@awebai/oats 0.30.0 → 0.30.1

package/docs/desktop-cli-api.md

@@ -591,7 +591,7 @@ Read-only (it writes no lock):
              "souls":["rm"],"capabilities":["nw-house-style"],"publishes":null,"url":"https://github.com/nw/agents/tree/66566512…",
              "membershipFile":{"path":"oats-membership.yaml","url":"https://github.com/nw/agents/blob/66566512…/oats-membership.yaml"}}],
  "packages":[{"id":"oats.okf","version":"3.0.0","source":"catalog:oats.okf","commit":"ab897841…","integrity":"sha256-bada35…",
-              "capabilities":["oats.okf"],"souls":[],"latest":{"version":"4.0.4","ref":"v4.0.4"}}],
+              "capabilities":["oats.okf"],"souls":[],"latest":{"version":"4.0.5","ref":"v4.0.5"}}],
  "declaredPackages":["oats.framework","oats.okf"],"unsynced":["oats.framework"],"stale":[],
  "external":[{"source":"git:github.com/oss/experts@3c606e09…","soul":"security-reviewer"}],
  "problems":[],"warnings":[],
@@ -642,8 +642,8 @@ packages' capabilities and souls, sorted by name, then origin. Both carry
     "defaultTeam":{"label":"mine","team":"mine:ana.aweb.ai","from":"deployment"},
     "private":false,"path":"souls/writer","work":"directory","description":"Drafts campaigns.","harness":"pi","model":null,"harnessFrom":"kernel-default",
     "file":{"path":"souls/writer/soul.yaml","url":null},"spawnable":true,"problem":null},
-   {"name":"knowledge-maintainer","qualifiedName":"oats.okf/knowledge-maintainer","origin":"package oats.okf v4.0.4","kind":"package","package":"oats.okf",
-    "version":"4.0.4","repoKey":"github.com/awebai/oats-okf","commit":"a4ccca02…","teams":null,"defaultTeam":null,"private":false,
+   {"name":"knowledge-maintainer","qualifiedName":"oats.okf/knowledge-maintainer","origin":"package oats.okf v4.0.5","kind":"package","package":"oats.okf",
+    "version":"4.0.5","repoKey":"github.com/awebai/oats-okf","commit":"26d8216f…","teams":null,"defaultTeam":null,"private":false,
     "path":"oats-package/souls/knowledge-maintainer","work":"directory","description":"Reviews harvested knowledge.","harness":"pi","model":null,
     "harnessFrom":"kernel-default","file":{"path":"oats-package/souls/knowledge-maintainer/soul.yaml","url":null},
     "spawnable":false,"problem":{"code":"E_TEAM_UNKNOWN","message":"team \"reviewers\" is not declared (oats-local.yaml#/souls/teams/…)"}}],

package/docs/implementation.md

@@ -30,7 +30,8 @@ published to npm. Its developer docs are in
 | `lib/` | the kernel (below) |
 | `injects/` | the kernel and work-mode instruction blocks composed into every instance |
 | `skills/` | bootstrap skills shipped with the kernel |
-| `capabilities/` | generated mirrors of released package capabilities (for example `oats-okf*`), checked by `scripts/check-okf-mirror.mjs` |
+| `capabilities/` | this repository's own member capabilities (`oats-workspace-experts`), discovered at the member's latest state |
+| `mirrors/` | generated byte mirrors of the official packages' capabilities (for example `oats-okf*`, checked by `scripts/check-okf-mirror.mjs`): release-lane and test material, kept out of `capabilities/` so member discovery does not list them a second time; not shipped in the npm package |
 | `oats-package/` | the `oats.framework` package |
 | `souls/` | this repository's own souls (a workspace member) |
 | `docs/` | the reference pages, schemas, design records and release notes |

package/docs/integrations.md

@@ -40,7 +40,7 @@ arrives from.
 ```yaml
 # oats-workspace.yaml: one default per slot, for every soul
 packages:
-  oats.okf: v4.0.4
+  oats.okf: v4.0.5
   oats.aweb: v1.17.1
   oats.linear: v1.0.1
   oats.jira: v1.0.1

package/docs/knowledge.md

@@ -26,7 +26,7 @@ The workspace pins the package and fills the slot for every soul by default:
 ```yaml
 # oats-workspace.yaml (excerpt)
 packages:
-  oats.okf: v4.0.4
+  oats.okf: v4.0.5
 defaults:
   knowledge: { oats.okf: { from: package } }
 stores:
@@ -207,9 +207,9 @@ its `oats trigger test` passes.
 
 | Capability | Composed into | Skills | Inject |
 |---|---|---|---|
-| `oats.okf` | every working soul it serves | [`okf-consultation`](../capabilities/oats-okf/skills/okf-consultation/SKILL.md), [`okf-instance-knowledge`](../capabilities/oats-okf/skills/okf-instance-knowledge/SKILL.md) | Consult soul and instance knowledge; capture with judgment. |
-| `oats.okf-harvest` | `oats.okf/knowledge-harvester` | `knowledge-theory`, [`knowledge-harvest`](../capabilities/oats-okf-harvest/skills/knowledge-harvest/SKILL.md), `okf-authoring` | A judge; its staged roots are its only write surface. |
-| `oats.okf-maintenance` | `oats.okf/knowledge-maintainer` | `knowledge-theory`, [`knowledge-review`](../capabilities/oats-okf-maintenance/skills/knowledge-review/SKILL.md), `okf-authoring`, [`okf-trigger-setup`](../capabilities/oats-okf-maintenance/skills/okf-trigger-setup/SKILL.md) | One PR per instance; never supersede silently. |
+| `oats.okf` | every working soul it serves | [`okf-consultation`](../mirrors/oats-okf/skills/okf-consultation/SKILL.md), [`okf-instance-knowledge`](../mirrors/oats-okf/skills/okf-instance-knowledge/SKILL.md) | Consult soul and instance knowledge; capture with judgment. |
+| `oats.okf-harvest` | `oats.okf/knowledge-harvester` | `knowledge-theory`, [`knowledge-harvest`](../mirrors/oats-okf-harvest/skills/knowledge-harvest/SKILL.md), `okf-authoring` | A judge; its staged roots are its only write surface. |
+| `oats.okf-maintenance` | `oats.okf/knowledge-maintainer` | `knowledge-theory`, [`knowledge-review`](../mirrors/oats-okf-maintenance/skills/knowledge-review/SKILL.md), `okf-authoring`, [`okf-trigger-setup`](../mirrors/oats-okf-maintenance/skills/okf-trigger-setup/SKILL.md) | One PR per instance; never supersede silently. |
 
 Working souls get no promotion doctrine: only the harvester judges and only
 the maintainer merges. `knowledge-theory` and `okf-authoring` ship as

package/docs/official-catalog.md

@@ -10,9 +10,9 @@ or workspace membership alone does not make a package official.
 | package | release | capabilities | package souls |
 |---|---|---|---|
 | `oats.framework` | `oats-framework/v1.4.0` (this repository) | `oats.core`, `oats.setup`, `oats.knowledge-theory` | `knowledge-theory-expert` |
-| `oats.okf` | `v4.0.4` | `oats.okf` (knowledge), `oats.okf-harvest`, `oats.okf-maintenance` | `knowledge-harvester`, `knowledge-maintainer` |
+| `oats.okf` | `v4.0.5` | `oats.okf` (knowledge), `oats.okf-harvest`, `oats.okf-maintenance` | `knowledge-harvester`, `knowledge-maintainer` |
 | `oats.aweb` | `v1.17.1` | `oats.aweb` (messaging) | |
-| `oats.engineering` | `v1.1.0` | `oats.engineering-expert`, `oats.developer`, `oats.code-review` | `code-reviewer` |
+| `oats.engineering` | `v1.3.0` | `oats.engineering-expert`, `oats.developer`, `oats.code-review` | `code-reviewer` |
 | `oats.authoring` | `v1.0.3` | `oats.authoring` | |
 | `oats.jira` | `v1.0.1` | `oats.jira` (tasks) | |
 | `oats.linear` | `v1.0.1` | `oats.linear` (tasks) | |
@@ -27,7 +27,7 @@ no lock and adds nothing to an existing workspace.
 ## Find and use packages
 
 - A workspace pins an official package by **bare version** in its
-  `packages:` map (`oats.okf: v4.0.4`); `oats sync` resolves it through the
+  `packages:` map (`oats.okf: v4.0.5`); `oats sync` resolves it through the
   catalog to an exact commit, fetches it, verifies its integrity and locks it.
   A package outside the catalog is written `git:<repo>@<ref>`. Pinning does
   not join a team or adopt the publisher's workspace. See

package/docs/packages.md

@@ -44,14 +44,14 @@ whole organisation:
 
 ```yaml
 packages:
-  oats.okf: v4.0.4                                    # bare version → the official catalog
+  oats.okf: v4.0.5                                    # bare version → the official catalog
   acme.tools: git:github.com/acme/tools@v0.4.0        # direct ref: git:<repo>@<tag or full OID>
 ```
 
-- **Bare version** (`v4.0.4`, `4.0.4`, `1.0.0-rc.1`): the id is looked up in
+- **Bare version** (`v4.0.5`, `4.0.5`, `1.0.0-rc.1`): the id is looked up in
   the official catalog — `package-catalog.json` in the `oats` repo, or the file
   named by `OATS_PACKAGE_CATALOG` — which supplies the repo url, the tag
-  convention (`v4.0.4` or `oats-framework/v1.4.0`) and the payload path. An id
+  convention (`v4.0.5` or `oats-framework/v1.4.0`) and the payload path. An id
   the catalog does not know is `E_PACKAGE_MISSING` ("use `git:<repo>@<ref>` for
   a package outside the catalog"). The catalog is the reviewed official list
   ([official-catalog.md](official-catalog.md)) and the only way a
@@ -75,7 +75,7 @@ members:
   - git:github.com/acme/platform
 packages:
   oats.framework: v1.4.0
-  oats.okf: v4.0.4
+  oats.okf: v4.0.5
   oats.aweb: v1.17.1
 teams:
   platform: { team: "platform:acme.aweb.ai", description: Platform engineering }
@@ -105,7 +105,7 @@ decision recorded in the lock.
 $ oats sync
 workspace  acme  (github.com/acme/agents @ 3f2a9c1e)
 members    agents ✓↔ (@ 3f2a9c1e)   platform ✓↔ (@ 77c0a1b2)   billing ✗ (no-backlink)
-packages   acme.tools 0.4.0 ✓ (@ 47f4b816)   oats.okf 4.0.4 ✓ (@ a4ccca02)
+packages   acme.tools 0.4.0 ✓ (@ 47f4b816)   oats.okf 4.0.5 ✓ (@ 26d8216f)
 changed    acme.tools  — → 0.4.0 (@ 47f4b816)
 souls      9 discovered (6 members, 1 external, 2 package, 0 disabled here) · 0 private capabilities
 teams      platform (shared) · this deployment's: oats teams
@@ -160,8 +160,8 @@ same workspace commit hold identical locks.
       "source": "catalog:oats.okf",
       "url": "https://github.com/awebai/oats-okf.git",
       "path": "oats-package",
-      "version": "4.0.4",
-      "commit": "a4ccca0230b75961daa00f59f29b8264be6fb5e8",
+      "version": "4.0.5",
+      "commit": "26d8216f8ce986cad1ffa7a8291b4a4978510ee2",
       "integrity": "sha256-…",
       "capabilities": ["oats.okf", "oats.okf-harvest", "oats.okf-maintenance"]
     },
@@ -331,7 +331,7 @@ A soul that names one of the package's capabilities with
 {
   "policy": "docs/official-catalog.md",
   "packages": {
-    "oats.okf":       { "url": "https://github.com/awebai/oats-okf.git", "ref": "v4.0.4", "path": "oats-package" },
+    "oats.okf":       { "url": "https://github.com/awebai/oats-okf.git", "ref": "v4.0.5", "path": "oats-package" },
     "oats.framework": { "url": "https://github.com/awebai/oats.git", "ref": "oats-framework/v1.4.0", "path": "oats-package" }
   }
 }

package/docs/plans/0.30-close-out.md

@@ -1,7 +1,7 @@
 # OATS 0.30 close-out: the shared plan
 
 The single source of truth for the rest of 0.30, owned by BOTH leads (oats-expert-knowledge-reworks
-and oats-expert-antares; Juan asked for joint work on 2026-09-28). Whoever changes the state updates
+and oats-expert-antares, succeeded by oats-expert-steward; Juan asked for joint work on 2026-09-28). Whoever changes the state updates
 this file.
 
 ## Rules
@@ -20,7 +20,7 @@ this file.
 | 5 | The 0.30.0 release PR (brief below) | lead | cli-dev-v2-native | briefed |
 | 6 | Full rehearsal re-run on the final heads (all cases, incl. 5 and 10); close-out; retire case 9; the 0.30 runbook for Juan and Pepe | Antares | — | DONE on the final heads (main kernel stamped 0.30.0 + aweb v1.17.1 + okf v4.0.4): all cases PASS (1–8, 10, onboarding (a)–(e) + resume, the BYOT leave/retire owner commands actually run → revoked, 22 clean retires). Known: 8 (E_SPAWN_FAILED), the BYOT membership limit. Runbook for Juan and Pepe: next |
 | 7a | automations.trust (#300, ACKed a0562b9f) + the Desktop grouping of `untrusted` with owner-mismatch (not here, with the remedy; a real-capture test): the Desktop PR merges BEFORE #300. Both land before the tag, or both go to 0.30.1 together | lead | cli-dev-okf-ops + ux-designer-desktop-redesign | routed |
-| 7 | Tag v0.30.0 after green main CI on the exact release SHA | Antares | — | after 5 and 6 |
+| 7 | Tag v0.30.0 after green main CI on the exact release SHA | Antares | — | DONE: v0.30.0 + oats-framework/v1.4.0 on dec58082 (main CI green on it); published @awebai/oats 0.30.0 (shasum 2e370157) + @awebai/oats-pi 0.30.0, latest; a clean-room onboard with the published package locks framework 1.4.0, aweb 1.17.1, okf 4.0.4, engineering 1.1.0 |
 
 **Sequence:** 1–4 in parallel → 6 on the final heads → 5 with the final pins → 7.
 
@@ -50,6 +50,22 @@ this file.
 8. A check of the PACKED tarball: its `package-catalog.json` carries oats.engineering 1.1.0,
    oats.aweb 1.17.1 and oats.okf 4.0.4.
 
+## Released (2026-09-29)
+**OATS 0.30.0** on npm (`@awebai/oats` and `@awebai/oats-pi`, latest), from `dec58082` (#297).
+Tags `v0.30.0` and `oats-framework/v1.4.0` are both on that SHA. Pins: oats.aweb 1.17.1,
+oats.okf 4.0.4, oats.engineering 1.1.0, framework 1.4.0. A clean-room `oats onboard` against the
+published package locks all of them without a catalog override.
+
+Found by the rehearsals, and fixed before the tag:
+- joined teams unusable against real aw;
+- okf readiness always `unknown`;
+- `oats aweb setup` from a deployment;
+- launch-hook warnings dropped;
+- `readiness --soul` with no soul copy;
+- a newcomer's first `--join`;
+- a stale `settings.team` orphaning identities on retire;
+- a BYOT retire with no owner command.
+
 ## After the tag
 - **Flag day:** the oats.engineering release with the souls' `launch:` (experts on Claude Code +
   Opus 5.5; `code-reviewer` on Codex + Astra; compat `>=0.30.0`), and committing the shared team id.
@@ -57,5 +73,11 @@ this file.
   - the kernel items that miss the tag: retire of homes whose session is gone, automations.trust;
   - deployment-scope capability commands without `--soul`;
   - the case-8 pre-check (`E_TEAM_UNCONFIGURED`).
+  - the kernel refuses an unrecognised spawn argument (a bare `join=oats` without
+    `--provider oats.aweb` was silently ignored, so the spawn joined nothing).
+  - a launch (spawn, `session start`, `session restart`) puts the spawning kernel's bin directory
+    FIRST on the instance's PATH and records it in the launch recipe, so plain `oats` inside an
+    instance is the kernel that made it (two kernels side by side: a 0.30 home ran the global 0.24.6
+    and `oats aweb` was `E_UNKNOWN_COMMAND`; the injected instructions tell agents to run plain `oats`).
 - **Parked:** item L (`git rm agents/`, cli-dev-v2-native). It needs the GitHub `workflow` token
   scope from the human on the lead's machine.

package/docs/release-lane.md

@@ -174,9 +174,14 @@ not weaken the pre-publish build/inventory/ABI gates.
 ## Mirroring a released `oats.okf`
 
 The standalone `awebai/oats-okf` repository is authoritative. This repository
-carries a generated mirror of its capabilities under `capabilities/oats-okf*/`
+carries a generated mirror of its capabilities under `mirrors/oats-okf*/`
 and the inventory `scripts/okf-source-inventory.json`; neither is edited by
-hand. After an okf release is tagged:
+hand. The inventory records each capability at its path inside the package
+(`capabilities/oats-okf`, what the tag attests) and, in `mirrorPaths`, where
+this repository keeps it. The mirror is not under `capabilities/`: this
+repository is a workspace member, and member discovery would list it as a
+latest-state member capability beside the package. After an okf release is
+tagged:
 
 1. Check out the release in a clean clone of `awebai/oats-okf` at the tagged
    commit, with the tag present locally and `origin` pointing at the official

package/docs/release-notes/v0.30.1.md

@@ -0,0 +1,123 @@
+# OATS 0.30.1
+
+## Fixes
+
+- **Desktop: an instance-less soul no longer takes the whole roster down.**
+  `oats status --json` reports an agent row's `key` as `null` when no instance
+  records a workspace soul, as the roster contract documents. That happens for a
+  soul directory with no instances: after a spawn preview of a soul that has
+  never been spawned, or after its last instance is retired. The 0.30.0 Desktop
+  accepted only a string there, so one such row rejected the whole observation
+  with `E_CLI_PROTOCOL` ("The installed OATS CLI returned an invalid deployment
+  observation"). The Desktop now accepts `null` and still refuses any other
+  type.
+- **Knowledge readiness answers, fast.** With oats.okf 4.0.5, `oats readiness`
+  answers the knowledge check from okf's cache in the knowledge `stateDir`, well
+  inside the kernel's 30 s cap, instead of cloning every base and timing out as
+  `unknown` (measured: 7 s against 35 s and `unknown` before). A base that is
+  not cached yet, out of date or unreachable is reported as a named warning or
+  problem, never `unknown`. A spawn with harvest off fills the cache, spending at
+  most 20 s per base, and still refuses a soul that names a node its base does
+  not have.
+- **Desktop: a stored workspace selection the server no longer serves** (a
+  deleted deployment) locked the Desktop out: every roster refresh refused the
+  server's reply as "belongs to a different workspace", and the switcher
+  already showed the served workspace as active. A selection that is not
+  among the served workspaces is now treated like an empty one: both rosters
+  adopt the served workspace and the stored selection is replaced. A
+  selection the server does serve, answered with another workspace, is still
+  refused.
+- **Desktop: terminal tabs are back to native geometry.** 13px system
+  monospace, xterm's default line height, and 32px side gutters with no
+  vertical inset, as before Redesign v3. The block cursor is one cell tall
+  again. A font size you chose yourself is kept.
+- **Desktop: the spawn dialog could stay on "Reading defaults…" forever.**
+  A routine roster refresh restarted the spawn preview while it was still
+  being read, so on a machine where the preview takes several seconds it
+  never finished. The dialog now re-reads only when a fact the preview
+  depends on changes.
+
+## Packages
+
+- **oats.okf 4.0.5** (was 4.0.4 in 0.30.0): the knowledge readiness fix above.
+- **oats.engineering 1.3.0** (was 1.1.0 in 0.30.0).
+  - 1.2.0: the packaged `code-reviewer` launches on Codex with `gpt-6-astra` by default, a different model family from the developers it reviews. A machine without the `codex` binary gets `E_HARNESS_UNAVAILABLE` when it spawns `code-reviewer`, until it installs Codex or overrides the preference (`oats-local.yaml` `souls.launch`, or `--harness`/`--model` at spawn).
+  - 1.3.0: review happens on local branches, before the PR. The developer runs its adversarial loop with the `code-reviewer` on its local branch and hands the reviewed branch to its expert. The expert reviews that branch, and only when it accepts is a PR opened. A returned branch's delta goes back through the same reviewer first.
+
+## Changed
+
+- **Desktop: calmer selection, focus and search fields.** A selected segment
+  (Group by, List/Graph and similar) now uses the brand tint instead of
+  white-on-grey. Clicking a button, tab or row no longer draws a focus ring.
+  Keyboard focus stays visible as the tint plus a thin accent edge, not a
+  2px ring. Search and filter fields have a single border that turns accent
+  on focus, with no inner ring.
+  Sidebar instance rows are more compact, with a gap between highlighted rows,
+  and an instance's pull request number sits before its branch name instead of
+  on its own line.
+- **The official workspace lists each package capability once.** The `oats`
+  repository kept byte mirrors of the official packages' capabilities
+  (`oats.okf`, `oats.aweb`, `oats.jira`, …) under `capabilities/`, so `oats
+  capabilities` in the official workspace also listed each of them as a member
+  capability of `github.com/awebai/oats`, beside its package. The mirrors now
+  live in `mirrors/`, which member discovery does not read, and the npm
+  package no longer carries them (nothing read them at runtime: capabilities
+  resolve from Git at the locked commit). No operator action.
+- **Desktop: clearer Workspace views, and Spawn goes straight to the soul.**
+  Soul cards label their facts ("Team oats", "No instances" instead of a
+  bare "none"), group by repo by default, and keep a compact Spawn on the
+  instances line. Capabilities are compact one-line row cards with a
+  kind-coloured tile, their source and who uses them; a row opens the
+  capability page with the full description. Teams show one card per team,
+  split into shared and this-computer sections. Spawn on a soul card or the
+  soul page opens the spawn dialog for that soul, with a "What will be
+  created" preview (core capabilities and capabilities with their sources);
+  "Change soul" returns to the picker.
+- **Two Desktop souls.** The `oats-desktop-designer` soul is removed.
+  `oats-desktop-expert` now owns Desktop's UX and design direction as well as
+  its product rationale, and `oats-desktop-developer` builds all of
+  `packages/desktop`, including renderer views, styles, themes and copy.
+  Running designer instances keep working until they are retired; `oats
+  status` reports their soul as no longer present.
+- **The legacy Desktop soul trees are removed.** `agents/oats-desktop-engineer`
+  and `agents/ux-designer` were no longer offered souls. The
+  `oats-desktop-expert` knowledge node carries their durable rationale.
+- **The remaining legacy soul trees are removed.** `agents/cli-dev`,
+  `dev-coordinator`, `docs-expert`, `integrations-expert`, `lead`,
+  `oats-coordinator` and `oats-expert` were pre-v2 soul bundles, not offered
+  souls; the offered souls live in `souls/` and the packages. Their bundled
+  knowledge gate (`npm run validate:okf`) goes with them: the souls' knowledge
+  lives in the central knowledge base, which validates itself.
+- **Desktop: a calmer instance panel.** The summary bar under the terminal
+  (harness, tmux target, team marks, Details, Focus mode) is gone, and the
+  terminal gets its height. A panel toggle at the end of the tab bar shows or
+  hides the instance panel (⌥⌘B, Ctrl+Alt+B on Linux and Windows; also in the
+  command palette). Focus mode stays in the palette; in focus mode the panel
+  toggle and the sidebar's edge button stay visible and leave it. The Instance
+  tab drops Built from and Details. When the kernel reports drift, its header
+  shows an "older build" chip whose tooltip says what changed and that
+  re-spawning picks up the new state. Where it works is one card: the work mode
+  in plain words, then repo, branch and home. Messaging is a compact list of
+  teams, with an icon refresh and the identity address on its own line. The Git
+  & GitHub tab is now the Developer tab; it shows branch, changes and pull
+  request cards; the branch line says how far it is from main and, when it has
+  an upstream, how many commits are unpushed. An instance without Git by design
+  (directory or workspace mode) gets a calm "No Git for this instance" note
+  instead of a red error; a worktree that has gone missing still reports its
+  error.
+- **The official workspace's souls declare launch preferences.** Its experts,
+  developers and setup admin prefer Claude Code with Opus 5.5 (`launch:` in
+  each `soul.yaml`); each machine can override them in `oats-local.yaml`
+  `souls.launch`, and spawn flags win over both.
+
+## Still known in 0.30.1
+
+The 0.30.0 notes said the first two below would be fixed in 0.30.1. They are
+not in this release, and are planned for 0.30.2.
+
+- With no teams configured, a spawn is refused by the provider
+  (`E_SPAWN_FAILED`, relaying "no teams configured: run `oats aweb setup`"),
+  not by the kernel's `E_TEAM_UNCONFIGURED`.
+- A capability operator command run from a deployment needs `--soul <soul>`.
+- On a team you control (BYOT), retire cannot revoke membership; the retire
+  prints the owner's `aw id team remove-member` command, as in 0.30.0.

package/docs/souls-and-instances.md

@@ -150,8 +150,8 @@ composed skills and instructions, a spawn records:
       "commit": "3f2a9c1e…", "digest": "sha256-…", "materializedAt": "2026-09-24T10:12:44.118Z"
     },
     "oats.okf": {
-      "from": { "kind": "package", "package": "oats.okf", "version": "4.0.4", "commit": "a4ccca02…", "integrity": "sha256-…", "repoKey": "github.com/awebai/oats-okf" },
-      "commit": "a4ccca02…", "digest": "sha256-…", "materializedAt": "2026-09-24T10:12:44.201Z"
+      "from": { "kind": "package", "package": "oats.okf", "version": "4.0.5", "commit": "26d8216f…", "integrity": "sha256-…", "repoKey": "github.com/awebai/oats-okf" },
+      "commit": "26d8216f…", "digest": "sha256-…", "materializedAt": "2026-09-24T10:12:44.201Z"
     }
   },
   "providers": {

package/docs/workspaces.md

@@ -55,7 +55,7 @@ members:                                   # repo refs, NO @revision (E_WORKSPAC
 
 packages:                                  # the ONLY versioned things
   oats.framework: v1.4.0                   # bare version → resolves through the official catalog
-  oats.okf: v4.0.4
+  oats.okf: v4.0.5
   acme.tools: git:github.com/acme/tools@v0.4.0   # outside the catalog → git:<repo>@<tag|OID>; still a package
 
 teams:                                     # SHARED teams: the same provider team for everyone
@@ -226,6 +226,11 @@ A repository may be a **member** (it completed the handshake; its `souls/*` and
   version }` on the member row (informational) and does **not** list the
   package's capabilities as member capabilities.
 
+A publisher that also keeps copies of its package's capabilities (a mirror, a
+fixture) keeps them outside `capabilities/`, or discovery lists them as member
+capabilities too: the same capability offered twice, once at latest state. The
+`oats` repository keeps its mirrors of the official packages in `mirrors/`.
+
 So the framework's own souls say `oats.okf: { from: package }` even though
 `oats-okf` is a member of the OATS workspace, and every package repo carries a
 member soul that is the expert in that capability (`oats-okf-expert`,

package/lib/packages.mjs

@@ -2,7 +2,7 @@
  * OATS packages — versions, lock v3 (workspace model v2).
  *
  * Contract: docs/design/2026-09-23-workspace-module-contracts.md §4.
- * Decision: agents/oats-expert/soul/knowledge/decisions/workspace-model-v2.md.
+ * Decision: https://github.com/awebai/oats-knowledge/blob/main/knowledge/nodes/oats-expert/decisions/workspace-model-v2.md.
  *
  * A package is a place to fetch from WITH a version attached. Nothing is
  * installed: `resolvePackages` turns each `workspace.packages` entry into an

package/lib/resolve.mjs

@@ -2,7 +2,7 @@
  * lib/resolve.mjs — from a soul to an immutable resolution (module contract §3).
  *
  * Contract: docs/design/2026-09-23-workspace-module-contracts.md §3.
- * Decision: agents/oats-expert/soul/knowledge/decisions/workspace-model-v2.md (6, 12, 14, 16, 19–21).
+ * Decision: https://github.com/awebai/oats-knowledge/blob/main/knowledge/nodes/oats-expert/decisions/workspace-model-v2.md (6, 12, 14, 16, 19–21).
  *
  * `resolveSoul(discovery, soulEntry, options)` turns a discovered soul into the
  * exact set of modules an instance will be built from: which capability comes

package/package-catalog.json

@@ -3,7 +3,7 @@
   "packages": {
     "oats.okf": {
       "url": "https://github.com/awebai/oats-okf.git",
-      "ref": "v4.0.4",
+      "ref": "v4.0.5",
       "path": "oats-package"
     },
     "oats.aweb": {
@@ -28,7 +28,7 @@
     },
     "oats.engineering": {
       "url": "https://github.com/awebai/oats-engineering.git",
-      "ref": "v1.1.0",
+      "ref": "v1.3.0",
       "path": "oats-package"
     },
     "oats.framework": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",
@@ -18,7 +18,6 @@
     "check": "node scripts/check-package-dry-runs.mjs --syntax-only",
     "check:pi": "node --experimental-strip-types --check packages/pi/extension/index.ts",
     "validate": "node scripts/validate-project.mjs",
-    "validate:okf": "node scripts/validate-okf.mjs",
     "pack:check": "node scripts/check-package-dry-runs.mjs",
     "smoke:tarball": "node scripts/clean-room-smoke.mjs"
   },
@@ -32,7 +31,6 @@
     "lib/",
     "skills/",
     "injects/",
-    "capabilities/",
     "docs/",
     "README.md",
     "package-catalog.json",

package/skills/oats-getting-started/SKILL.md

@@ -61,7 +61,7 @@ members:
   - git:github.com/acme/platform
 packages:
   oats.framework: v1.4.0                # bare versions resolve through the official catalog
-  oats.okf: v4.0.4
+  oats.okf: v4.0.5
 defaults:
   capabilities: { oats.core: { from: package } }
   knowledge: { oats.okf: { from: package } }

package/capabilities/oats-authoring/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 OATS Framework
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/capabilities/oats-authoring/oats-package.json

@@ -1,11 +0,0 @@
-{
-  "package": "oats.authoring",
-  "version": "1.0.3",
-  "description": "Official additive OATS guidance for capability, skill, and soul authoring.",
-  "compatibility": {
-    "oats": ">=0.25.0"
-  },
-  "capabilities": [
-    "."
-  ]
-}

package/capabilities/oats-authoring/oats.json

@@ -1,12 +0,0 @@
-{
-  "capability": "oats.authoring",
-  "version": "1.0.3",
-  "compatibility": { "oats": ">=0.25.0" },
-  "description": "Additive framework-authoring guidance for capability packages, agent skills, and souls.",
-  "requires": [],
-  "skills": [
-    "skills/integration-authoring",
-    "skills/skill-craft",
-    "skills/soul-craft"
-  ]
-}

package/capabilities/oats-authoring/skills/integration-authoring/SKILL.md

@@ -1,84 +0,0 @@
----
-name: integration-authoring
-description: >-
-  Route custom OATS capability-package and integration work to the framework's
-  integrations expert. Use when building, adapting, or debugging a reusable
-  capability, new tasks/messaging/knowledge core capability, oats.json manifest,
-  lifecycle hook, or operational command—not merely activating an existing
-  package. Triggers: "custom integration", "capability package", "integrate
-  our tracker", "new messaging integration", "write an oats.json".
----
-
-# Capability and integration authoring — delegate
-
-A capability package may ship skills, instance instructions, requirements,
-namespaced commands, and declared hooks. A core capability is the constrained
-kind that fills one of the knowledge, messaging or tasks positions (its
-manifest's `layer` field names which). Building either requires
-manifest, security, targeting-boundary, collision, and probe discipline; use
-the framework's **integrations-expert** soul rather than improvising.
-
-If the user only wants an existing package, declare it and give it to souls;
-no build is needed:
-
-```yaml
-# oats-workspace.yaml (host repository): declaring the package is the trust decision
-packages:
-  vendor.review: git:github.com/vendor/review@v1.0.0
-# a soul's soul.yaml, or the workspace defaults: a capability the package exports
-# (a package may export several; the soul names each one it wants)
-capabilities:
-  vendor.review: { from: package }
-```
-
-Then run `oats sync` (fetch, verify integrity, lock). The oats.setup
-capability's **oats-package-pins** skill has the procedure.
-
-## 1. Verify the expert is available
-
-Run `oats souls` in the deployment and confirm it resolves the
-`integrations-expert` soul (a member repository or package provides it). If it
-is absent, ask the human which OATS deployment owns reusable package work;
-never locate or import private kernel files.
-
-## 2. Spawn the expert against the package's repository
-
-The package lives in its own repository. Make that repository a member of the
-workspace (or use the member that already holds it), then spawn the expert on
-it:
-
-```bash
-oats spawn integrations-expert --preview \
-  --purpose <package-slug> \
-  --repo <member clone of the package repository> \
-  --work worktree \
-  --task '<capability intent; layer if any; skills/instructions/commands/hooks; external tools; which souls should get it; distribution path>'
-# review the preview, then run the same command without --preview
-```
-
-Use `--relation child --relative-to <your-instance>` only when the documented
-workflow makes the expert your child; otherwise leave the spawn unrelated. A
-package is distributed from its own repository as `oats-package/` with a
-version tag; a framework contribution belongs in the framework's repository.
-
-## 3. Brief the design boundary
-
-Tell the expert:
-
-- whether it is additive or implements exactly one of knowledge/messaging/tasks;
-- external requirements and executable surfaces (commands, hooks);
-- intended distribution and version/compatibility;
-- which souls or workspace defaults should receive it, and its settings; and
-- expected skill/instruction collisions (a duplicate skill name fails the spawn).
-
-Which souls get a capability is declared by the workspace (`defaults`) and the
-souls (`soul.yaml` `capabilities`), never in the manifest. The expert must
-test exact pi/Claude/Codex instance materialization, generated instructions,
-command gating, deterministic hooks, and the lock's integrity check as
-applicable.
-
-## 4. Hand off
-
-Report the new instance (`oats status`). The expert follows its
-package/integration craft, runs a preview-only probe, and leaves the
-`packages:` pin and the `oats sync` for the user.