@awebai/oats 0.29.4 → 0.30.1

package/docs/capabilities.md

@@ -81,16 +81,15 @@ A self-contained package has an `oats.json`:
   slot.
 - `skills` entries can be skill directories or roots containing skills.
 - `inject` is optional instance instruction Markdown.
-- Only `soul-scaffold`, `spawn`, and `retire` hooks are accepted. A hook is a
+- The hooks are `spawn`, `launch` and `retire`. A hook is a
   command string, or `{ command, required }`. `required: true` is valid **only
   on `spawn`**: the hook's failure then fails the spawn and rolls it back,
   instead of producing an instance whose capability never configured itself —
   an aweb identity that could not be minted leaves an agent believing it can be
   woken by mail. Every other hook stays best-effort and only warns, so advisory
-  work never becomes a spawn blocker. `retire` and `soul-scaffold` cannot be
+  work never becomes a spawn blocker. `launch` and `retire` cannot be
   required: they run outside a spawn transaction, so there is no moment to
-  enforce them. The kernel no longer runs `soul-scaffold` (it ran when
-  `oats create` wrote a soul); a manifest may still declare it.
+  enforce them. A `soul-scaffold` hook is tolerated and ignored.
 - A capability declaring a **required** spawn hook should declare a `retire` hook
   too. Without one, OATS has no way to undo what the spawn hook did and no way to
   know whether it did anything, so a failure quarantines the home rather than
@@ -156,9 +155,7 @@ A self-contained package has an `oats.json`:
 
 `capability` is the only manifest identity field; it may also carry
 `private: true` (a **repo-owned** capability: listed, but usable only by souls
-of its own repo) and `team: <label>`
-(the one workspace team label it is listed under; without it, the primary of
-its repository's default). The machine-readable contract is
+of its own repo). The machine-readable contract is
 [`capability-manifest.schema.json`](capability-manifest.schema.json).
 
 ## Who gets a capability
@@ -172,9 +169,6 @@ defaults:
   knowledge: { oats.okf: { from: package } }        # slot default: a layer capability
   messaging: none
   tasks: none
-  byTeam:
-    engineering:
-      capabilities: { acme-release-tooling: { from: github.com/acme/agents } }
 
 # souls/release-manager/soul.yaml — the soul's own choices
 capabilities:
@@ -182,110 +176,80 @@ capabilities:
   acme-deploy: { from: package }
   acme-house-style: off
 knowledge:
-  owns: release-manager
+  harvest: off                                        # this soul's knowledge-slot payload
 ```
 
 Composition order: `defaults.<slot>` ⊕ `defaults.capabilities` ⊕
-`defaults.byTeam[<label>]` for each of the soul's team labels, in order ⊕
 `soul.capabilities` — later wins, `off` removes, a soul `<slot>: none` drops
-the workspace's slot default. Two labels that give one capability different
-entries are `E_TEAM_CONFLICT`, naming both labels; identical entries are fine,
-and a capability the soul names itself settles it (the soul's entry wins). A resolved
-capability whose manifest says `layer: X` fills slot X; two for one slot are
+the workspace's slot default. Teams compose nothing, so a soul's composition
+is the same for every person and machine. A resolved capability whose manifest says `layer: X` fills slot X; two for one slot are
 `E_SLOT_CONFLICT`. Provider settings start from the manifest's own declared
 defaults (`settings.<key>.default`, the lowest layer), then take the workspace's
-`messaging` payload (its base: no `byTeam` entry is merged, per teams
-amendment K) for the messaging slot, the soul's
+`messaging` payload for the messaging slot, the soul's
 slot payload, `oats-local.yaml` `settings.<cap>`, and `oats spawn --provider`,
 deep-merged in that order. There are no agent types, no `global`, no
 per-deployment activation or exclusion maps.
 
-### Several team labels
-
-A soul's `team` (or its repository's default in `oats-membership.yaml`) is a
-label or a non-empty list of distinct labels; the first is the **primary**:
-
-```yaml
-# souls/release-manager/soul.yaml
-schemaVersion: 2
-name: release-manager
-description: Cuts and ships releases.
-work: worktree
-team: [engineering, reviewers]
-```
-
-- `OATS_TEAM_LABEL` is the primary label. The merged messaging payload takes
-  **no** label's `byTeam` entry, the primary's included (teams amendment K), so
-  `OATS_TEAM_ID` (the payload's `team`) is the default team a host, soul or spawn set; empty means the provider's default.
-- Every label is an **eligible team**: the kernel hands the messaging provider
-  `teams`, one `{ label, team, mapped, payload }` per label in order. `payload`
-  is `workspace.messaging` ⊕ `byTeam[<label>]` when the workspace maps the
-  label (`team` is then its team id), else the base alone with `mapped: false`
-  and `team: null`. A soul with no label gets `[]` (the workspace's default team only).
-- `teams` travels **beside** a provider's settings, never inside them:
-  `OATS_TEAMS` (the JSON), `OATS_TEAM_LABELS` (comma-joined) and
-  `OATS_TEAMS_SOURCE` in the environment of every hook, home command and
-  provider check. The environment is their only channel: a check's stdin
-  request stays the released binding wire, which providers decode strictly.
-  The variables are empty (not `[]`) when a home's teams are unknown.
-- `OATS_TEAMS_SOURCE` is `live` (read from the workspace now, or a fresh
-  resolution) or `recorded` (the spawn-time list). **A provider leaves a joined
-  team only on a `live` list**: a recorded one lacks every team mapped since
-  the spawn, so acting on it could drop a valid membership.
-- Joining an eligible team is the provider's explicit act (a spawn choice or a
-  command at any time); the kernel never joins anything.
-- For an existing home the teams are **live** where they are acted on: its
-  launch hook (`oats session start|restart`), its messaging module's commands
-  and `messaging:` operations (`oats operation run --home`), and `oats inspect
-  --home` read the soul's labels and the workspace's `messaging` as they stand
-  now — two repository reads (the workspace host, the soul's own repo), never a
-  discovery; `oats readiness --home` takes them from the discovery it already
-  runs. The home's modules and skills stay as spawned. Every other capability
-  command and operation gets the teams the spawn recorded in `instance.json`
-  (`teams`), marked `recorded`, at no remote cost; so does any read where the
-  workspace cannot be reached.
-- **Known limitation (0.26.0):** a scheduled wake's session start uses the
-  recorded teams (`OATS_TEAMS_SOURCE=recorded`), so its launch hook leaves
-  nothing; the next operator start or messaging command is live.
-- A label in the workspace's `teams:` but not in `messaging.byTeam` is a
-  discovery warning (`unmapped-team-label`, one per label naming its souls); a
-  label not in `teams:` at all is the `E_TEAM_UNKNOWN` problem.
-
-## Exact harness composition
-
-Every spawned instance receives:
-
-- canonical soul skills;
-- a **full copy** of every capability the soul resolved to, under
-  `<instance>/.oats/modules/<capability>/` (manifest, `bin/`, injects, skills);
-- those capabilities' skills copied to `<instance>/.agents/skills/<capability>/<skill>/`.
-
-`instance.json` records per module its source (`from`), commit and content
-digest, and the composed skill names with their source. `.claude/skills` points
-to the same canonical directory. **The harness starts normally**: pi, Claude
-Code and Codex run their own skill discovery with cwd = the instance home;
-ambient skills (user-level, the work tree's `.agents/skills/`) coexist with the
-OATS-composed set. `instance.json` records what OATS composed, not everything
-the harness may discover.
-
-Duplicate skill names **within the composed set** fail the spawn naming both
-capabilities (`E_SKILL_DUPLICATE`). A composed skill and an ambient skill with
-one name is the harness's own precedence, not an error.
-
-The instance's `AGENTS.md` is a generated regular file containing:
-
-1. the canonical soul `AGENTS.md`;
-2. the kernel and work-mode blocks;
-3. each module's inject, in deterministic (name) order.
-
-Its `CLAUDE.md` symlinks to `AGENTS.md`. The committed soul remains unchanged.
-Edit the canonical soul or the capability's inject in its repo, then spawn a
-new instance; do not edit generated blocks as source-of-truth changes.
+### Teams in the provider environment
+
+A soul's teams here (the committed shared teams, and the deployment's `oats-local.yaml` `teams`, `defaultTeam`, `souls.teams`,
+`souls.default` — see [workspaces.md](workspaces.md#teams)) travel **beside** a
+provider's settings, never inside them, in the environment of every hook, home
+command and provider check:
+
+- `OATS_DEFAULT_TEAM` — the soul's default label; `OATS_DEFAULT_TEAM_ID` — its
+  provider id; `OATS_DEFAULT_TEAM_FROM` — `deployment` (`defaultTeam`) or `soul`
+  (`souls.default`).
+- No default configured: none of the three is set. An **unmapped** default (a
+  shared team declared without an id): `OATS_DEFAULT_TEAM` and
+  `OATS_DEFAULT_TEAM_FROM` are set and `OATS_DEFAULT_TEAM_ID` is not. What a
+  provider does then is its own contract; a messaging provider typically
+  refuses the spawn, naming the unmapped label, or saying no team is
+  configured.
+- `OATS_TEAMS` — JSON `[{label, team, default, from: "shared"|"local"}]`: every
+  mapped team the soul may be in here, the default included (`default: true`),
+  default first, then by label. Eligible to join = the rows with `default: false`.
+  Unset when a home's teams are unknown (none recorded, and unreadable now).
+- `OATS_TEAMS_SOURCE` — `live` (the workspace and `oats-local.yaml` read now, or
+  a fresh resolution) or `recorded` (the spawn-time record). **A provider leaves
+  a joined team only on a `live` list**: a recorded one lacks every change since
+  the spawn.
+
+The environment is their only channel: a check's stdin request stays the
+released binding wire, which providers decode strictly. Joining a team other
+than the default is the provider's explicit act (a spawn choice or a command at
+any time); the kernel never joins anything.
+
+For an existing home the teams are **live** where they are acted on: its launch
+hook (`oats session start|restart`), its messaging module's commands and
+`messaging:` operations (`oats operation run --home`), and `oats inspect
+--home` read the workspace host and the deployment's `oats-local.yaml` as they
+stand now — one repository read, never a discovery; `oats readiness --home`
+takes them from the discovery it already runs. The home's modules and skills
+stay as spawned. Every other capability command and operation gets the teams
+the spawn recorded in `instance.json` (`teams`, `defaultTeam`), marked
+`recorded`, at no remote cost; so does any read where the workspace cannot be
+reached. A scheduled wake's session start uses the recorded teams, so its
+launch hook leaves nothing; the next operator start or messaging command is
+live.
+
+## What an instance receives
+
+Every spawned instance gets a **full copy** of each capability its soul
+resolved to, under `<home>/.oats/modules/<capability>/` (manifest, `bin/`,
+injects, skills), and those skills under
+`<home>/.agents/skills/<capability>/<skill>/`. Its generated `AGENTS.md` is the
+soul's `AGENTS.md`, the kernel and work-mode blocks, then each module's inject
+in name order. Two composed skills with one name fail the spawn
+(`E_SKILL_DUPLICATE`). The harness then starts normally, with its own skill
+discovery; the details are in [souls-and-instances.md](souls-and-instances.md).
+Change a capability's inject or skills in its repository, then spawn a new
+instance: the generated files are not a source.
 
 Inspect a composition before it exists:
 
 ```bash
-oats spawn release-manager --preview          # modules (from / commit / changedSince), team, resolution revision
+oats spawn release-manager --preview          # modules (from / commit / changedSince), teams + default, resolution revision
 oats spawn release-manager --preview --json
 ```
 
@@ -302,7 +266,7 @@ packages is in [packages.md](packages.md). There is no installed
 copy at a deployment and no `oats install`/`trust`/`update`/`remove`.
 
 One package can carry capabilities meant for **different souls**. oats.okf
-4.0.0 ships three:
+ships three:
 
 - `oats.okf` fills every working soul's knowledge slot;
 - `oats.okf-harvest` is composed only into its harvester soul;
@@ -328,22 +292,11 @@ reported as `publishes` and consumed only as a package.
 
 ## Agents a capability needs
 
-A capability declares no agents: `agents:` in a manifest was **removed in
-0.29.0**. Resolution refuses a module that still declares it with
-`E_CAPABILITY_AGENTS_REMOVED { capability, agents }` (spawn, `spawn --preview`,
-`inspect --soul`, operator commands). Ship the agent as a soul instead:
-
-- a **package soul**: `souls/<name>/` beside the package's capabilities, listed
-  in `oats-package.json` `souls:`, spawned as `oats spawn <package>/<name>`
-  (or the bare name when unique), reading the package's capabilities with
-  `from: here` ([packages.md](packages.md#package-souls)). The post-commit
-  `reviewer` is one: oats.dev 1.1.0's `oats.dev/reviewer`, beside `oats.review`;
-- or a **member soul**: `souls/<name>/` in a member repository, using a
-  member capability `from: here`.
-
-A home an earlier kernel spawned from a manifest `agents:` soul (its agent
-directory holds only `instances/`) is still listed by `oats status`, may anchor
-a `--parent`, and retires; nothing creates one any more.
+A capability declares no agents (a manifest `agents:` is refused with
+`E_CAPABILITY_AGENTS_REMOVED`). Ship the agent as a soul: a **package soul**
+beside the package's capabilities ([packages.md](packages.md#package-souls)),
+such as oats.engineering's `code-reviewer` beside `oats.code-review`, or a **member soul** in a
+member repository, using the capability `from: here`.
 
 ## Commands and hooks
 
@@ -352,23 +305,36 @@ instance's modules (or the soul's resolved set). Workspace commands (`sync`,
 `package`, `workspace status`, `capabilities`, `souls`, `doctor`) are always
 available.
 
-A manifest's `helperInjection` and a hook's `inputs` are **ignored since 0.26**:
-they served the captured path (removed in 0.26), are still accepted so that
-existing manifests load, and change nothing.
+A manifest's `helperInjection` and a hook's `inputs` are tolerated and ignored.
+
+Hooks receive:
 
-Hooks receive `OATS_EVENT`, `OATS_CAPABILITY`, `OATS_LAYER`, `OATS_INSTANCE`,
-`OATS_HOME`, `OATS_AGENT`, `OATS_SOUL`, `OATS_CONTEXT`, `OATS_WORKSPACE`,
-`OATS_ROOT`, `OATS_LEVEL`, `OATS_SETTINGS`, `OATS_SETTINGS_ORIGINS`, and
-`OATS_META`. `OATS_SETTINGS_ORIGINS` (0.29.0) says where each leaf of
+- `OATS_EVENT`, `OATS_CAPABILITY`, `OATS_LAYER`, `OATS_LEVEL`;
+- `OATS_INSTANCE`, `OATS_INSTANCE_HOME` (the home, absolute; `OATS_HOME` is a
+  compatibility alias), `OATS_AGENT`, `OATS_SOUL`, `OATS_SOUL_ID`,
+  `OATS_CONTEXT`, `OATS_WORKSPACE`, `OATS_ROOT`;
+- `OATS_CLI_BIN` (the running kernel's `bin/oats.mjs`);
+- `OATS_SETTINGS`, `OATS_SETTINGS_ORIGINS`, `OATS_META`;
+- the team and workspace variables of
+  [Teams in the provider environment](#teams-in-the-provider-environment),
+  plus `OATS_WORKSPACE_NAME`, `OATS_WORKSPACE_KEY` and `OATS_TEAM_SCOPE`
+  (the deployment directory). `OATS_TEAM_NAME` is always empty.
+
+A spawn hook also gets `OATS_TASK`, `OATS_REPO`, `OATS_BRANCH`, `OATS_WORK`,
+`OATS_HARNESS`, `OATS_KIND` and, for a spawn a trigger started,
+`OATS_TRIGGER_EVENT_FILE`. A launch hook also gets `OATS_HARNESS` and
+`OATS_PREVIOUS_HARNESS`.
+
+`OATS_SETTINGS_ORIGINS` says where each leaf of
 `OATS_SETTINGS` came from: a JSON object from a JSON pointer to `{ kind, at }`,
 `kind` being `manifest-default`, `workspace`, `soul`, `host`, `spawn` or
 `anchor` (the last layer that set it), e.g.
 `{"/harvest":{"kind":"soul","at":"soul.yaml#/knowledge"}}`. A provider tells a
-soul-set value from a host-set one there, and never reads `soul.yaml` for it.
-A home spawned before 0.29.0 recorded none: `{}`. A final JSON line may
-return `meta`, `brief`, `warning`, or harness-specific `launch` arguments. A
-**spawn hook only** may also return an `env` object for the launched process;
-returning `env` from retire or soul-scaffold is an explicit contract error.
+soul-set value from a host-set one there, and never reads `soul.yaml` for it;
+a home with none recorded gives `{}`. A final JSON line may return `meta`,
+`brief`, `warning`, or harness-specific `launch` arguments. A **spawn or
+launch hook** may also return an `env` object for the launched process;
+returning `env` from a retire hook is an explicit contract error.
 
 A **launch hook** runs at every start and restart of a home for each provider
 recorded at spawn (under its recorded settings). Its `launch` arguments and
@@ -378,8 +344,7 @@ after the start succeeds — the same record the spawn hook wrote and the retire
 hook later reads as `OATS_META` — so a provider that re-issues a credential at
 start (a renewed session grant, for example) leaves the CURRENT one on record. A
 launch hook that answers without `meta` keeps its previous entry; a start whose
-preparation fails changes nothing. (Kernel ≥ 0.25.5; earlier kernels collected
-launch `meta` and discarded it.)
+preparation fails changes nothing.
 
 Hook environment values are strings, at most 8192 UTF-8 bytes, with no NUL or
 newlines. Names use the portable environment grammar and must belong to an
@@ -390,11 +355,10 @@ for this contract. Hyphenated vendors are also excluded because translating a
 hyphen to `_` would let `aweb-evil.*` collide with names already inside
 `aweb.*`'s `AWEB_*` namespace.
 
-A manifest's `settings.<key>` may carry `hostOnly: true` (decision 27). Such a
+A manifest's `settings.<key>` may carry `hostOnly: true`. Such a
 key is a fact about the machine — a custody directory, a state root — and the
 resolver accepts it only from the deployment's own `oats-local.yaml`
-`settings.<capability>`; a committed workspace or soul file (every
-`messaging.byTeam` entry of a label the soul carries included) or a
+`settings.<capability>`; a committed workspace or soul file or a
 `--provider` flag carrying it is refused (`E_WORKSPACE_SCHEMA`, reason
 `host-only-key`).
 Declare it for any key whose value points at something a committed file must
@@ -425,11 +389,11 @@ A failed compensation, unverifiable topology removal, or reported spawn state
 without a retire hook uses the standard retryable quarantine instead. Ordinary
 advisory hook execution failure itself contributes no environment.
 
-The environment prefix applies to the initial Pi or Claude process. `--no-launch`
-validates command preparation but launches no harness. The fallback shell
-after that process exits does not inherit command-scoped assignments, and OATS
-has no restart command or replay policy yet. The generated command is persisted
-as before; hooks must contribute locators, selectors, or broker endpoints—not
+The environment prefix applies to the harness process (pi, Claude Code or
+Codex). `--no-launch` validates command preparation but launches no harness.
+The fallback shell after that process exits does not inherit command-scoped
+assignments; `oats session start|restart` runs the launch hooks again. The
+generated command is persisted; hooks must contribute locators, selectors, or broker endpoints—not
 bearer tokens or private key material. An instance-lifetime local principal may
 be selected by a home locator. A replaceable execution serving a durable global
 identity must instead use a custody/action broker or equivalent narrow adapter;
@@ -443,28 +407,50 @@ spawn order. Hooks run from the instance's own copy
 
 ## Official packages
 
-| Capability | Kind | Provides | Package |
-|---|---|---|---|
-| `oats.core` | additive | day-to-day OATS operation for an instance | `oats.framework` |
-| `oats.setup` | additive | whole-architecture knowledge for an onboarding expert | `oats.framework` |
-| `oats.okf` | knowledge core capability | External owned OKF bases, durable notes/record custody, independent judgment and inspection | `oats.okf` |
-| `oats.aweb` | messaging core capability | aweb identity lifecycle and messaging skills | `oats.aweb` |
-| `oats.jira` | tasks core capability | Jira task protocol via `acli` | `oats.jira` |
-| `oats.linear` | tasks core capability | Linear GraphQL task commands and workflow | `oats.linear` |
-| `oats.authoring` | additive | capability, skill, and soul authoring guidance | `oats.authoring` |
-
-Each is pinned by a bare version in `packages:` and resolved through the
-[official catalog](official-catalog.md); each package repo is also a member
-of the OATS workspace carrying its expert soul (`okf-expert`, `aweb-expert`, …).
-The framework's own souls say `oats.okf: { from: package }` — membership never
-turns a package into a latest-state capability.
+The official packages and the capabilities and souls each carries are listed
+in the [official catalog](official-catalog.md#the-packages). Each is pinned by a bare version in
+`packages:`; each package repository is also a member of the OATS workspace,
+carrying its expert soul. The framework's own souls say
+`oats.okf: { from: package }`: membership never turns a package into a
+latest-state capability.
 
 ## Operations a capability declares
 
-A manifest may declare `operations` (named actions or views delegating to
-its own commands) that a GUI or a schedule invokes through `oats operation
-run <layer>:<name>`; `oats inspect --json` reports them with availability.
-See [docs/design/operations-contract.md](design/operations-contract.md).
+A manifest may declare `operations`: named actions or views that a GUI, a
+schedule or an operator invokes without knowing the provider.
+
+```json
+"operations": {
+  "harvest": { "kind": "action", "command": "harvest", "context": "home", "description": "Promote this instance's notes" },
+  "inspect": { "kind": "view",   "command": "inspect", "context": "home", "description": "Show this instance's working knowledge" }
+}
+```
+
+- `command` names one of the manifest's `commands`. `kind` is `action`
+  (default) or `view`; `context` is `home` (default: runs in an instance
+  home) or `scope`.
+- Optional `args` declare `{ name, flag, required, description }`; the runner
+  passes `--arg name=value` as those flags and refuses unknown or missing
+  required ones.
+- A view answers `{ documents: [{ label, kind: "markdown"|"text", path?, text? }], summary? }`;
+  the kernel validates that shape and relays it.
+
+`oats inspect --json` lists each operation with its availability.
+`oats operation run <layer>:<name> (--home <abs> | --soul <name>) [--arg k=v …] --json`
+resolves the provider that fills `<layer>` for the subject and runs its
+command exactly as `oats <namespace> <command>` would, with the hook
+identity variables of that subject and the invoking process's own identity
+removed. It refuses an undeclared operation (`E_OPERATION_UNKNOWN`), a slot
+with no provider or a home operation without `--home`
+(`E_OPERATION_UNAVAILABLE`), and a missing host command
+(`E_CAPABILITY_REQUIRES`).
+
+The provider must exit 0 with exactly one JSON envelope on stdout. Otherwise
+the outcome is **unconfirmed**: `E_OPERATION_TIMEOUT` (after 240 s) or
+`E_OPERATION_RESULT`, with `error.details { unconfirmed: true, exit, envelope?, stderr? }`.
+A provider's own `ok: false` is relayed with its code. A schedule of kind
+`operation` runs the same command ([schedules.md](schedules.md)). The JSON
+shapes are in [desktop-cli-api.md](desktop-cli-api.md#inspect-readiness-and-operation-run-on-the-workspace-model-operationsapi-2-soulsapi-2-readinessapi-2-oats-0260).
 
 ## Readiness check (`binding.check`)
 
@@ -473,7 +459,7 @@ manifest is asked by `oats readiness` whether it is ready for the subject. The
 subject is an instance home (`--home`) or a soul (`--soul`). The command named
 by `binding.check` receives one request and answers once. The kernel relays
 that answer to consumers as it came: readiness `providers` items. For the
-consumer side, see [desktop-cli-api.md](desktop-cli-api.md#oats-readiness---home---soul---dir---policy---json-readinessapi-2).
+consumer side, see [desktop-cli-api.md](desktop-cli-api.md#oats-readiness---home-----soul----dir----policy---json--readinessapi-2).
 This check reads configuration only; it binds nothing and does not change a
 spawn's fail-closed hooks.
 
@@ -492,9 +478,9 @@ passed as arguments; no shell is involved.
 
 ```json
 {"schemaVersion":1,"phase":"check","slot":"messaging","capability":"my.provider",
- "settings":{"team":"acme:eng","root":"/srv/aw"},
+ "settings":{"root":"/srv/aw"},
  "input":{"context":{"kind":"workspace","workspace":"github.com/acme/agents","deployment":"/srv/acme",
-                     "soul":"release-manager","team":"engineering","instance":"release-manager-1",
+                     "soul":"release-manager","instance":"release-manager-1",
                      "home":"/srv/acme/agents/release-manager/instances/release-manager-1"},
           "action":{"kind":"readiness"}}}
 ```
@@ -503,9 +489,9 @@ passed as arguments; no shell is involved.
 - `settings` is the merged provider payload: the one the spawn recorded for a
   home, or the one the resolution computes for a soul.
 - The request has exactly these keys; a provider may decode it strictly. The
-  soul's eligible teams (see *Several team labels*) are not on stdin: the check
-  reads them from `OATS_TEAMS` / `OATS_TEAMS_SOURCE` / `OATS_TEAM_LABELS`.
-- `context.team` is the soul's primary team label, or `null`.
+  soul's teams (see [Teams in the provider environment](#teams-in-the-provider-environment))
+  are not on stdin: the check reads them from `OATS_DEFAULT_TEAM*`, `OATS_TEAMS`
+  and `OATS_TEAMS_SOURCE`.
 - `instance` and `home` are `null` for a soul subject.
 
 **Environment:**
@@ -516,16 +502,19 @@ passed as arguments; no shell is involved.
     `OATS_SETTINGS_ORIGINS` (where each leaf came from, as hooks get it);
   - `OATS_CLI_BIN`;
   - `OATS_WORKSPACE` (the deployment);
-  - the team variables `OATS_TEAM_ID` (the messaging payload's `team`: the
-    workspace's default team if one is set; empty = the provider's default),
-    `OATS_TEAM_SCOPE`, `OATS_TEAM_LABEL`, `OATS_TEAM_NAME`,
-    `OATS_TEAM_LABELS`, `OATS_TEAMS`, `OATS_TEAMS_SOURCE`, `OATS_WORKSPACE_NAME` and
+  - the team variables `OATS_DEFAULT_TEAM`, `OATS_DEFAULT_TEAM_ID`,
+    `OATS_DEFAULT_TEAM_FROM`, `OATS_TEAMS`, `OATS_TEAMS_SOURCE` (see
+    [Teams in the provider environment](#teams-in-the-provider-environment)),
+    `OATS_TEAM_SCOPE`, `OATS_TEAM_NAME`, `OATS_WORKSPACE_NAME` and
     `OATS_WORKSPACE_KEY`;
   - `OATS_AGENT` (the soul);
-  - `OATS_SOUL` when the soul directory is known;
+  - `OATS_SOUL`, the soul directory: a home's recorded one, or for a soul
+    (`readiness --soul`, `inspect --soul`) its copy at the resolved commit,
+    which the kernel materialises first as a spawn would (0.30; a copy that
+    cannot be made fails readiness under `installed`, producer `soul copy`);
   - for a home, `OATS_INSTANCE` and `OATS_INSTANCE_HOME`.
-- A home's `OATS_WORKSPACE_NAME` is `""` until spawn records the workspace
-  name.
+- `OATS_TEAM_SCOPE` is the deployment directory; `OATS_TEAM_NAME` is always
+  empty.
 
 **Answer** — exit 0, and exactly one JSON document on stdout (whitespace
 around it is fine; progress text is not):

package/docs/capability-manifest.schema.json

@@ -11,7 +11,7 @@
   "$defs": {
     "HelperInjection": {
       "deprecated": true,
-      "description": "DEPRECATED and IGNORED since OATS 0.26: it served the captured path (removed in 0.26). Still accepted so existing manifests validate; it changes nothing. Omit it.",
+      "description": "Tolerated and ignored: accepted so existing manifests validate; it changes nothing. Omit it.",
       "oneOf": [
         {"type":"object","required":["version","mode"],"additionalProperties":false,"properties":{"version":{"const":1},"mode":{"enum":["inherit","omit"]}}},
         {"type":"object","required":["version","mode","path"],"additionalProperties":false,"properties":{"version":{"const":1},"mode":{"const":"file"},"path":{"type":"string","minLength":1,"pattern":"^(?![A-Za-z]:)(?!.*(?:^|/)\\.{1,2}(?:/|$))[^/\\\\\u0000]+(?:/[^/\\\\\u0000]+)*$"}}}
@@ -61,11 +61,6 @@
       "type": "boolean",
       "description": "Workspace discovery: true makes this member capability repo-owned — listed (private: true) but usable only by souls of its own repository (E_CAPABILITY_PRIVATE elsewhere)."
     },
-    "team": {
-      "type": "string",
-      "pattern": "^[a-z0-9][a-z0-9._-]*$",
-      "description": "Workspace discovery: the team label for this capability; else the repository's default from oats-membership.yaml."
-    },
     "layer": {
       "enum": [
         "knowledge",
@@ -83,7 +78,7 @@
     "inject": {
       "type": "string"
     },
-    "helperInjection": {"$ref":"#/$defs/HelperInjection","deprecated":true,"description":"DEPRECATED and IGNORED since OATS 0.26 (accepted so existing manifests validate; changes nothing). Omit it."},
+    "helperInjection": {"$ref":"#/$defs/HelperInjection","deprecated":true,"description":"Tolerated and ignored (accepted so existing manifests validate; changes nothing). Omit it."},
     "environment": {
       "type": "array",
       "items": {
@@ -120,7 +115,7 @@
           },
           {
             "title": "harness package requirement",
-            "description": "A package that must be installed into a specific harness's own package manager. Raised only for deployments using that harness, satisfied by the harness's package list rather than by PATH, and installed only with explicit consent. The harness is named by `harness` (0.27.0) or by `runtime`, its pre-0.27 name that released manifests use: exactly one of the two.",
+            "description": "A package that must be installed into a specific harness's own package manager. Raised only for deployments using that harness, satisfied by the harness's package list rather than by PATH, and installed only with explicit consent. The harness is named by `harness` or by `runtime`, its old name that released manifests use: exactly one of the two.",
             "type": "object",
             "required": [
               "package",
@@ -140,7 +135,7 @@
               },
               "runtime": {
                 "type": "string",
-                "description": "The pre-0.27 name of `harness`, accepted for released manifests.",
+                "description": "The old name of `harness`, accepted for released manifests.",
                 "enum": [
                   "pi",
                   "claude"
@@ -210,7 +205,7 @@
           "items": { "type": "string", "minLength": 1, "maxLength": 200, "not": { "pattern": "[{}]|[^\\x20-\\x7e]" } }
         },
         "keys": {
-          "description": "Owned operator-key declarations: exact names or trailing-dot namespaces, no other pattern syntax. Kernel 0.24.4 validates shape only; filtering, overlap checks and ownership attribution are deferred to 0.25. Providers must ignore foreign keys themselves.",
+          "description": "Owned operator-key declarations: exact names or trailing-dot namespaces, no other pattern syntax. The kernel validates their shape only; providers must ignore foreign keys themselves.",
           "type": "array",
           "uniqueItems": true,
           "items": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]*\\.?$(?![\\s\\S])" }
@@ -281,7 +276,7 @@
           },
           "hostOnly": {
             "type": "boolean",
-            "description": "When true, this key is a host fact (a custody path, a state directory): the resolver accepts it only from the deployment's oats-local.yaml settings.<capability> and refuses it in the workspace file, byTeam payloads, a soul's slot payload and --provider flags (E_WORKSPACE_SCHEMA reason host-only-key). Decision 27."
+            "description": "When true, this key is a host fact (a custody path, a state directory): the resolver accepts it only from the deployment's oats-local.yaml settings.<capability> and refuses it in the workspace file, a soul's slot payload and --provider flags (E_WORKSPACE_SCHEMA reason host-only-key). Decision 27."
           }
         },
         "additionalProperties": false