@awebai/oats 0.29.4 → 0.30.0

package/docs/design/2026-09-18-captured-pi-host.md

@@ -1,205 +0,0 @@
-# Captured Pi print host — kernel implementation boundary
-
-This increment implements an explicit SDK host, not a reinterpretation of a Pi
-CLI executable. It is not interactive/plugin/private-provider qualification.
-The host is packaged by the existing `bin/` and `lib/` file inclusion; no new
-package metadata or mandatory model capability is introduced.
-
-## Selection and native behavior
-
-Choose the physical installed `bin/oats-pi-sdk-host.mjs` path as an explicit
-captured Pi executable. Operator args are exactly:
-
-```
---oats-pi-host 1 --mode print --thinking medium --sdk-root /physical/pi/package --sdk-version 0.85.1
-```
-
-Launch env is empty (no additional OATS contribution, NOT an empty inherited
-process environment); yolo is false; model is an exact `provider/id`. The kernel
-alone prefixes `--home H --session-dir S --model M --task-file H/TASK.md`.
-There is exactly one session-dir flag at prefix indices2/3. Unknown/duplicate
-args, arbitrary task/history/model flags and empty tasks refuse.
-
-The public SDK export is resolved from the exact selected package name/version
-and public export map without PATH/package acquisition or private imports.
-ModelRuntime.create() uses its normal native defaults. Native getAgentDir and
-SettingsManager.create preserve the user's ordinary profile/auth/helpers/OAuth,
-model config and persistence. There is no OATS credential selector/parser/store,
-no copied auth, and no null/empty/no-refresh production fixture configuration.
-
-The public ResourceLoader consumes only reverified retained instructions and
-exact skill files (`includeDefaults:false`). It has zero extensions and refuses
-resource additions. Public services, createAgentSessionFromServices,
-AgentSessionRuntime and runPrintMode remain the actual engine. The print host
-rejects session switch/import/fork/new operations before delegation. Native
-compaction/retry are not disabled. The captured exact model must exist; no
-first-available/default substitution occurs.
-
-## Admission, history and activation hold
-
-The execution-side host verifies the original index/incarnation/intent, native
-pending receipt/target, task input digest, capability approvals, selected launch,
-zero-plugin eligibility and projected curriculum. It revalidates for resource
-reload and startup; it does not admit another action or create an identity.
-
-S is `nativeHistoryPath(H)`'s sibling named `<history-basename>.pi`, never inside
-the native UUID-receipt directory and never the native auth/profile directory.
-Core hooks the EXISTING native transaction's record preparation point, preserving
-its record-ID/pending/target/replay/uncertainty logic. Legacy noncaptured renderers
-are unchanged. A captured Pi CLI recipe is held rather than silently converted
-or launched with unqualified ambient extension behavior.
-
-**Fail-closed dependency:** the record library must provide the complete v2 root
-witness AND discovery/read/each-append guard implementation. This kernel checks
-`CAPTURED_PI_RECORD_VERSION === 2` and these synchronous native-history APIs:
-
-- `inspectCapturedPiRoot(home, { incarnationId, sessionDir })`: read-only original
-  proof validation or truly absent fresh root; missing/ambiguous evidence holds.
-- `prepareCapturedPiStart(home, { incarnationId, intent, sessionDir, assertAuthority })`:
-  pending-v2 before exclusive creation; kernel-authority checks around effects;
-  durable witness outside S before dependent execution; original witness on reuse;
-  returns the existing native record ID, never a replacement action identity.
-- `assertCapturedPiStart(home, id, { incarnationId, intent, sessionDir })`: validate
-  the execution-side started-v2 receipt, original associations and root identity.
-
-The record owner's approved `history.json` v2 expected-ID claim is mutable
-record custody. For the exact strict Pi profile, Core's authority callback keeps
-index/incarnation/lifecycle/home/native-directory/baseline/target checks but does
-not duplicate that private codec or freeze its bytes to v1. The pinned read-only
-inspection, guarded preparation and started-v2 assertion own that validation.
-Re-entering inspection during a pending publication would incorrectly reject the
-record owner's own transition. Non-Pi retains literal v1 manifest equality.
-This narrow consumer correction was demonstrated by the combined package fixture;
-it is not acceptance of a path/self-marker or a weaker record implementation.
-
-The existing recordNativeStart execution must understand/check v2 before exec;
-all downstream guards must be present before the version advertises support.
-Until then, this increment refuses ZP1 BEFORE admission/backend effects. It does
-not fake a complete runnable path or bypass the separate record source exception.
-The API seam is subject to the parent-owned combined code review and coordinated
-record implementation; no record lib/bin edits occur in this increment.
-
-## Non-authorizing print-completion observation (version 1)
-
-The dispatch ID marker and native SDK return value answer different questions.
-Neither proves that the native process terminated successfully AND produced an
-attributable final turn. The small observation increment uses the existing
-native ID, original pending/index/started-v2 custody and witnessed S, not another
-resolver, admission, identity, transcript parser or observation service.
-
-Two exclusive 0600 JSON files live in S:
-
-- `.oats-pi-sdk-<nativeRecordId>.json`: `kind: oats.pi-sdk-outcome`;
-- `.oats-pi-process-<nativeRecordId>.json`: `kind: oats.pi-process-outcome`.
-
-Both have `schemaVersion: 1`, `authority` and `observed`. Authority contains the
-original home/sessionDir/incarnation/IntentRef/nativeRecordId/executionBinding,
-target/admitted input integrity and expected `{runtime: pi, provider, id,
-sdkVersion}` selection. It is attribution, NOT an additional authorization.
-The original attempt remains original even when same-ID reconciliation advances
-the index counter (PH1). Existing/partial/conflicting receipt files are not
-rewritten, adopted or cleaned up. File and directory sync plus custody checks
-surround publication. Before ANY content read, and again before every bounded
-read, the opened outcome descriptor must match the CURRENT physically named
-regular file under original-root proof. An earlier stat can itself come from a
-redirected ancestor; a restored root or a post-read exception is not FD authority.
-Size/version stability checks remain, with no bytes read to discover a mismatch.
-These files are neither root witnesses nor native JSONL;
-the record3API, native inventory, S formula, v1 readers and capture parsing are
-unchanged. Their presence never establishes root ownership.
-
-SDK `observed` is `{exitCode, observation}`. `exitCode` is the actual numeric
-return from native `runPrintMode`, never a default. The public runtime's
-synchronous `setBeforeSessionInvalidate` hook snapshots actual public session
-metadata after shutdown handlers and BEFORE native disposal. It copies only
-SDK VERSION, SessionManager header/id/file, session.model, and the final native
-branch assistant entry's id/provider/model/optional responseModel/stopReason/
-timestamp. That entry must agree with the last state message; an earlier
-assistant followed by another message is not a final assistant. No prompt,
-content/nonce, raw error, profile, credential or request-as-response is copied.
-Unavailable observation stays null; it does not prevent native disposal or
-manufacture a successful turn. The host publishes only after native print mode
-returns and original custody is reverified. Native print output is unchanged.
-
-Process `observed` is `{exitCode, source: launcher-wait-status}`. The COMMON
-captured Pi completion wrapper used by tmux AND Herdr saves the native execution
-chain's actual shell `$?`, then invokes the existing host executable's PRIVATE
-`--oats-pi-record-exit 1 --home H --native-record UUID --exit-status N` mode under
-the ORIGINAL kernel command environment. The native recorder execs the original
-host, so this is post-process wait status, not a sidecar's intent or the SDK
-return value. Nonzero/signaled shell status is retained literally; no signal
-number is guessed. The observer imports/creates no SDK/model/auth services and
-cannot change the enclosing shell's saved native status. This private mode is
-NOT accepted by the launch recipe grammar. Ordinary/Claude/Codex paths are
-unchanged, including explicit permission settings and native defaults.
-
-Only after guarded process-receipt publication does the observer atomically
-publish the EXISTING `.oats-start-exited` with its unchanged dispatch-ID-only
-contents. Legacy readers remain correlation-only. If custody or publication is
-uncertain, missing evidence is held; there is no success fallback, repair or
-new native attempt. A failed process can have a process-only observation; a
-successful-looking SDK receipt without process observation is incomplete.
-
-### Public read-only query
-
-```
-oats session inspect --deployment /deployment --resolution <retained-id> \
-  --home /original/home --native-record <native-UUID> --json
-```
-
-For a helper, use the SOURCE resolution plus `--helper <exact-source-map-key>`.
-There is no current-context lookup. Inspect accepts only home/helper/native-record
-and json after the captured selectors; request/retry/model overrides are refused.
-It admits/provisions nothing, calls no backend/model, and does not forge process
-environment to inspect evidence. Existing source/helper and physical custody
-checks plus pinned `assertCapturedPiStart` surround every receipt read and
-native session-path check. The narrow query requires the ORIGINAL current
-pending dispatch; an old ID after another dispatch replaces pending, a deleted
-incarnation, changed curriculum/input or uncertain root remains held. Files in
-S remain retained; this is not a new historical-incarnation recovery API.
-
-The normal JSON envelope's `result.outcome` has `schemaVersion: 1`,
-`contract: oats.pi-print-completion`, `nonAuthorizing: true`, `authority`,
-`status: succeeded|failed|incomplete`, `qualified`, `processExitCode`,
-`sdkExitCode`, `finalObserved`, nullable `sdk`, and evidence-presence flags.
-Envelope `ok: true` means the QUERY succeeded, not that execution did.
-
-`qualified: true` requires BOTH actual exit codes0, the observed selected SDK
-version/header-v3/home/session-id/file, observed session and final assistant model
-tuples equal to the retained selection, and final `stopReason: stop`. Missing
-facts, mismatches, truncation/tool-use/error/aborted or nonzero status never pass.
-This qualifies only **native-print completion**, NOT meaningful task completion,
-automatic SOURCE helper execution, learning/privacy/capture correctness,
-installation or release. A gate must still compare the expected original IDs,
-consume protected native capture, and establish its domain-specific result.
-Optional native `responseModel` is reported literally, not substituted for a
-missing value or treated as cryptographic provider-side model attestation.
-Receipts share the existing trusted execution-host/filesystem boundary; they do
-not introduce signatures or promise detection of coherent privileged tampering.
-
-Packaging needs the new `lib/captured-pi-outcome.mjs` alongside the existing
-host/custody/SDK modules and bin. Existing lib inclusion already ships it; no
-package/version metadata changes are needed.
-
-## Evidence and honest results
-
-Targeted unit tests use explicit SDK doubles to check parser/assembly argument
-flow, normal native service initialization, loader and before-delegation guards.
-They are NOT another SDK-consumer/model proof. Real retained preparation/scaffold
-checks establish missing-record-support refusal before native effects. Existing
-inert native regression checks cover unchanged custody/replay/placement behavior.
-The previously completed public SDK consumer proof remains separate and closed.
-
-`dispatchAccepted` proves native dispatch acceptance, not a model response.
-The existing `.oats-start-exited` ID marker still does not contain a success code.
-The new completion receipts/query are implemented as bounded kernel consumers;
-unit doubles and inert shells are not actual SDK/model/backend qualification.
-The coupled integration fixture REQUIRES actual complete record-v2 source (no
-skip/stub of record support), exercising kernel/record/CLI wiring on both backend
-paths with an explicitly FAKE SDK and inert transport. The bounded negative case
-uses an existing unwitnessed S and retains legacy CLI refusal, rather than an
-obsolete assumption that record support is absent. Neither fixture is actual
-native SDK/model/backend qualification.
-Real acceptance must observe SDK-created native session/assistant turns and
-actual capture/recall under the completed witness guards, on BOTH selected native
-backends. Do not fabricate process names, sessions, worker runs or learning.

package/docs/design/2026-09-18-first-cut-release-checklist.md

@@ -1,131 +0,0 @@
-# First-cut retained execution: installation and release checklist
-
-This is an execution checklist for the release owner, **not a completed-release or
-runtime-readiness claim**. The first-cut goal is an actual runnable packaged retained
-path. A narrowly working profile does not establish full Desktop/plugin/lifecycle or
-private-provider parity. Developers deliver code; the parent reviews combined code,
-integrates, runs real acceptance and is the sole publisher. No independent-reviewer
-wait is required by the current human workflow.
-
-## 1. Freeze what is actually being shipped
-
-- Record exact framework commit/tree, provider commit/manifest and runtime-consumer
-  revision; retained resolutions, source/helper bindings, protocol selection and
-  emitted witnesses must agree with that combination. Prior closed source gates are
-  evidence at their old pins, not qualification of the new SDK host or protocol22.
-- Include the explicit print-mode SDK host/parser/native-services assembly only when
-  its complete retained eligibility/curriculum, kernel-owned task/args/thinking/history
-  controls and approved external session-directory identity witness are implemented.
-  Path-only history attribution is not an original-root identity witness.
-- Launch the user's already-authenticated harness through its normal native profile,
-  auth/helpers/OAuth/model configuration. **No auth-file selector, CredentialStore,
-  key/provider allowlist, empty production store, profile substitution, credential
-  inspection/copy or new login questionnaire.** Strict selected curriculum/history is
-  a separate boundary, not a reason to replace native authentication.
-- Preserve selected hard runtime/bridge/plugin requirements. If the first supported
-  host is zero-plugin, a profile selecting an unqualified plugin/bridge remains held;
-  do not remove that requirement to advertise default-OKF success.
-- Record-runtime changes remain limited to the exact additional boundary explicitly
-  assigned by the parent after resolving its scope. Do not import held patches or
-  bypass the guard. No general record-package rewrite, bootstrap grammar, role-source
-  adoption or proposed retirement semantics is part of this checklist.
-
-## 2. Metadata and package surfaces (parent-controlled)
-
-Choose an actual unused release version **V** after the final code/pin selection;
-verify it against existing published artifacts. Do not invent a tag or claim that
-source/API2/protocol22 alone establishes a package compatibility floor.
-
-| Surface | Required check/update |
-|---|---|
-| `package.json`, `package-lock.json` | Kernel version/root lock agree; SDK host's real runtime dependencies/import resolution are declared and available after installation, not accidentally from a development/global checkout. Keep manifest exports usable. |
-| `packages/pi/package.json` | Version agrees with kernel; actual supported SDK/native package dependency contract and extension resource paths are truthful. |
-| `packages/desktop/package.json`, `packages/desktop/package-lock.json` | All three release manifests and lock root entries use V. This metadata alignment does not mean complete Desktop behavior is qualified. |
-| Provider distribution/capability manifests | Selected provider version and minimum OATS floor must include its actual supported wire/input/runtime requirements. Source-main with old metadata is not a released compatibility claim. |
-| `scripts/okf-source-inventory.json`, `capabilities/oats-okf/`, `package-catalog.json` | If shipping an updated default provider, use the authoritative provider source and existing mirror/finalization tooling, then verify exact retained closure/canonical aliases and real published refs. Never hand-edit the mirror or point a catalog at an invented tag. |
-| `docs/release-notes/<actual-tag>.md` | Exact tag-matching filename exists before build/tag. List implemented profile/actual gates and every remaining refusal; no real-worker/learning or model-health claim from inert output. |
-
-The existing `.github/workflows/release.yml` and `scripts/release-lane.mjs` derive V
-for **root, Pi and Desktop**, using `--allow-same-version`. The older release skill's
-blanket two-package/no-same-version description is not the current implementation.
-No developer package/version edits are authorized by this checklist alone.
-
-## 3. Artifact/install boundary
-
-Release owner uses the existing release tooling; this lane performs no pack/install/
-publish operation. Build from the exact reviewed commit, not moving HEAD.
-
-1. Run the applicable syntax/project/package gates on that assembled tree. Confirm
-   the new SDK host/bin, parser, native adapter and all runtime dependencies are in the
-   **actual** kernel tarball; Pi bridge resources must also be in its tarball. Verify
-   no deployment config/lock, agents/instances, credentials, private KB or scratch leaks.
-2. Keep canonical Git payload aliases intact for selected capabilities. npm's omission
-   of source symlinks does not make its copied provider subtree a self-contained Git
-   distribution; use the supported complete provider acquisition path.
-3. Pack kernel and Pi bridge once and record hashes. Install those exact tarballs in a
-   clean external location, outside the source checkout. Confirm installed CLI/core/
-   SDK-host dependency resolution with no repository-module or unselected resource
-   fallback. A checkout scaffold is not an installed-artifact test.
-4. Use existing public `prepare --request` with an explicit valid source export,
-   deployment and workspace-or-standalone context. Approval/reprepare is explicit;
-   no private scratch input/current-config hole filling. Do not assume the parked five
-   roles or public bootstrap package have been adopted/published.
-5. Inspect retained instructions/skills/launch inputs and preserve unsupported-profile
-   refusals. Create only a new owned home; do not overwrite old instances/state. A
-   source-complete helper is selected by its **SOURCE edge**, not a bare helper-ID
-   start. No-launch can still run admitted hooks and is not a real session gate.
-
-## 4. Parent-run real first-cut acceptance
-
-Use the already assigned single provider/native path rather than inventing a second
-matrix. Pin and retain its real results separately from old inert/seeded evidence.
-
-- Both tmux and Herdr are required, not a deferred optional backend. For Herdr select
-  the exact supported protocol and explicit operator-managed executable/socket; the
-  server snapshot must match it. IDs are observed receipts. No automatic daemon start,
-  tmux fallback, fabricated caller context or focused user session.
-- Run an actual retained primary and exact SOURCE-helper through the new host, using
-  normal authenticated native harness operation. Verify an actual turn/task result,
-  selected curriculum and original session-directory identity/history continuity.
-  Source deletion/current-config poison must not redirect the retained selection.
-- Record dispatch acceptance separately from model health, task completion, capture,
-  judged knowledge delivery, acceptance and fresh-reader learning. With default OKF,
-  use the provider's explicit private owned directory-store path and required selected
-  launcher/bridge; do not fake a worker/process/transcript or convert seed data into
-  learning evidence. If a required bridge is unqualified, report the exact hold.
-- Preserve source versus helper execution authority and original incarnation/intent/
-  pending/history receipts across replay/restart/failure. Same-ID ambiguity never
-  authorizes redispatch. Missing public retirement/recovery remains a documented hold,
-  not permission to call a legacy/private fallback or delete an uncertain home.
-- Credential/account/private-messaging authority is not granted by backend/model success.
-  External human/admin private-aweb evidence cannot be manufactured by this gate.
-
-## 5. Publication and honest first-cut status
-
-The existing tag workflow publishes only after build/test/smoke **and Desktop matrix**
-jobs are green; npm kernel then Pi, GitHub release/assets last. The existing runnerless
-lane can stage exact artifacts and publish its two staged npm tarballs; the parent owns
-whether/how to use that documented route. Do not edit away gates to meet a clock.
-
-Before publication retain exact source/tag ancestry, version probes, package checksums,
-provider provenance and completed gate receipts. Verify published versions, package
-integrities/source identity and installed behavior afterward. Do not move a tag after
-any publication; distinguish partial npm publication, GitHub assets and bump-PR results
-before retrying the appropriate existing phase. No force-push or credential repair here.
-
-If packaging or a required real gate is incomplete at the first-cut deadline, deliver
-its exact candidate artifacts plus named hold; label it **candidate**, not published or
-usable for the blocked profile. Do not reset the agreed clock or conflate npm readiness
-with all-platform Desktop delivery.
-
-### Explicit limitations to carry into release notes unless genuinely closed
-
-- Adapter20/22 unit support is not public caller/schema22 or real-server readiness.
-- SDK feasibility/inert dispatch is not an actual normal-auth model turn.
-- Zero-plugin success is not eligibility for a selected plugin/bridge/managed profile.
-- Directory/history custody is not completed public retirement, wake or recovery.
-- Source/provider gates are not actual worker/capture/learning/private-aweb proof.
-- A packaged CLI/Pi path is not complete Desktop/platform behavior or rollout parity.
-
-Every open item retains its existing refusal and owner. This checklist changes no
-runtime semantics, metadata, release automation, live state or production authority.

package/docs/design/2026-09-18-herdr-protocol-compatibility.md

@@ -1,60 +0,0 @@
-# Explicit Herdr protocol20/22 adapter compatibility
-
-The host-local adapter in `lib/herdr.mjs` supports exactly numeric protocols **20**
-(documented0.8 baseline) and **22** (documented0.9.0 native schema). This is explicit
-selection, not version negotiation or proof of an installed/running backend.
-
-## Shared adapter interface
-
-- `HERDR_PROTOCOL` remains20 for existing legacy/default behavior. In particular,
-  the unchanged legacy `ensureHerdr` path is not silently switched to22.
-- `HERDR_SUPPORTED_PROTOCOLS` is the frozen `[20,22]` set.
-- `isSupportedHerdrProtocol(value)` accepts only those numbers; no strings,
-  omitted/null value, protocol21, future number or range is accepted.
-- `herdrSnapshot(target, io)` requires a supported explicit target protocol before
-  issuing a command, then requires **snapshot.protocol === target.protocol** and a
-  pane inventory. A20 target cannot accept a22 snapshot, or vice versa. Missing or
-  malformed observations refuse; saved target metadata is not upgraded/downgraded.
-- `allocateHerdr` also validates the selected protocol before workspace creation,
-  preserving it alongside the actual returned workspace/pane/terminal identifiers.
-  As before, callers own preflight/admission and the pending/observed-target ledger;
-  allocation is not a new independent lifecycle transaction.
-- `validHerdrTarget` recognizes both explicit protocols with its existing target
-  checks. Delivered strict workspace/pane/terminal uniqueness, explicit socket
-  transport, replacement refusal, run/input/stop behavior and server-error handling
-  are retained. No daemon, focused target or alternate-backend fallback is added.
-
-The captured caller and generated request/target schema must use the same set and
-retain selected/admitted/observed target equality. That integration belongs to the
-lifecycle owner (`lib/captured-session-backend.mjs`, core and shared schema generator),
-not this adapter-only change. A current const20 caller still correctly refuses22 until
-that separate integration lands. API availability is not protocol/host/model readiness.
-
-## Documented native0.9 subset
-
-The bundled protocol22 schema retains `.result.snapshot`, panes/agents and their
-workspace/pane/terminal identifiers, `.result.root_pane` allocation identifiers,
-agent status values and process-info fields used by the existing adapter. The CLI
-spellings remain `api snapshot`, `workspace create --cwd ... --label ... --no-focus`,
-`pane run <id> <command>`, `pane process-info --pane <id>` and `pane close <id>`.
-
-These observations justify reusing the adapter, not treating arbitrary later protocol
-numbers as compatible. Client version, server version, endpoint-protocol generation,
-OATS API version and native request version remain distinct facts. Explicit existing
-operator-managed executable/socket and actual server protocol must be qualified by the
-real acceptance gate. No `HERDR_ENV` value is fabricated or focused user session used.
-
-## Evidence boundary
-
-`test/herdr-protocol.test.mjs` uses injected inert command responses, not a live
-server or process:20/22 preservation, unknown/missing refusal before commands, exact
-snapshot mismatches, actual-ID projection, explicit command/socket transport, strict
-ambiguous/foreign/replaced targets and stop/input behavior. Existing adapter tests
-remain applicable. The controlled scaffold probe composes resources and normally
-retires without invoking a backend.
-
-This slice does not qualify public native protocol22 integration, real model health,
-Pi managed-resource eligibility, worker completion, public retirement/recovery, private
-messaging, release floors or production. None of those guards is removed. Ordinary
-already-authenticated harness operation remains separate from this backend adapter;
-no auth-file selector, credential copy or production profile substitution is introduced.

package/docs/design/2026-09-20-redesign-program-board.md

@@ -1,142 +0,0 @@
-# OATS redesign — program board
-
-**Purpose:** the one accurate view of every work stream in the redesign, what is on main, what is in flight, who owns it, and what blocks it. Lead: `oats-expert` (redesign lead). Updated whenever anything merges, is returned, or reality changes. Older per-lane boards are superseded by this file.
-
-**Last update:** 2026-09-24 14:10Z · **0.25.0–0.25.7 PUBLISHED** (0.25.7 = v2 deployment root is a configuration boundary) (0.25.6 = decision 27 kernel half + Desktop 10B-0 terminal owner leases, native gate 23/23) (workspace model A–C; team-review fixes; operator-rebuild round; OATS_SOUL_ID; quarantine-retry fix; launch meta + catalog pins) · **OKF v2.1.4 + oats.aweb v1.12.0 TAGGED and pinned** · **decision 27 accepted; K1′/K1″/K2 kernel PR next** · **oats.aweb 1.13.0 (#110) queued** · **Desktop 10B-0 resumed** · Phase D plan next · **Desktop engineer paused by the human** (10B-0 uncommitted foundation preserved; resume is the human's call; 0.24.14 to be cut from a maintenance branch off `e5cdaf95` when its PR lands) · parity pipeline ⏸.
-
-Legend: ✅ on main/published · 🔄 in flight (PR/branch) · 🟡 preserved, not adopted · ⬜ not started · ⛔ blocked
-
-## Streams at a glance
-
-| # | Stream | State | Owner | Next action |
-|---|---|---|---|---|
-| S1 | Knowledge capability contract rework (kernel↔provider boundary, OKF 2.x) | ✅ OATS 0.24.1 / OKF 2.1.1 published | P | done for this phase |
-| S2 | Workspace/Portable Souls adoption of the OATS repos | ✅ **FIRST SECOND-OPERATOR PUBLICATION (735296c5, 2026-09-21)**: fresh machine, published definition alone, no `launch` → `status: prepared`, resolution `sha256-f11c433c…`, zero problems. ❌ then OKF `check` → `needs-configuration / provider-not-qualified`, **no message/key/origins**, identical for `harvest-runtime` pi and claude — OKF's check phase is code-only and folds ≥4 causes into one code (P, OKF 2.1.3). ⏳ Pi `launch` blocked by kernel ifInstalled defect (L, 0.24.5). Earlier: ✅ knowledge: bound to public `oats-knowledge` via OKF 2.1.2 from a fresh machine, four kernel versions · ✅ messaging normalizes; `wider` deadlock gone; named reasons in one run · ❌ **operator's amended verdict (9816b8ec): no resolution can publish — behind `responsibleHuman`, helper composition refuses because `oats.core` and `oats.aweb` ship `inject` without `helperInjection`** (OKF adopted the contract; its siblings did not). Both remaining blockers are packaging, not operator input. Fix: [decision](https://github.com/awebai/oats/blob/main/agents/oats-expert/soul/knowledge/decisions/helper-injection-policy-on-every-injecting-capability.md) — core `inherit`, aweb `omit`, framework release check, attributed early refusal · then unchanged re-run | lead, Antares | oats.framework 1.1.3 + aweb 1.11.2 + pins; re-run |
-| S3 | Messaging capability readiness on the new infrastructure (aweb) | ✅ aweb 1.11.0 released · ✅ **catalog + six editions pin v1.11.0 (0.24.2)** · ✅ **second-operator `launch` re-run on 0.24.6 (Antares, 2026-09-21)**: resolution `sha256-0cbedec4…` published WITH launch selection {pi, model}; helper `oats.okf:memory-harvest` resolved alongside; hard runtime row (`delivery: channel`) refused attributed with capability/slot/runtime/package/install/origin — no bare `needs-configuration`. `check` half parked with OKF 2.1.3 by direction | P, lead | Antares re-run |
-| S4 | Official capabilities `oats.core` / `oats.setup` + explicit default + onboarding `oats-setup-expert` | ✅ D1, D2, **D3 merged (PR35)**: `oats onboard` verified live (acquire 1.1.1 → setup expert with both caps → scaffold composes the five capability skills, no legacy) · `oats.framework` 1.1.1 tagged | P, L | done; Desktop surfaces → S8 |
-| S5 | Official marketplace = reviewed list in oats repo | ✅ D4 merged · ✅ `oats.framework` 1.1.1 listed (`oats.core`, `oats.setup`, `oats.knowledge-theory` aliases) | M | Desktop view → S8 |
-| S6 | Five expert souls created in the oats repo (`souls/<name>/`) | ✅ five + `oats-setup-expert` on main, all declaring `oats.core`, exported + imported | M, L, lead | legacy `agents/` cutover after S7 proof |
-| S7 | Centralised per-soul knowledge in `oats-knowledge` (migration + PR-only learning) | ✅ **MIGRATED — PR #2 merged → main `7148a36`, 58 concepts / 35k words from 399 legacy** (kernel 26, expert 18, desktop 13, assistant 1, market-research chartered empty); option A roster; theory + no-code-teaching rule; two workflow passes (24 agents) + lead review; validator 58/0/0; ownership 14/14 · ⏸ harvest OFF until new souls run from the base (human) | lead | next: legacy `agents/` decommission with the `~/OATS` cutover |
-| S8 | Desktop parity with the redesign (Redesign v3, aweb palette, discovery-first control panel) | 🔄 **STARTED 2026-09-22**: existing `oats-desktop-engineer-1` retrofitted with an aweb identity (spawn hook replayed, `capabilityMeta` persisted, session reloaded); redesign artefacts copied into its home; brief sent (f16eed3f): merge main (0.24.5) first, then PR slices — shell/palette/sidebar → right panel follows selection → Souls view → **Capabilities view incl. official catalog (human's required feature; server-side via kernel catalog API, never auto-acquire/auto-trust)** → Knowledge/Tasks adapters → remainder. Lead reviews/merges each slice. **Decisions 2026-09-22:** human's later palette/row instructions supersede the HTML where they conflict; grouping is agent-group (cross-repo clusters), not repo; kernel seam `oats catalog --json` merged (PR46 `524180b7`, ships 0.24.6); the Juan-host fresh-engineer plan is superseded — this instance owns S8. | oats-desktop-engineer-1, lead | per-slice PRs | ✅ **Slice 2b MERGED** (PR65; Connections + PR card; 1654/1654) · ✅ **K5+K6 MERGED** (PR63; readiness quartet/signatures/enforced child policy; spawn --preview/--base/@native-default) · ✅ **K7+K8 MERGED** (PR64; typed instance events; schedule recentRuns) · ✅ **K3 MERGED** (PR62; `instance stop --plan|--apply`, `retire --plan`, retention-by-default retire with re-home) · ✅ baseline flakes fixed (PR61) · ✅ **P1 decided + K1 `remote` MERGED** (PR60) · ✅ **Components (frame 10, existing data) MERGED** (PR59; 1606/1606) · ✅ **Slice 2a MERGED** (PR57; Git panel on K1; legacy gitState collector removed) · ✅ **v0.24.7 tagged/published** (tag → `c923d81b`) · ✅ **Slice 3 MERGED** (PR54; Souls + Sources on K4 soulsApi 1; 1503/1503) · ✅ **K1 MERGED** (PR53; `oats instance git|diff`, instanceGitApi 1; DTO in docs/desktop-cli-api.md) · ✅ **K4 MERGED** (PR52; `inspect --json` soulsApi 1: declarations/provenance/readiness/sources; onboard records provenance; DTO in docs/desktop-cli-api.md) · ✅ **Slice 7a MERGED** (PR51; frame 07 Active overview on /api/panel; anonymous groups; 1466/1466) · ✅ **Slice 6a MERGED** (PR50; Spawn modal frame 02 on existing seams; launchConfig restored; 1435/1435) · ✅ **Slice 4 MERGED** (PR49; Capabilities view: official catalog via `oats catalog` + classic inventory; 1386/1386; server boundary reviewed) · ✅ **Slice 1b MERGED** (PR48; contextual panel + focus mode; 1238/1238) · ✅ **Slice 1a MERGED `508c4b5f`** (PR45; 273/273 real jsdom; gates green) → v0.24.6. **Plan + seams recorded: [`docs/design/2026-09-22-desktop-parity-seams.md`](2026-09-22-desktop-parity-seams.md)** — slices 1a–8, seams K1–K8/P1, five policy decisions **DECIDED 2026-09-22 under delegation** — see `decisions/desktop-parity-lifecycle-and-policy-decisions.md`.
-
-## S1 — Knowledge capability contract rework
-- ✅ Provider-neutral contract, binding wire v1, helper/input contract, retained execution: OATS 0.24.0 + OKF 2.1.0 (f20f8e57) published.
-- ✅ **oats-okf PR4 merged (9f90ee9) → OKF v2.1.1 (01b48dfc)**: Claude/Codex helpers with complete approved closure accepted; strict-Pi unchanged. Framework mirror/inventory finalized, catalog ref and `souls/oats-expert` source → v2.1.1 (16c5c939, 87292f40).
-- Open: strict-Pi "enriched profile" remains unqualified (documented, not hidden).
-
-## S2 — Workspace adoption of the OATS repos
-- ✅ **PR23 merged f6d5a89b**: `oats-workspace.yaml` (7 members, `imports: []`), `oats.yaml` (exports souls/oats-expert, oats-package, capabilities/oats-authoring), transitional `souls/oats-expert/` edition, the workspace adoption guide (removed in 0.26.0), layout tests.
-- ✅ **PR24 merged da38e5a9**: deletion of `skills/oats-portable-setup` + `oats inspect --request` read-only seam (ACCEPTED as the public inspection route); full gate 1621/0.
-- ✅ Member `oats.yaml` merged to main: oats-okf #3 (fec78a20), oats-aweb #1 (069ea2f6), oats-authoring #1 (54183a6a), oats-jira #1 (2f855daf).
-- ✅ oats-dev#1 (main 6e164ee3) and oats-linear#1 (main a2121e48) merged after Juan granted write access — M's exact commits 0434f4ef / 8c183c37.
-- ⬜ `imports:` pin of `souls/oats-expert` at its published revision (after member indexes).
-- ⬜ Fresh local deployment from the shared definition (P1.5) — the real acceptance gate.
-
-## S2 — second-operator gate report (Antares, Juan's machine, 2026-09-20)
-Fresh dir, local `@awebai/oats@0.24.1`, no prior state. `inspect --request` → ready-for-preparation, membership eligible, source `souls/oats-kernel-expert@caa341f3`. `prepare` resolved and materialized `oats-package@caa341f3`, `oats.okf@v2.1.1`, `oats.aweb@v1.10.3`, `oats.core`, `oats.setup`, `oats.knowledge-theory` + soul; artifact-set approvals worked. Terminal: `needs-configuration` + `provider-not-qualified` (aweb 1.10.3 has no binding interface) — expected. Seams — **all fixed in PR36 (913c4f9e), shipped in 0.24.3**:
-1. `inspect --request` requires `workTarget`; `prepare --request` refuses it (`buildFreshPreparationRequest` exists but the CLI never uses it).
-2. `prepare` on the absent deployment inspect blessed → raw `ENOENT` + host path through the JSON envelope.
-3. `prepare` writes lock v3; `oats trust <cap> --dir` rejects it (`unsupported lockfileVersion 3`) → dead end from `--help`.
-4. The working `trust --deployment --artifact-set <sha256>` route is absent from `--help`.
-5. Problems carry `origins: []` and no slot/capability, so with more than one unresolved slot the operator cannot tell which slot a `needs-configuration` refers to (Antares needed three runs and an ablation table). **Root cause of the original identical pair (L's trace, confirmed by P and by Antares' settings-aware run):** both OKF `normalize` calls refused because the request had no OKF runtime settings (`bindings-file`, `state-dir`); the identical pair is correct output for that input. With settings, OKF normalize diagnostics DO reach the operator (a malformed `acceptedBranch` yields a distinct `invalid-binding`); a structurally valid locator to a nonexistent repo is correctly not distinguished until OKF `check`. Fix (0.24.3, PR36) = attribution by slot/capability/phase/origins + kernel-fixed messages. Precision: the kernel names the missing item only where it knows it (missing binding interface: id/version/slot); for a provider `needs-configuration` it cannot name `bindings-file`/`state-dir` because OKF 2.1.1's wire is code-only — OKF 2.1.2 (assigned to P) adds the fixed safe message naming the setting. Antares' earlier "no signal at all" framing is withdrawn by its author.
-
-## S2 — second-operator re-run on 0.24.2 (Antares, Juan's machine, 2026-09-21)
-- Found the five expert imports still pinned at `caa341f3` (aweb 1.10.3) while the setup expert was at `0aad753c` — the one repinned soul was the one that never exercises aweb. Fixed: all six imports at v0.24.3 `3156e4de` (638206b9); new layout guard fails when a pin's provider requirements lag the current edition (3ce40aaa, verified to catch the miss).
-- **aweb 1.11.0 qualifies**: via the direct source route on current main, `provider-not-qualified` disappeared → `approval-required` → after approval both slots on the settings hold. Confirms L's root cause.
-- `oats onboard --workspace git:github.com/awebai/oats` from a fresh dir: clean (acquired 1.1.1, both caps, spawn printed not run); scaffold composed exactly the five capability skills, both trusted, no hooks.
-- Seams 1–5 reproduced identically on 0.24.2 (baseline); fixed in 0.24.3. Gate decisions given: `harvest-model` arbitrary for the gate; aweb slot `delivery: session` without a private-team binding → expected typed `needs-configuration` naming the binding (Juan's team identity is never guessed).
-
-## S2 — settings-aware run (Antares, direct source route on main, aweb 1.11.0, 2026-09-21)
-- With `bindings-file`/`state-dir`/`harvest-runtime: pi` and the public `oats-knowledge` bound as base `oats`: **the knowledge slot binds** (OKF problem gone). `harvest-model` is optional per manifest; aweb 1.11.0 declares exactly one setting (`delivery`).
-- **aweb 1.11.0 is the only remaining hold** (`needs-configuration`, identical for `delivery: session` and `channel` on 0.24.2's unattributed output). No resolution publishes → OKF `check` probe not reachable yet. 0.24.3 run will show the attributed aweb message (expected: private-team binding / Pi session-input).
-
-## 0.24.5 — four small fixes, lead-implemented (2026-09-22, PR43 → `38b6c028`)
-
-Human authorised lead implementation after new spawns in the development deployment were blocked by a correct `pi-profile` drift refusal (profile pins bridge 0.23.2; global Pi has 0.24.0 — deployment policy, the human's re-pin). Merged: (1) retire recovery derives the branch from the worktree (drift recorded in `recovery.json`; detached HEAD recovers at its OID) — unblocks the three peers; (2) captured launch: `ifInstalled` rows satisfied by absence, hard rows refuse attributed (slot/capability/runtime/package/manifest `install`); (3) helper-injection refusal attributed; (4) `onboard --workspace` reads `package-catalog.json` from the workspace revision (bundled = fallback; `OATS_PACKAGE_CATALOG` = override; result `catalog.origin`; drift refusal names the lag). Full gate 1665/1661/0/4. Rule: `prepare` never ends in a bare `needs-configuration` after selection. Lesson: `lessons/pinned-release-lags-installed-release.md` (three lag refusals in one day). ✅ **v0.24.5 PUBLISHED** (npm both, GH release 7 assets, bump #44). ✅ **`~/OATS` re-onboarded clean on 0.24.5 with NO override**: `catalog.origin: workspace`, framework 1.1.3, setup expert from `7416d84e` — fix 4 proven the way a second operator meets it. ✅ **Three stuck peers retired by the normal path** (fix 1 proven live): each recovery records `branchDrift` (recorded vs worktree branch) and preserved home + untracked bytes + nested repos; L's recovery shows it had begun the 0.24.5 assignment on its own branch (superseded by PR43, preserved). Roster: only the lead and the Desktop engineer remain in the development deployment. Next: spawn the setup expert in `~/OATS` (human runs).
-
-## Cutover started: `~/OATS` onboarded from the public workspace (lead, 2026-09-21 23:55Z)
-
-Kernel 0.24.4 installed globally; `oats onboard --dir ~/OATS --workspace git:github.com/awebai/oats` → `oats.framework` 1.1.3 acquired and exact-locked (lock v2), `oats.core` + `oats.setup` selected, `oats-setup-expert` copied from the workspace's pinned edition (`7416d84e`, workspace revision `c82a96af`), layers `none`. First attempt refused `integrity-drift` because the kernel's **bundled catalog snapshot** still listed framework 1.1.1 — correct refusal, misleading read; remedy `OATS_PACKAGE_CATALOG=<main's list>`; lesson `lessons/bundled-catalog-lags-the-reviewed-list.md` (proposes onboarding read the catalog from the workspace revision). Next: spawn the setup expert to adopt the workspace (knowledge → public `oats-knowledge` via OKF 2.1.2; messaging → aweb 1.11.2 or none) with explicit approvals; then the five expert souls run from the central base and this checkout becomes secondary. Harvest stays off until then.
-
-## S2 — FIRST SECOND-OPERATOR PUBLICATION + `check` finding (Antares, 735296c5, 2026-09-21)
-
-Verified wave (aweb v1.11.2, framework v1.1.3, main cd3d4913, imports 7416d84e). Fresh deployment, unchanged request minus `launch`, synthetic `responsibleHuman`, `wider: []` → `{"status":"prepared","resolution":{"id":"sha256-f11c433c…"},"executionBinding":{…},"problems":[]}`, exit 0, empty stderr. **An operator holding none of the authoring state produced an executable resolution from the published workspace definition — the first.** Helper-injection fix confirmed from outside; `ignored` shrank to `["operator"]` correctly.
-
-Then P's OKF `check` probe against the published resolution (contacted the public repository): `{"status":"needs-configuration","problems":[{"code":"provider-not-qualified"}]}` — bare; the operator dumped the shape to prove nothing was elided. Second resolution with `harvest-runtime: claude`, no model (`sha256-1aa5ab9a…`, prepared) → identical. Traced by lead: OKF 2.1.2 `checkPhase` (`binding-wire.mjs` L256–282) returns `problem(code)` only and maps unadmitted action / >64 bases / `E_OWNER|E_BASE|E_VALIDATION|E_DIRECTORY_GIT|E_CONFIRM` all to `provider-not-qualified`; the kernel's check path already passes declared reasons. Fifth of the family. Operator's verdict adopted: *"A second operator reaches, resolves, approves and publishes an executable resolution from the public definition alone … The OKF check readiness probe then refuses as provider-not-qualified with no reason, no key and no origins, and the refusal is independent of the harvest runtime."* Decision amended: every check problem carries a fixed reason distinct per cause. **Assigned P: OKF 2.1.3** — ahead of 0.24.5 by the operator's priority, which the lead accepts (publication works; check is the next thing every operator hits). **Operator narrowed the cause from outside (9c9dc404), each elimination tested:** not action kind, not base count, not `validateBase` (validator from the 2.1.2 artifact against the public `knowledge/`: 25 concepts, 0/0), not directory-git, not runtime; staging IS reached (nonexistent repo → `unavailable/provider-unavailable` in 0.65s; real → `needs-configuration/provider-not-qualified` in 1.66s). Left: `verifyPublicationTree` (E_CONFIRM/E_BASE) or `checkKnowledgeRuntime` (E_OWNER; not a naive owner mismatch — public base owner = edition owner). Forwarded to P so 2.1.3 reasons split exactly these. Sharp edge noted: the validator at the repository root fails on bundle-root-absolute links — a wrong root will look like an invalid base. **Acceptance plan corrected by the operator (bbbb6bdd):** the two retained resolutions captured and approved the exact 2.1.2 artifact and `runCapturedProviderBinding` executes exactly that, so re-probing them must still return code-only — that is immutability working. After 2.1.3 is pinned: keep the old resolutions as before-evidence, prepare NEW resolutions from the same two request shapes with only the OKF source moved to v2.1.3, approve their exact artifact sets, run the same probe → valid before/after.
-
-## Helper-injection gap FIXED + next blocker found (lead, 2026-09-21 20:30Z)
-
-- ✅ **oats.framework 1.1.3** (`oats-framework/v1.1.3` @ `6108bfbb`): `oats.core` 1.0.1 declares `helperInjection: inherit`. ✅ **aweb 1.11.2** (`v1.11.2` @ `a671884`): `helperInjection: omit`, manifest-only. Bundled copy byte-synced; catalog `oats.aweb` → v1.11.2, `oats.framework` → v1.1.3; six editions → aweb v1.11.2; six imports → `7416d84e`. Release check added: every injecting framework capability declares its helper policy (jira/linear/review pending upstream, not required by any edition). Notes: `docs/release-notes/oats-framework-v1.1.3.md`.
-- **Lead probe from the published 0.24.4 tarball, operator's request shape + synthetic `responsibleHuman` + `wider: []`:** helper composition now passes. **Without a `launch` block the resolution PUBLISHES** (`status: prepared`, resolution + execution binding) — first end-to-end publication from public definitions. **With the Pi `launch` block it refuses** on a bare `needs-configuration: runtime package requirements need retained runtime roots and a qualified loader`: kernel defect — the captured path treats aweb's `ifInstalled: true` Pi floor (`npm:@awebai/pi ≥0.3.10`, only if present) as a hard block, and refuses with no `details`. `delivery: channel` gives the byte-identical message. Lesson: `lessons/captured-launch-ignores-ifinstalled-and-refuses-bare.md`. **Assigned to L with the retirement defect → 0.24.5 (kernel), plus attribution for both bare refusals.** Operator's re-run: after 0.24.5, or now without `launch` to witness publication.
-
-## S2 — operator's self-correction (9816b8ec, 2026-09-21): packaging gap behind `responsibleHuman`
-
-The operator supplied a deliberately synthetic `responsibleHuman` (`gate-probe-not-a-real-human`; accepted — `humanRef` checks only provider + non-empty id, i.e. an accountability claim the code records but does not verify) and preparation refused: `needs-configuration: new helper injection requires an explicit capability policy` (`lib/helper-injection-policy.mjs:38`), a bare top-level error with no `details`/attribution. Cause verified from the published manifests: `oats.okf` declares `helperInjection {omit}`; **`oats.core` (`injects/oats.md`) and `oats.aweb` (`injects/aweb.md`) declare none**. Every edition declares `oats.core`, so no edition could publish once its OKF harvest helper composed. Fourth finding of the same family (contract adopted by one provider, not its siblings). Operator's restated verdict adopted verbatim: *"A second operator reaches, resolves and approves the entire graph from the public definition, binds knowledge to the public `oats-knowledge` base, and normalizes messaging. Preparation cannot publish a resolution … Both remaining blockers are packaging, not operator input."* The earlier "EXIT GATE MET" entry below is superseded by this one.
-
-## Kernel defect found at peer retirement (2026-09-21) — 0.25 lifecycle item
-
-`oats retire oats-expert-scheduler-peer` (self and spawner retry) fails closed: *recovered Git index/status disagreed with the source*. Cause: `preserveRetirementWork` clones the branch recorded in `instance.json` (`feat/portable-scheduler-captures`, tip e0c3232c) while the worktree is checked out on `docs/okf-host-runtime-settings` (5919a547); the status comparison cannot agree. Verified by hand: worktree clean, both branches pushed, every deliverable merged (oats PR39, oats-okf PR5, oats-aweb PR4); the only dirt is two untracked files in a nested scratch clone that are already on aweb main since 1.11.0. **Nothing unpreserved.** Instance left `RETIRING`; no branch/metadata/force surgery. Fix scoped to **0.25 (L)**: derive the recovery branch from the worktree, record drift as a typed observation. Lesson: `lessons/retire-recovery-uses-recorded-branch-not-checked-out-branch.md`.
-
-## S2 — acceptance run on the 0.24.4 wave (Antares, Juan's machine, 2026-09-21) — superseded by the self-correction above (knowledge result stands)
-
-Fresh directory and deployment, `@awebai/oats@0.24.4`, policy sources v2.1.2 / v1.11.1, `wider: []`, request otherwise unchanged from the 0.24.3 run; wave verified independently first (npm, both provider tags, main `86b5f924`, six imports @ `08c68ece`).
-
-- inspect: exit 0, `ignored: ["operator","launch"]`, six imports @ `08c68ece`, `ready-for-preparation` — **seam 1 closed**.
-- prepare → two `approval-required` → approved via the printed `--artifact-set` commands → prepare: **knowledge binds with `wider: []` present (deadlock fixed)**; the single remaining problem is `{code: needs-configuration, slot: messaging, key: /bindings/messaging/responsibleHuman}`.
-- `bindings-file` removed → `setting bindings-file is required (absolute host path)` in one run — the named-reason criterion ("one run instead of six") met. `wider` removed → both messaging keys attributed separately.
-- Operator's observation, adopted: `required value has no concrete binding` is generic text but the `key` carries the address; sufficient — no more spend on the string.
-- **Operator's verdict (verbatim):** *"An outside operator on a fresh machine, holding none of the authoring state, now reaches a single, fully-named, legitimately-operator-owned requirement: `/bindings/messaging/responsibleHuman`. Everything else — source discovery, workspace membership, artifact resolution, exact approval, knowledge binding to the public `oats-knowledge` base through OKF 2.1.2, messaging normalize — resolves from the published definitions alone. That is the S2 exit gate met … not 'it works', but 'every remaining item is named and belongs to the operator'."*
-- Coda: the operator has put `responsibleHuman` to Juan as a real decision; if supplied, R publishes and the OKF `check` probe runs (typed status/problems only). If declined, that is a legitimate end state and is recorded as such.
-- Four acceptance trees retained on the operator's side (0.24.1–0.24.4) — every later check is a repeat, not a rebuild.
-
-## S2 — 0.24.3 gate run (Antares, Juan's machine, 2026-09-21) — verdict
-- Seams 1, 3, 4 **fixed**; seam 2 fixed as typed (message does not echo the path — deliberate, consistent with no host diagnostics; expectation corrected); seam 5 **half**: attribution (slot/capability/full origins) fixed; naming the missing item only where the kernel knows it. The specificity half is provider-side: OKF 2.1.2 (assigned) and an aweb follow-up.
-- Six imports resolve at the repinned revision; workspace route selects aweb 1.11.0; **the knowledge slot fully resolves through the workspace route** with `bindings-file`/`state-dir`/`harvest-runtime` (`harvest-model` confirmed optional).
-- **Messaging was a SOURCE defect, not an operator gap**: aweb 1.11.0 normalize requires the workspace to declare `teams: {private: per-human}` and the soul a messaging declaration; neither was published, so the slot was unreachable by any input. Fixed on main **906b1558** (workspace policy + `teams: []` on the five messaging editions; verified against aweb v1.11.0 normalize) and imports repinned **f3ee31e0**. Remaining operator inputs after the fix: `responsibleHuman` (required) and `wider` (required, may be empty) — the private team is a later `check` outcome.
-- **S2 exit-gate verdict (amended per the operator):** knowledge — an outside operator on 0.24.3 discovers, resolves, approves and binds from public sources, remaining item attributed: **PASS**. Messaging — on 0.24.3 as published the operator hit a source defect wearing a configuration error; fixed on main 906b1558 and to be re-proven on the repinned imports before it is written as PASS.
-- **Re-run on 906b1558 (operator, b875669f):** messaging normalize passes; remaining problem is `responsibleHuman`, attributed. But end-to-end is **deadlocked**: `wider: []` (messaging requires) makes OKF 2.1.1 return `invalid-binding` on knowledge (it validates every `operator.bindings` key as a store locator); without it messaging needs `wider`. Operator's wording adopted for S2: *a second operator reaches a published, resolvable configuration boundary for knowledge; messaging is blocked by a kernel-level binding-namespace collision, not by operator input or identity.* Not Juan's to unblock; no identity requested. [Decision](https://github.com/awebai/oats/blob/main/agents/oats-expert/soul/knowledge/decisions/operator-bindings-ownership.md): flat map with declared ownership (`binding.keys`); providers ignore foreign keys (OKF 2.1.2, aweb 1.11.1); kernel attributes/refuses stray keys by name — **deferred to 0.25 by L's scope call (accepted): overlap refusal, filtered forwarding, owned/unowned attribution and the undeclared-provider path need their own regression matrix; the provider ignore rule is the floor and ships in 0.24.4's provider releases.**
-- ✅ **Provider wave published (2026-09-21 17:00Z):** OKF **2.1.2** (oats-okf PR5 → `f02a0d9a`, tag v2.1.2: named-setting reasons, source-owned operator bindings, `binding.reasons`, floor >=0.24.4), aweb **1.11.1** (oats-aweb PR4 → `d404da76`, tag v1.11.1: manifest-only reasons + keys, floor >=0.24.4), **oats.framework 1.1.2** (`oats-framework/v1.1.2` @ `6f98c7c9`), OKF mirror finalized + bundled aweb byte-synced (`08c68ece`), catalog refs, six editions repinned, six imports → `08c68ece`. **Lead's end-to-end probe from the published 0.24.4 tarball via the workspace route, Antares' exact request shape with `wider: []`:** inspect accepts the complete file (`ignored: [operator, launch]`), six imports resolve, both providers approve via the printed `trust` commands, **knowledge binds and messaging normalizes — the deadlock is gone**; the single remaining problem is `key: /bindings/messaging/responsibleHuman` (the operator's own decision). Named reasons cross in one run: `setting bindings-file is required (absolute host path)`; dropping `wider` yields both messaging keys attributed. Awaiting the independent operator's unchanged re-run to write it as PASS. **Seam 1 independently confirmed closed by the operator on 0.24.4** (same file that failed on 0.24.3 → exit 0, `ignored: [operator, launch]`).
-- ✅ **PR41 merged `ef211d3e`** (L): inspect accepts prepare's superset (`ignored`), provider reasons cross the wire by exact match (manifest `binding.reasons` / bundled lists), `binding.keys` shape-only, CLI renders `key`. Full gate 1657/1653/0/4 twice (L + maintainer). → ✅ **v0.24.4 PUBLISHED** (npm both packages, GH release 7 assets, tarball probe: installed validator accepts `binding.reasons`/`keys`, `inspect --request` accepts `operator`/`launch`), kernel-first; OKF 2.1.2 / aweb 1.11.1 floor `>=0.24.4` (closed validator on ≤0.24.3 rejects the fields — P's finding).
-- Two further kernel findings from the repeat (assigned to L, 0.24.4): (a) seam 1 converged one way only — `inspect --request` still refuses prepare's `operator`/`launch`; (b) **the kernel discards the adapter's reason** at the wire (`provider-binding-wire.mjs:23`) and templates it; aweb already sends whitelisted safe reasons. New [decision](https://github.com/awebai/oats/blob/main/agents/oats-expert/soul/knowledge/decisions/provider-problem-reasons-cross-the-wire.md): whitelisted fixed reasons cross the wire (`binding.reasons`), free text still refused.
-
-## S3 — Messaging (aweb) on the new infrastructure
-- ✅ **aweb PR3 merged → v1.11.0 (93f8ab96)**: `binding {normalize,bind,check}` on the existing wire; `check` = HOME-route operational custody only (explicit private team, `delivery: session`, kernel ≥0.24.2 via caller-owned `OATS_CLI_BIN`, retained `launchSelection` must be input-capable Claude/Codex; strict-Pi print → `needs-configuration`, never downgraded). Native adapter over existing `aw` commands with physical identity-dir custody and redacted tokens. Standalone 30/0; coupling 14/0 vs kernel b92f0d07. PR33 (launchSelection projection, OATS_CLI_BIN in codec env) merged b92f0d07.
-- Facts: released aweb 1.10.3 has no binding interface; broker refuses. aw 1.36.1 broker calls `oats session inspect/input --home H`; never restarts stopped runtime; strict-Pi print mode can't take session input.
-- 🔄 oats-aweb **PR2** codec (165b20e) + uncommitted `lib/captured-execution.mjs` (6/6).
-- ✅ Lead answered (d9d912a4): pilot primary = Pi strict print host explicit model; helper = Pi sole-OKF (Claude/Codex allowed by 2.1.1); authority = existing HOME route + L's custody fix, gated on `oats >=0.24.1`; no new grant mechanism. P delivers aweb 1.11.0 PR. 
-- ✅ **PR27 merged (5af848fc)**: HOME-only session route applies existing captured custody; refuses before transport on drift. Full gate 1626/1632 (2 pre-existing env failures reproduced on main). Ships in **v0.24.1** — the kernel floor the aweb adapter gates on.
-
-## S4 — `oats.core` / `oats.setup` / onboarding
-- ✅ **D3 merged PR35 (37c5c012)**: `oats onboard` classic local bootstrap; edition `souls/oats-setup-expert` (core+setup, provider defaults `none`, no knowledge owner). Full gate 1639/0. Live: onboard → acquire `oats.framework` 1.1.1 @0aad753c → soul declares both caps at that commit → scaffold-only spawn composes exactly `oats-operate, oats-souls, oats-config, oats-packages, oats-workspace-setup` + the `oats.core` injection, no legacy kernel skills. Baseline hygiene fixed on main (a96f24df).
-- ✅ **D1 merged PR28 (70b10822)**, distribution tag `oats-framework/v1.1.0` on 9930dcfb; **D2 merged PR29 (9930dcfb)** full gate 1634/0. Verified live: `oats create` writes `requires.capabilities.oats.core` with the catalog source; `oats install oats.framework` acquires all three capabilities from the tag.
-- ✅ Decision + plan D1–D4 on main 18af53be; docs reference as accepted-not-shipped.
-- 🔄 **D1** (P, started 16:29Z; package identity confirmed: rename distribution package to `oats.framework` 1.1.0, capabilities 1.0.0, `oats.knowledge-theory` unchanged) package `oats.core` (`oats-operate`, `oats-souls`, oats.md injection) and `oats.setup` (oats-config, oats-packages, adoption guidance) under `oats-package/capabilities/`. Owner P.
-- 🔄 **D2** (L, after custody fix) soul creation writes explicit `requires.capabilities.oats.core`; kernel skill list de-ambiented (one-release coexistence); checked-in souls updated. Owner L.
-- 🔄 **D3** (L, in progress) onboarding creates `oats-setup-expert` (edition in `souls/`); CLI verb **`oats onboard`** — `oats setup` is already the record capture-setup command and stays untouched.
-- Exit: fresh onboarding → running setup expert; created soul shows `oats.core`; kernel ships no ambient operational skill.
-
-## S5 — Official marketplace
-- ✅ Mechanism exists (`package-catalog.json`, `officialPackageCatalog()`); decision names it the official list.
-- ✅ **D4 merged PR26 (786490ae)**: the official list policy (now `docs/official-catalog.md`), `package-catalog.json` policy pointer (inert to the reader), README/packages/capabilities links, D3 sketch in adoption guide. ⬜ entries for `oats.core`/`oats.setup` at D1 release. Desktop view → S8.
-
-## S6 — Five expert souls in the oats repo
-- ✅ **PR30 merged (40a579dc)** + maintainer follow-up **caa341f3**: all five declare `oats.core: {source: repo:oats-package}`, oats.okf@v2.1.1; `oats.yaml` exports all five; `oats-workspace.yaml` imports all five at caa341f3 (375b9f42). Live inspection against published main resolves them.
-- Roster (decided): `oats-expert`, `oats-kernel-expert`, `oats-desktop-expert`, `market-research-expert`, `oats-assistant`.
-- 🟡 Candidate: `expert-roster` worktree (b5e233b9 + 519 uncommitted changes: five `agents/<name>/soul/` + legacy roster deletions). Reviewed earlier; NOT committed.
-- ✅ `souls/oats-expert` transitional edition on main already declares owns/reads for the five nodes.
-- 🔄 Assigned to M (17:05Z): create `souls/<name>/` editions for the other four from the candidate; each declares `oats.core` explicitly (S4 rule) + `oats.okf`/`oats.aweb` sources; export in `oats.yaml`. Legacy `agents/` roster retirement is a separate, later cutover.
-
-## S7 — Centralised knowledge in `oats-knowledge`
-- ✅ Juan made the repo PUBLIC (2026-09-20). Bootstrap history pushed to main; **PR #1 merged (8d67eab4)**: 25 curated concepts, roadmap re-verified to the 0.24.1 baseline and 2026-09-20 decisions, validator pinned to OKF v2.1.1, strict OKF 25/0/0, ownership tests 24/24.
-- 🟡 Curated corpus: 35 concepts (five nodes) on local `curation/expert-knowledge` in `/Users/pepe-reyero/OATS-workspace/oats-knowledge`, **uncommitted**. Bootstrap + one PR-only harvest already proven on `josep-reyero/oats-knowledge` (3 commits).
-- ⛔ Target `awebai/oats-knowledge` is EMPTY and PRIVATE; **visibility undecided** (stated requirement: public). Human decision needed before publishing.
-- ⬜ Then: push bootstrap + curation as PR to awebai; bind `stores.oats` in the pilot deployment; prove fresh-reader + Git-PR learning with the new souls; retire old in-soul knowledge (`agents/*/soul/knowledge`) as a final cutover.
-
-## S8 — Desktop parity
-- Finding (L, D2 audit): the Desktop server has **no soul-creation endpoint** today (roster reads, existing-soul edits/capability operations, instance spawn only). Soul creation with explicit `oats.core`, the marketplace view and the onboarding flow are new Desktop features, not wiring.
-- ⬜ After S4/S5: official marketplace view/search; soul creation showing `oats.core`; onboarding flow; redesign parity vs `Oats UX Redesign and Desktop Discovery (1)`.
-- ⛔ Fresh `oats-desktop-engineer` not spawned: `claude` not on PATH → choose Pi/Codex or install (human).
-
-## Blockers needing the human
-- ~~oats-knowledge visibility~~ → PUBLIC (Juan). ~~oats-dev/oats-linear access~~ → granted, indexes merged. ~~Desktop runtime~~ → Juan's machine hosts the Desktop lane (has `claude`).
-- None open at 23:10Z. Juan's side (Antares) takes: (a) fresh-deployment gate P1.5, (c) fresh-reader proof, (b) Desktop host after D3.