@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/work-orders/store.d.ts

@@ -60,6 +60,22 @@ export declare const WorkRecord: z.ZodObject<{
         from: z.ZodString;
         to: z.ZodString;
         weakened: z.ZodArray<z.ZodString>;
+        review: z.ZodArray<z.ZodObject<{
+            field: z.ZodString;
+            before: z.ZodString;
+            after: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    acknowledgements: z.ZodArray<z.ZodObject<{
+        at: z.ZodString;
+        by: z.ZodEnum<{
+            agent: "agent";
+            ci: "ci";
+            person: "person";
+        }>;
+        digest: z.ZodString;
+        findings: z.ZodArray<z.ZodString>;
+        note: z.ZodString;
     }, z.core.$strict>>;
     attempts: z.ZodNumber;
     checks: z.ZodOptional<z.ZodObject<{
@@ -105,6 +121,10 @@ export declare const WorkRecord: z.ZodObject<{
         }, z.core.$strict>>;
         note: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    amendmentsFailedReview: z.ZodOptional<z.ZodObject<{
+        at: z.ZodString;
+        note: z.ZodString;
+    }, z.core.$strict>>;
     notes: z.ZodArray<z.ZodObject<{
         at: z.ZodString;
         by: z.ZodEnum<{
@@ -114,11 +134,15 @@ export declare const WorkRecord: z.ZodObject<{
         }>;
         kind: z.ZodEnum<{
             answer: "answer";
+            decision: "decision";
             note: "note";
             question: "question";
+            resolution: "resolution";
         }>;
         text: z.ZodString;
         answers: z.ZodOptional<z.ZodNumber>;
+        resolves: z.ZodOptional<z.ZodNumber>;
+        record: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     closure: z.ZodOptional<z.ZodObject<{
         at: z.ZodString;
@@ -136,6 +160,11 @@ export declare const WorkRecord: z.ZodObject<{
         }>;
         note: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    recoveries: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        at: z.ZodString;
+        holder: z.ZodString;
+        checked: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type WorkRecord = z.infer<typeof WorkRecord>;
 /** Keeps the end of a command's output, where a runner prints its summary, within the record's bound. */
@@ -148,11 +177,31 @@ export interface WorkStore {
         record?: WorkRecord;
         value: T;
     }>) => Promise<T>;
-    readonly recover: (id: string, apply: boolean) => Promise<Readonly<{
-        id: string;
-        lock: 'none' | 'live' | 'unknown' | 'dead' | 'removed';
-        holder?: string;
-    }>>;
+    /** Names a lock's holder and, with `apply`, removes the lock once the holder is shown gone, recording what was checked. */
+    readonly recover: (id: string, apply: boolean, containers: () => Promise<ContainerEvidence>) => Promise<LockRecovery>;
 }
+/** The containers cockpit labels on this machine's Docker daemon, which a process probe cannot look inside. */
+export type ContainerEvidence = Readonly<{
+    state: 'listed';
+    context: string;
+    containers: readonly Readonly<{
+        id: string;
+        name: string;
+        running: boolean;
+    }>[];
+}> | Readonly<{
+    state: 'no-docker';
+    reason: string;
+}> | Readonly<{
+    state: 'unavailable';
+    reason: string;
+}>;
+type LockRecovery = Readonly<{
+    id: string;
+    lock: 'none' | 'live' | 'unknown' | 'dead' | 'removed';
+    holder?: string;
+    checked?: readonly string[];
+    recorded?: boolean;
+}>;
 export declare function createWorkStore(root: string): WorkStore;
 export {};

package/dist/work-orders/store.js

@@ -5,7 +5,9 @@
 // an agent wrote there would read as cockpit's own. A write holds the order's lock file, which a
 // crashed writer leaves behind until `work recover --apply` removes it.
 import { randomUUID } from 'node:crypto';
-import { lstat, mkdir, open, readFile, readdir, rename, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { link, lstat, mkdir, open, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { hostname } from 'node:os';
 import { join } from 'node:path';
 import { z } from 'zod';
 import { isProcessGone, observeProcessStart, processHost } from '../environment/claims.js';
@@ -46,24 +48,62 @@ export const WorkRecord = z.object({
         sources: z.record(z.string(), z.string().length(64)),
         base: z.record(z.string(), z.string().regex(/^[a-f0-9]{40,64}$/)),
     }).strict(),
-    amendments: z.array(z.object({ at, by, from: z.string().length(64), to: z.string().length(64), weakened: z.array(z.string()).max(64) }).strict()).max(256),
+    // `weakened` names what the amendment removed; `review` each change a model, or a person where none grades, judges
+    // against the bar, with its text before and after. An agent's amendment is judged at the next grade.
+    amendments: z.array(z.object({ at, by, from: z.string().length(64), to: z.string().length(64), weakened: z.array(z.string()).max(64),
+        review: z.array(z.object({ field: z.string().max(64), before: z.string().max(131_072), after: z.string().max(131_072) }).strict()).max(128) }).strict()).max(256),
+    // A person's (or, where [work.gates] allows, an agent's or CI's) acknowledgement that the change weakened tests:
+    // it covers exactly the findings its digest names, so a later weakening needs its own.
+    acknowledgements: z.array(z.object({ at, by, digest: z.string().length(64), findings: z.array(z.string().max(1_100)).max(256), note }).strict()).max(256),
     attempts: z.number().int().min(0),
     checks: z.object({ at, digest: z.string().length(64), results: z.array(CheckResult).max(64) }).strict().optional(),
     grade: Grade.optional(),
-    notes: z.array(z.object({ at, by: z.enum(['agent', 'person', 'ci']), kind: z.enum(['note', 'question', 'answer']), text: note,
-        answers: z.number().int().min(1).optional() }).strict()).max(1_024),
+    // A grade found the agent's amendments lowered the bar. It outlives the grade a later check or grade
+    // replaces, and only an amendment a person or CI accepts clears it, so the next amendment stays theirs.
+    amendmentsFailedReview: z.object({ at, note: z.string().max(4_096) }).strict().optional(),
+    // A decision is resolved by a later `resolution` note naming it in `resolves`: with `record`, the decision
+    // record it is written in; without, `text` says why it made no lasting decision. The latest resolution counts.
+    notes: z.array(z.object({ at, by: z.enum(['agent', 'person', 'ci']), kind: z.enum(['note', 'question', 'answer', 'decision', 'resolution']), text: note,
+        answers: z.number().int().min(1).optional(), resolves: z.number().int().min(1).optional(), record: z.string().max(1_100).optional() }).strict()).max(1_024),
     closure: z.object({ at, by, how: z.enum(['graded', 'checks-passed', 'self-reported', 'partial', 'abandoned']), note: note.optional() }).strict().optional(),
+    // Each lock `work recover --apply` removed: the holder it named and what was checked to call it gone.
+    recoveries: z.array(z.object({ at, holder: z.string().max(1_024), checked: z.array(z.string().max(1_024)).max(16) }).strict()).max(256).optional(),
 }).strict();
 /** Keeps the end of a command's output, where a runner prints its summary, within the record's bound. */
 export function outputTail(value) {
     const bytes = Buffer.from(value);
     return bytes.byteLength <= OUTPUT_TAIL_BYTES ? value : `[...]${bytes.subarray(bytes.byteLength - OUTPUT_TAIL_BYTES).toString('utf8')}`;
 }
-// A lock names its holder as pid@start, so a reused pid never keeps a dead writer's lock alive.
+// A lock names its writer: pid and start, so a reused pid never keeps a dead writer's lock alive, and
+// the host and whether it ran in a container, because a pid means nothing outside the process table
+// it came from. Docker names a container's host after the container, unless it shares the machine's network.
+const LockHolder = z.object({ pid: z.number().int().min(1), start: z.string().max(256).optional(), host: z.string().min(1).max(255), container: z.boolean() }).strict();
+const inContainer = () => existsSync('/.dockerenv') || existsSync('/run/.containerenv');
 const holder = async () => {
     const observed = await observeProcessStart(process.pid, processHost(executeProbe));
-    return observed.state === 'present' ? `${process.pid}@${observed.start}` : `${process.pid}`;
+    return { pid: process.pid, ...observed.state === 'present' ? { start: observed.start } : {}, host: hostname(), container: inContainer() };
 };
+// Whether the holder is shown running or gone, looking first where a pid probe cannot; anything unproven is unknown.
+async function judgeHolder(found, containers) {
+    const here = hostname();
+    const listed = containers.state === 'listed' ? containers.containers : [];
+    const checked = [`the lock was written by process ${found.pid} on host ${found.host}${found.container ? ' inside a container' : ''}`, `this machine is host ${here}`,
+        (containers.state === 'listed' ? `Docker context ${containers.context} lists ${listed.length} cockpit-labelled container(s)${listed.length
+            ? `: ${listed.map(row => `${row.name} (${row.running ? 'running' : 'stopped'})`).join(', ')}` : ''}`
+            : containers.state === 'no-docker' ? `no Docker client is installed (${containers.reason}), so no container on this machine runs cockpit`
+                : `Docker could not be read: ${containers.reason}`).slice(0, 1_024)];
+    if (containers.state === 'unavailable')
+        return { lock: 'unknown', checked };
+    if (found.host !== here || found.container) {
+        const writer = /^[a-f0-9]{12}$/.test(found.host) ? listed.find(row => row.id.startsWith(found.host)) : undefined;
+        if (!writer)
+            return { lock: 'unknown', checked: [...checked, 'the writer ran on another host or in a container this machine does not list, whose processes this machine cannot see'] };
+        return { lock: writer.running ? 'live' : 'dead', checked: [...checked, `container ${writer.name}, which wrote it, is ${writer.running ? 'running' : 'stopped, so none of its processes runs'}`] };
+    }
+    const observed = await observeProcessStart(found.pid, processHost(executeProbe));
+    const lock = isProcessGone(found.start, observed) ? 'dead' : observed.state === 'unknown' ? 'unknown' : 'live';
+    return { lock, checked: [...checked, `process ${found.pid} on this machine is ${lock === 'dead' ? 'gone' : observed.state === 'unknown' ? `not observable (${observed.reason})` : 'running'}`] };
+}
 export function createWorkStore(root) {
     const directory = join(root, WORK_RECORD_DIRECTORY);
     const pathOf = (id, suffix) => {
@@ -103,21 +143,21 @@ export function createWorkStore(root) {
     const lock = async (id) => {
         await mkdir(directory, { recursive: true });
         const path = pathOf(id, '.lock');
-        const recorded = await holder();
+        // The holder is written before the lock appears, by linking a finished file into place, so a
+        // crash never leaves a lock that names nobody and so could never be shown gone.
+        const staged = `${path}.${randomUUID()}.tmp`;
+        await writeFile(staged, `${JSON.stringify(await holder())}\n`, { flag: 'wx', mode: 0o644 });
         try {
-            const handle = await open(path, 'wx', 0o644);
-            try {
-                await handle.writeFile(`${recorded}\n`);
-            }
-            finally {
-                await handle.close();
-            }
+            await link(staged, path);
         }
         catch (error) {
             if (!hasErrorCode(error, 'EEXIST'))
                 throw error;
             throw new RefusalError(`work order ${id} is locked by another cockpit command (${WORK_RECORD_DIRECTORY}/${id}.lock); wait for it, or if it crashed run npx --no cockpit work recover --config <your cockpit.toml> --work-order ${id} --apply`);
         }
+        finally {
+            await rm(staged, { force: true });
+        }
         return async () => { await rm(path, { force: true }); };
     };
     const write = async (record) => {
@@ -170,7 +210,7 @@ export function createWorkStore(root) {
                 await release();
             }
         },
-        recover: async (id, apply) => {
+        recover: async (id, apply, containers) => {
             const path = pathOf(id, '.lock');
             let text;
             try {
@@ -181,16 +221,70 @@ export function createWorkStore(root) {
                     return { id, lock: 'none' };
                 throw error;
             }
-            const recorded = text.trim();
-            const [pidText, start] = recorded.split('@', 2);
-            const observed = await observeProcessStart(Number(pidText), processHost(executeProbe));
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch (error) {
+                if (!(error instanceof SyntaxError))
+                    throw error;
+            }
+            const found = LockHolder.safeParse(parsed);
+            const shown = text.trim().slice(0, 1_024);
+            if (!found.success)
+                return { id, lock: 'unknown', holder: shown, checked: ['the lock does not name its holder the way cockpit writes one'] };
             // A lock whose writer is still running, or cannot be shown gone, is never removed: the write it guards may be in progress.
-            if (!isProcessGone(start, observed))
-                return { id, lock: observed.state === 'unknown' ? 'unknown' : 'live', holder: recorded };
-            if (!apply)
-                return { id, lock: 'dead', holder: recorded };
-            await rm(path, { force: true });
-            return { id, lock: 'removed', holder: recorded };
+            const judged = await judgeHolder(found.data, await containers());
+            if (judged.lock !== 'dead' || !apply)
+                return { id, lock: judged.lock, holder: shown, checked: judged.checked };
+            // The lock is taken over rather than deleted, so no other writer slips in before the recovery is recorded.
+            // Two recoveries that both judged it dead must not both replace it and then each delete the other's: each
+            // links its holder at the takeover name, which only one can create, and only that one replaces the lock.
+            const ours = `${path}.${randomUUID()}.tmp`;
+            const takeover = `${path}.takeover`;
+            await writeFile(ours, `${JSON.stringify(await holder())}\n`, { flag: 'wx', mode: 0o644 });
+            try {
+                try {
+                    await link(ours, takeover);
+                }
+                catch (error) {
+                    if (!hasErrorCode(error, 'EEXIST'))
+                        throw error;
+                    throw new RefusalError(`another work recover is taking over the lock on ${id}; rerun work recover once it finishes, `
+                        + `or if none is running, a person removes ${WORK_RECORD_DIRECTORY}/${id}.lock.takeover, which a crashed recovery left`);
+                }
+                let replaced = false;
+                try {
+                    let current;
+                    try {
+                        current = await readFile(path, 'utf8');
+                    }
+                    catch (error) {
+                        if (!hasErrorCode(error, 'ENOENT'))
+                            throw error;
+                    }
+                    if (current !== text)
+                        throw new RefusalError(`the lock on ${id} changed while it was being recovered; rerun work recover`);
+                    await rename(takeover, path);
+                    replaced = true;
+                }
+                finally {
+                    if (!replaced)
+                        await rm(takeover, { force: true });
+                }
+            }
+            finally {
+                await rm(ours, { force: true });
+            }
+            try {
+                const record = await read(id);
+                if (record)
+                    await write({ ...record, recoveries: [...record.recoveries ?? [], { at: new Date().toISOString(), holder: shown, checked: [...judged.checked] }] });
+                return { id, lock: 'removed', holder: shown, checked: judged.checked, recorded: record !== undefined };
+            }
+            finally {
+                await rm(path, { force: true });
+            }
         },
     };
     return store;

package/docs/README.md

@@ -22,13 +22,16 @@ contributor pages live separately under docs/contributing/.
 ## Guides
 
 - [Joining a team's cockpit](joining-a-team.md): install and verify a cockpit from a fresh clone.
-- [Environment lifecycle](environment.md): setup, bring-up, health, logs, reset and seeding.
+- [Environment lifecycle](environment.md): setup, bring-up, health, logs, reset and seeding;
+  worktrees, Compose profiles, one-service commands and pruning stacks across the machine.
 - [Compose patterns](compose-patterns.md): vendor stubs, TLS and data restore in plain Compose.
 - [Harness surfaces](harness-surfaces.md): what `sync` writes for each agent tool, and overlays.
 - [Extending cockpit](extending.md): supported extension points, what an upgrade replaces and the build-beside pattern.
 - [Safety and autonomy](safety-and-autonomy.md): what guards allow, ask about and deny.
-- [Work and browser workflows](work-and-browser.md): work orders, grading, browser checks and
-  test tiers.
+- [Work and browser workflows](work-and-browser.md): work orders, grading, test protection,
+  decisions, browser checks and test tiers.
+- [Living documents and decision records](docs-check.md): find documents that cite removed paths
+  or make targets, and decision records whose numbers, index or statuses disagree.
 
 ## Reference
 

package/docs/capability-matrix.md

@@ -2,7 +2,7 @@
 
 <!-- Generated by `npm run references`; edit its sources, not this file. -->
 
-<!-- Source manifest: 94a3b5d0068e28fa3dc3ce7751dd8e3dc2d35d7a5e067980a8b09ff479f3ea7a -->
+<!-- Source manifest: 7db847121f6f4cf7fc6608625e755acc97326e8320ea425b807d7de8a283f70c -->
 
 This generated page is for users checking what cockpit actually enforces in each agent tool. Each cell holds one of four states:
 
@@ -15,15 +15,15 @@ Only a dated run of the real tool changes a state; writing a file or passing coc
 
 Written says whether `sync` writes the tool's files for a cockpit.toml that lists no tools: the tools whose guard firing is measured are the default `[surfaces] tools`, and any other tool is written only once listed (`npx --no cockpit tool add <tool> --config <your cockpit.toml>`).
 
-Guard firing is the generated hook refusing a protected operation. Instruction loading is the tool reading the guidance cockpit writes for it, including the guides of sibling repositories. Skills are the tool loading the skills cockpit renders: `cockpit-setup`, `cockpit-explain`, `cockpit-fix` and `cockpit-work`. The session-start check is the tool running `cockpit check` as a session starts and showing its drift report to the agent.
+Guard firing is the generated hook refusing a protected operation. Instruction loading is the tool reading the guidance cockpit writes for it, including the guides of sibling repositories. Skills are the tool loading the skills cockpit renders: `cockpit-setup`, `cockpit-explain`, `cockpit-fix` and `cockpit-work`. The session-start check is the tool running `cockpit check` as a session starts and showing its drift report to the agent. Remote MCP servers are the tool connecting to an approved streamable HTTP server with the credential cockpit spells for it: an environment reference or a headers helper. Worktree grants are the tool letting the agent write a checkout `cockpit use` serves from outside the declared one, through a machine-local file cockpit writes.
 
-| Tool | Written | Guard firing | Instruction loading | Skills | Session-start check |
-| --- | --- | --- | --- | --- | --- |
-| Claude Code (`claudecode`) | by default | enforced | instructed | instructed | instructed |
-| Codex (`codexcli`) | by default | enforced (needs a person) | instructed | instructed | instructed (needs a person) |
-| OpenCode (`opencode`) | by default | enforced | instructed | instructed | unavailable |
-| Cursor (`cursor`) | when listed | unavailable | generated | generated | unavailable |
-| Grok Build (`grokcli`) | when listed | unavailable | generated | generated | unavailable |
+| Tool | Written | Guard firing | Instruction loading | Skills | Session-start check | Remote MCP servers | Worktree grants |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| Claude Code (`claudecode`) | by default | enforced | instructed | instructed | instructed | instructed (needs a person) | enforced (needs a person) |
+| Codex (`codexcli`) | by default | enforced (needs a person) | instructed | instructed | instructed (needs a person) | instructed | unavailable |
+| OpenCode (`opencode`) | by default | enforced | instructed | instructed | unavailable | instructed | enforced |
+| Cursor (`cursor`) | when listed | unavailable | generated | generated | unavailable | unavailable | unavailable |
+| Grok Build (`grokcli`) | when listed | unavailable | generated | generated | unavailable | unavailable | unavailable |
 
 ## Measurements
 
@@ -37,6 +37,12 @@ Each line gives the date and tool version of the run and what it showed.
 - OpenCode, instruction loading (2026-11-03, version 1.19.5): a sibling guide copied into the root AGENTS.md loaded, as did a guide named through a link in the opencode.jsonc instructions list, while the undeclared sibling's guide and the decoy did not.
 - Claude Code, session-start check (2026-11-03, version 2.1.317): a SessionStart hook in .claude/settings.json ran under claude -p and the agent quoted its stdout back, while a hook under a misspelled event name never ran and Claude Code named it as ignored.
 - Codex, session-start check (2026-11-03, version 0.166.0): only after a person trusts the hook, as for the guard: a trusted SessionStart hook in .codex/hooks.json ran under codex exec and the agent quoted its stdout back, while a hook under a misspelled event name never ran.
+- Claude Code, remote MCP servers (2026-11-04, version 2.1.318): from a project .mcp.json, Claude Code sent the Authorization header a ${NAME} reference named while a $NAME control went out literally; it ran a headersHelper given with --mcp-config, but refused to run one from the project file until a person trusts the workspace, and a misspelled headerHelper sent nothing.
+- Codex, remote MCP servers (2026-11-04, version 0.166.0): from a project .codex/config.toml in a directory Codex had not been told to trust, codex exec sent the bearer_token_env_var and env_http_headers values and the http_headers_helper output, named a misspelled http_header_helper as ignored, and sent a ${NAME} written in http_headers literally.
+- OpenCode, remote MCP servers (2026-11-04, version 1.19.5): opencode mcp list sent headers expanded from {env:NAME} in a project opencode.jsonc while a ${NAME} control went out literally; its remote server schema has no headers helper, so a server that declares one is not written for it.
+- Claude Code, worktree grants (2026-11-04, version 2.1.318): a directory in .claude/settings.local.json permissions.additionalDirectories was written and the control refused, and a malformed twin granted nothing; measured in an untrusted workspace, so whether it combines with the committed list once a person trusts the workspace is unmeasured.
+- Codex, worktree grants (2026-11-04, version 0.166.0): Codex reads no machine-local project file; --add-dir at start made the worktree writable and without it the write was refused, so cockpit use prints that flag and writes nothing.
+- OpenCode, worktree grants (2026-11-04, version 1.19.5): the machine-local grant file holding the worktree path allowed the write and the control was denied, and a pattern naming a missing grant file stopped OpenCode at start, naming the file.
 
 ## Without a measurement
 
@@ -47,4 +53,6 @@ Each line gives the date and tool version of the run and what it showed.
 - Skills in Cursor (`.cursor/skills`) and Grok Build (`.grok/skills`): cockpit writes the files, but no run of the tool beside a broken control has shown that it loads them.
 - Session-start check in OpenCode: OpenCode 1.19.5 delivers session.created to a plugin, but no run has shown a plugin putting text in the agent's context, so cockpit generates no session-start check.
 - Session-start check in Cursor and Grok Build: cockpit generates no hook for this tool.
+- Remote MCP servers in Cursor and Grok Build: cockpit writes no remote MCP server for this tool: its remote transport and header spelling have not been checked.
+- Worktree grants in Cursor and Grok Build: the tool was not installed where this was measured, so cockpit use writes nothing for it.
 - Browser native transports (the playwright MCP tools and the pinned Playwright CLI) in Claude Code, Codex and OpenCode: cockpit declares them and the browser skill says each still needs a person's paired call beside a broken control; no cockpit command runs or records that call, so the browser commands drive the browser through cockpit's own project client instead.

package/docs/cli-reference.md

@@ -53,6 +53,41 @@ Reads `cockpit.toml` from `--config`.
 | 2 | failure |
 | 130 | cancelled |
 
+## cockpit use
+
+Serve a sibling from another of its checkouts, such as a worktree.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--clear` | boolean | `false` |
+| `--json` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
+## cockpit pull
+
+Fast-forward the cockpit and its siblings to their upstreams.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
 ## cockpit sibling
 
 Add or remove a repository in cockpit.toml (sibling add, sibling remove).
@@ -96,6 +131,23 @@ Reads `cockpit.toml` from `--config`.
 | 2 | failure |
 | 130 | cancelled |
 
+## cockpit confirm
+
+Confirm an init answer no person stated by running the observation that verifies it.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
 ## cockpit registry-resolve
 
 Turn a validated shell registry into data shell scripts can source.
@@ -217,6 +269,7 @@ Reads `cockpit.toml` from `--config`.
 | --- | --- | --- |
 | `--config` | string | unset |
 | `--json` | boolean | `false` |
+| `--profile` | string | unset |
 
 | Exit | Meaning |
 | --- | --- |
@@ -250,6 +303,7 @@ Reads `cockpit.toml` from `--config`.
 | Flag | Type | Default |
 | --- | --- | --- |
 | `--config` | string | unset |
+| `--profile` | string | unset |
 
 | Exit | Meaning |
 | --- | --- |
@@ -278,6 +332,76 @@ Reads `cockpit.toml` from `--config`.
 | 2 | failure |
 | 130 | cancelled |
 
+## cockpit ps
+
+Show the state and health of each service in this checkout's stack.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
+## cockpit restart
+
+Restart one service of this checkout's stack and wait until it is healthy.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+| `--service` | string | unset |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
+## cockpit rebuild
+
+Rebuild one service's image, replace its container and wait until it is healthy.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+| `--service` | string | unset |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
+## cockpit exec
+
+Run a command inside one service's container of this checkout's stack.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--service` | string | unset |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
 ## cockpit sleep
 
 Release this checkout and stop the stack if no other holder remains.
@@ -331,6 +455,25 @@ Reads `cockpit.toml` from `--config`.
 | 2 | failure |
 | 130 | cancelled |
 
+## cockpit stacks
+
+List every stack on this machine, or preview and remove those whose checkout is gone (stacks prune).
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--apply` | boolean | `false` |
+| `--interactive` | boolean | `false` |
+| `--json` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
 ## cockpit doctor
 
 Report environment problems without changing anything.
@@ -425,7 +568,7 @@ Reads `cockpit.toml` from `--config`.
 
 ## cockpit work note
 
-Record a note on an order, or with --ask an open question that blocks it.
+Record a note on an order, an open question with --ask, or a decision with --decision.
 
 Reads `cockpit.toml` from `--config`.
 
@@ -436,6 +579,31 @@ Reads `cockpit.toml` from `--config`.
 | `--work-order` | string | unset |
 | `--text` | string | unset |
 | `--ask` | boolean | `false` |
+| `--decision` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
+## cockpit work decide
+
+Resolve a recorded decision: write or cite its decision record, or say it is not lasting.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+| `--work-order` | string | unset |
+| `--decision` | string | unset |
+| `--record` | boolean | `false` |
+| `--record-file` | string | unset |
+| `--supersedes` | string | unset |
+| `--none` | boolean | `false` |
+| `--reason` | string | unset |
 
 | Exit | Meaning |
 | --- | --- |
@@ -464,6 +632,26 @@ Reads `cockpit.toml` from `--config`.
 | 2 | failure |
 | 130 | cancelled |
 
+## cockpit work acknowledge
+
+Acknowledge that an order weakened tests, as [work.gates] allows.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
+| `--work-order` | string | unset |
+| `--note` | string | unset |
+| `--interactive` | boolean | `false` |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
 ## cockpit work grade
 
 Grade an accepted order the way [work] grading says.
@@ -573,6 +761,8 @@ Reads `cockpit.toml` from `--config`.
 | `--config` | string | unset |
 | `--json` | boolean | `false` |
 | `--role` | string | unset |
+| `--route` | string | unset |
+| `--fail-on-findings` | boolean | `false` |
 
 | Exit | Meaning |
 | --- | --- |
@@ -591,6 +781,24 @@ Reads `cockpit.toml` from `--config`.
 | `--config` | string | unset |
 | `--json` | boolean | `false` |
 | `--role` | string | unset |
+| `--route` | string | unset |
+
+| Exit | Meaning |
+| --- | --- |
+| 0 | success |
+| 2 | failure |
+| 130 | cancelled |
+
+## cockpit docs check
+
+Report removed paths and make targets living docs still cite, and broken decision records.
+
+Reads `cockpit.toml` from `--config`.
+
+| Flag | Type | Default |
+| --- | --- | --- |
+| `--config` | string | unset |
+| `--json` | boolean | `false` |
 
 | Exit | Meaning |
 | --- | --- |