@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/cli/capabilities-command.ts

@@ -83,6 +83,7 @@ export async function runCapabilities(argv: string[]): Promise<number> {
         flags: cap.flags,
         mutates: cap.mutates,
         json: cap.json,
+        ...(cap.usage !== undefined ? { usage: cap.usage } : {}),
         ...(cap.details ? { details: cap.details } : {}),
       })),
       ...(route === undefined && !mutatingOnly ? { headCapabilities: HEAD_CAPABILITIES } : {}),

package/src/cli/capabilities-integrations.ts

@@ -0,0 +1,264 @@
+import type { Capability } from "./capability-types";
+
+export const INTEGRATION_CAPABILITIES: readonly Capability[] = [
+  {
+    command: ["grok", "status"],
+    usage: "ocx grok status [--json]",
+    summary: "Read Grok model fence state and catalog.",
+    routes: [{"method": "GET", "path": "/api/grok"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["integration grok is an alias of grok; show aliases status. Saving selection and applying the saved fence are separate actions.", "Apply receipts can report changed or skippedReason; success is not a guarantee of a changed client file."],
+  },
+  {
+    command: ["grok", "set"],
+    usage: "ocx grok set <model,model...> [--json]",
+    summary: "Replace the excluded Grok model list.",
+    routes: [{"method": "PUT", "path": "/api/grok/selection"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["integration grok is an alias of grok; show aliases status. Saving selection and applying the saved fence are separate actions.", "Apply receipts can report changed or skippedReason; success is not a guarantee of a changed client file."],
+  },
+  {
+    command: ["grok", "exclude"],
+    usage: "ocx grok exclude <model,model...> [--json]",
+    summary: "Add models to the Grok exclusion list.",
+    routes: [{"method": "GET", "path": "/api/grok"}, {"method": "PUT", "path": "/api/grok/selection"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["integration grok is an alias of grok; show aliases status. Saving selection and applying the saved fence are separate actions.", "Apply receipts can report changed or skippedReason; success is not a guarantee of a changed client file."],
+  },
+  {
+    command: ["grok", "include"],
+    usage: "ocx grok include <model,model...> [--json]",
+    summary: "Remove models from the Grok exclusion list.",
+    routes: [{"method": "GET", "path": "/api/grok"}, {"method": "PUT", "path": "/api/grok/selection"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["integration grok is an alias of grok; show aliases status. Saving selection and applying the saved fence are separate actions.", "Apply receipts can report changed or skippedReason; success is not a guarantee of a changed client file."],
+  },
+  {
+    command: ["grok", "clear"],
+    usage: "ocx grok clear [--json]",
+    summary: "Clear Grok exclusions.",
+    routes: [{"method": "PUT", "path": "/api/grok/selection"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["integration grok is an alias of grok; show aliases status. Saving selection and applying the saved fence are separate actions.", "Apply receipts can report changed or skippedReason; success is not a guarantee of a changed client file."],
+  },
+  {
+    command: ["grok", "apply"],
+    usage: "ocx grok apply [--json]",
+    summary: "Apply the saved Grok model fence.",
+    routes: [{"method": "POST", "path": "/api/grok/apply"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["integration grok is an alias of grok; show aliases status. Saving selection and applying the saved fence are separate actions.", "Apply receipts can report changed or skippedReason; success is not a guarantee of a changed client file."],
+  },
+  {
+    command: ["integration", "client", "status"],
+    usage: "ocx integration client status [--client <id>] [--profile <id>] [--json]",
+    summary: "Read all file integrations, one client or an Aside profile.",
+    routes: [{"method": "GET", "path": "/api/client-integrations"}, {"method": "GET", "path": "/api/client-integrations/{clientId}"}, {"method": "GET", "path": "/api/client-integrations/aside/profiles"}, {"method": "GET", "path": "/api/client-integrations/aside/profiles/{profileId}"}],
+    flags: [{"name": "--client", "value": "string", "summary": "File integration ID; aside selects profiles."}, {"name": "--profile", "value": "number", "summary": "Aside nonnegative integer account ID; requires --client aside."}, {"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["show and list alias status; omitted Aside profile means the aggregate profile collection."],
+  },
+  {
+    command: ["integration", "client", "history"],
+    usage: "ocx integration client history [--client <id>] [--profile <id>] [--json]",
+    summary: "Read integration rollback history and snapshot availability.",
+    routes: [{"method": "GET", "path": "/api/client-integrations/journal"}, {"method": "GET", "path": "/api/client-integrations/aside/profiles/journal"}, {"method": "GET", "path": "/api/client-integrations/aside/profiles/{profileId}/journal"}],
+    flags: [{"name": "--client", "value": "string", "summary": "File integration ID; aside selects profiles."}, {"name": "--profile", "value": "number", "summary": "Aside nonnegative integer account ID; requires --client aside."}, {"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["journal is an alias. Ordinary client filtering uses ?client=; expired snapshots remain visibly expired."],
+  },
+  {
+    command: ["integration","client","enable"],
+    usage: "ocx integration client enable --client <id> [--profile <id>] [--overwrite-conflict] [--plan-fingerprint <token>] [--reasoning-default <model=effort> ... | --clear-reasoning-defaults] [--json]",
+    summary: "Apply the selected managed file integration.",
+    routes: [{"method":"PUT","path":"/api/client-integrations/{clientId}"},{"method":"PUT","path":"/api/client-integrations/aside/profiles"},{"method":"PUT","path":"/api/client-integrations/aside/profiles/{profileId}"}],
+    flags: [{"name":"--client","value":"string","summary":"Explicit file integration ID.","required":true},{"name":"--profile","value":"number","summary":"Aside nonnegative integer account ID; requires --client aside."},{"name":"--overwrite-conflict","value":"boolean","summary":"Explicitly permit replacing a conflicting block."},{"name":"--json","value":"boolean","summary":"Emit the result as JSON."},{"name":"--plan-fingerprint","value":"string","summary":"Optional versioned token from a matching preview; stale intent is refused without retry."},{"name":"--reasoning-default","value":"string","summary":"Repeat MODEL=EFFORT to replace the full Droid defaults map; exact model IDs, duplicate keys refused."},{"name":"--clear-reasoning-defaults","value":"boolean","summary":"Droid apply/overwrite only: send an empty map, distinct from omitted inherited defaults."}],
+    mutates: true,
+    json: "payload",
+    details: ["An omitted Aside profile toggles all Aside profiles. Ownership, snapshots, journal and conflict refusals remain server-owned.","Partial Aside failures remain failures after emitting the per-profile result. Never infer permission to overwrite from a refusal.","Bound Aside mutations require one explicit profile. Repeat the exact preview action/profile/options. The token is concurrency evidence, not authorization; stale state requires a new explicit preview.","Droid map omission preserves inheritance; supplied entries replace the full map, clear sends {}. Only Droid apply/overwrite accepts these options."],
+  },
+  {
+    command: ["integration","client","disable"],
+    usage: "ocx integration client disable --client <id> [--profile <id>] [--plan-fingerprint <token>] [--json]",
+    summary: "Disable the selected managed file integration.",
+    routes: [{"method":"PUT","path":"/api/client-integrations/{clientId}"},{"method":"PUT","path":"/api/client-integrations/aside/profiles"},{"method":"PUT","path":"/api/client-integrations/aside/profiles/{profileId}"}],
+    flags: [{"name":"--client","value":"string","summary":"Explicit file integration ID.","required":true},{"name":"--profile","value":"number","summary":"Aside nonnegative integer account ID; requires --client aside."},{"name":"--json","value":"boolean","summary":"Emit the result as JSON."},{"name":"--plan-fingerprint","value":"string","summary":"Optional versioned token from a matching preview; stale intent is refused without retry."}],
+    mutates: true,
+    json: "payload",
+    details: ["An omitted Aside profile toggles all Aside profiles. Ownership, snapshots, journal and conflict refusals remain server-owned.","Partial Aside failures remain failures after emitting the per-profile result. Never infer permission to overwrite from a refusal.","Bound Aside mutations require one explicit profile. Repeat the exact preview action/profile/options. The token is concurrency evidence, not authorization; stale state requires a new explicit preview."],
+  },
+  {
+    command: ["integration","client","restore"],
+    usage: "ocx integration client restore --op <opId> [--client aside --profile <id>] [--confirm-drift] [--preview | --plan-fingerprint <token>] [--json]",
+    summary: "Restore a selected rollback operation, retaining drift refusal.",
+    routes: [{"method":"POST","path":"/api/client-integrations/restore"},{"method":"POST","path":"/api/client-integrations/aside/profiles/{profileId}/restore"},{"method":"POST","path":"/api/client-integrations/restore/preview"},{"method":"POST","path":"/api/client-integrations/aside/profiles/{profileId}/preview"}],
+    flags: [{"name":"--op","value":"string","summary":"Operation ID; --op-id is an alias.","required":true},{"name":"--client","value":"string","summary":"File integration ID; aside selects profiles."},{"name":"--profile","value":"number","summary":"Aside nonnegative integer account ID; requires --client aside."},{"name":"--confirm-drift","value":"boolean","summary":"Explicitly allow replacing edits made after the snapshot."},{"name":"--json","value":"boolean","summary":"Emit the result as JSON."},{"name":"--preview","value":"boolean","summary":"Inspect restoration without mutating; exclusive with a commit fingerprint."},{"name":"--plan-fingerprint","value":"string","summary":"Optional versioned token from a matching preview; stale intent is refused without retry."}],
+    mutates: true,
+    json: "payload",
+    details: ["With --client, restore requires --profile; only Aside profiles accept that selector. No automatic drift confirmation or retry.","Preview preserves exact opId/profile/confirm-drift intent. Generic restore derives the client on the server; the returned plan does not embed opId or complete command input.","A refused or no-op preview is completed inspection, not applied work. A stale bound mutation exits5 with a fixed re-preview hint; no replacement token is automatically adopted."],
+  },
+  {
+    command: ["claude", "config", "status"],
+    usage: "ocx claude config status [--json]",
+    summary: "Read effective Claude Code configuration.",
+    routes: [{"method": "GET", "path": "/api/claude-code"}],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["show is an alias; integration claude forwards to the same handler."],
+  },
+  {
+    command: ["claude", "config", "set"],
+    usage: "ocx claude config set [--enabled <on|off>] [--auth-mode <auto|proxy|subscription>] [--system-env <on|off>] [--fast-mode <on|off>] [--auto-context <on|off>] [--compact-window <tokens|default>] [--inject-agents <on|off>] [--small-fast-model <id|->] [--model-map <from=to,...|->] [--blocked-skills <name,name|->] [--web-model <id|->] [--web-backend <openai|anthropic|xai|gemini|exa|->] [--vision-model <id|->] [--vision-backend <openai|anthropic|->] [--json]; or ocx claude config set --first-party <on|off> [--json]",
+    summary: "Change Claude Code settings through the runtime owner.",
+    routes: [{"method": "PUT", "path": "/api/claude-code"}],
+    flags: [{"name": "--enabled", "value": "string", "summary": "on or off."}, {"name": "--auth-mode", "value": "string", "summary": "auto, proxy or subscription."}, {"name": "--system-env", "value": "string", "summary": "on or off."}, {"name": "--fast-mode", "value": "string", "summary": "on or off."}, {"name": "--auto-context", "value": "string", "summary": "on or off."}, {"name": "--compact-window", "value": "string", "summary": "Positive token count or default to clear."}, {"name": "--inject-agents", "value": "string", "summary": "on or off."}, {"name": "--small-fast-model", "value": "string", "summary": "Model ID; - clears."}, {"name": "--model-map", "value": "string", "summary": "Comma-separated from=to mappings; - clears."}, {"name": "--blocked-skills", "value": "string", "summary": "Comma-separated names; - clears."}, {"name": "--web-model", "value": "string", "summary": "Model ID; - clears."}, {"name": "--web-backend", "value": "string", "summary": "openai, anthropic, xai, gemini, exa or -."}, {"name": "--vision-model", "value": "string", "summary": "Model ID; - clears."}, {"name": "--vision-backend", "value": "string", "summary": "openai, anthropic or -."}, {"name": "--first-party", "value": "string", "summary": "on or off; must be the only setting."}, {"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["At least one setting is required. --first-party must be set alone and writes Claude settings immediately.", "Clear both helper model and backend with - to restore inheritance. Preserve shared_proxy_retained warnings."],
+  },
+  {
+    command: ["claude", "desktop", "show"],
+    usage: "ocx claude desktop show [--json]",
+    summary: "Inspect the desired profile derived on this machine.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local config/catalog derivation, not GET of the remote desired profile. On a connected client scope is local; apply uses the hub profile. Catalog derivation may discover upstream models."],
+  },
+  {
+    command: ["claude", "desktop", "move"],
+    usage: "ocx claude desktop move <provider/model> <opus|fable|sonnet|haiku> [--default]",
+    summary: "Move an available route to a local Desktop family.",
+    routes: [],
+    flags: [{"name": "--default", "value": "boolean", "summary": "Make this route the family default."}],
+    mutates: true,
+    json: "none",
+    details: ["Local profile persistence only; no management HTTP or --json. On connected clients this does not change the hub profile."],
+  },
+  {
+    command: ["claude", "desktop", "default"],
+    usage: "ocx claude desktop default <opus|fable|sonnet|haiku> <provider/model|none>",
+    summary: "Set or clear a local Desktop family default.",
+    routes: [],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: ["Local profile persistence only; none clears the default. Connected Desktop apply uses the hub profile."],
+  },
+  {
+    command: ["claude", "desktop", "export"],
+    usage: "ocx claude desktop export <path|->",
+    summary: "Export the persisted local Desktop profile.",
+    routes: [],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: ["Local file output; - writes JSON to stdout. There is no --json flag. A file destination is overwritten; this is not a GUI draft export."],
+  },
+  {
+    command: ["claude", "desktop", "import"],
+    usage: "ocx claude desktop import <path> [--apply]",
+    summary: "Import a local Desktop profile, optionally applying it as a static gateway.",
+    routes: [{"method": "POST", "path": "/api/claude-desktop/apply"}],
+    flags: [{"name": "--apply", "value": "boolean", "summary": "After saving, apply as a static gateway."}],
+    mutates: true,
+    json: "none",
+    details: ["Without --apply this only persists locally. With a live local proxy, gateway apply is delegated by HTTP; otherwise local helpers apply it.", "Connected clients refuse import --apply. A saved profile can remain saved after application fails; no --json mode."],
+  },
+  {
+    command: ["claude", "desktop", "apply"],
+    usage: "ocx claude desktop [apply] [--first-party | --gateway [--static|--hybrid|--discovery-only]]",
+    summary: "Apply Claude Desktop first-party interception or gateway profile.",
+    routes: [{"method": "POST", "path": "/api/claude-desktop/apply"}],
+    flags: [{"name": "--first-party", "value": "boolean", "summary": "Keep Desktop on claude.ai and intercept its Code tab."}, {"name": "--gateway", "value": "boolean", "summary": "Apply a third-party gateway profile."}, {"name": "--static", "value": "boolean", "summary": "Static gateway model catalog."}, {"name": "--hybrid", "value": "boolean", "summary": "Hybrid gateway catalog."}, {"name": "--discovery-only", "value": "boolean", "summary": "Discovery-only gateway catalog."}],
+    mutates: true,
+    json: "none",
+    details: ["Uses local helpers or the live local apply route; connected gateway clients use the hub profile download path. No --json mode.", "First-party requires a local hub with interception enabled. Preserve account-risk warnings, trust prompts and ownership refusals; metadata grants no consent.", "Application and committed-marker persistence can diverge; inspect status after application and preserve warnings."],
+  },
+  {
+    command: ["integration","client","preview"],
+    usage: "ocx integration client preview --client <id> --operation <apply|overwrite|disable> [--profile <id>] [--reasoning-default <model=effort> ... | --clear-reasoning-defaults] [--json]",
+    summary: "Inspect a managed client change before choosing whether to apply it.",
+    routes: [{"method":"POST","path":"/api/client-integrations/preview"},{"method":"POST","path":"/api/client-integrations/aside/profiles/{profileId}/preview"}],
+    flags: [{"name":"--client","required":true,"value":"string","summary":"Explicit client; profile selectors require aside."},{"name":"--profile","value":"number","summary":"One Aside nonnegative integer profile ID."},{"name":"--operation","required":true,"value":"string","summary":"Required apply, overwrite or disable; Aside requires one profile."},{"name":"--reasoning-default","value":"string","summary":"Repeat MODEL=EFFORT to replace the full Droid defaults map; exact model IDs, duplicate keys refused."},{"name":"--clear-reasoning-defaults","value":"boolean","summary":"Droid apply/overwrite only: send an empty map, distinct from omitted inherited defaults."},{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["Uses an existing passive model snapshot; an unavailable preview never secretly refreshes providers or changes client files.","A valid refused plan, including an unbound refusal, is readable inspection. Only an applicable bound token can accompany a later write; repeat the original command intent.","Shows structural paths and consequences, not secret values or a client-file diff."],
+  },
+  {
+    command: ["integration","client","history","remove"],
+    usage: "ocx integration client history remove --op <opId> --yes [--client aside [--profile <id>]] [--json]",
+    summary: "Retire a selected rollback-history entry and its retained snapshot.",
+    routes: [{"method":"DELETE","path":"/api/client-integrations/journal"},{"method":"DELETE","path":"/api/client-integrations/aside/profiles/journal"},{"method":"DELETE","path":"/api/client-integrations/aside/profiles/{profileId}/journal"}],
+    flags: [{"name":"--op","required":true,"value":"string","summary":"Exact operation ID to retire."},{"name":"--yes","required":true,"value":"boolean","summary":"Required explicit confirmation of irreversible rollback-history retirement."},{"name":"--client","value":"string","summary":"Explicit client; profile selectors require aside."},{"name":"--profile","value":"number","summary":"One Aside nonnegative integer profile ID."},{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["journal remove is an alias. Omitting --client addresses the global journal; --client aside selects Aside history and optional --profile narrows it. Other clients are rejected for deletion scope.","The server protects the latest row and validates ownership. snapshotRemoved:false reports committed retirement with incomplete cleanup and exits1; never retry blindly or claim rollback."],
+  },
+  {
+    command: ["integration","client","sync"],
+    usage: "ocx integration client sync --client aside [--json]",
+    summary: "Refresh the managed Aside profiles through their existing owner.",
+    routes: [{"method":"POST","path":"/api/client-integrations/aside/sync"}],
+    flags: [{"name":"--client","required":true,"value":"string","summary":"Explicit client; profile selectors require aside."},{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: true,
+    json: "envelope",
+    details: ["Uses the existing local attested synchronization exchange; no new public target/auth option, profile override or broad sync fallback.","Empty results mean no eligible profiles. Partial or malformed outcomes stay nonzero with safe per-profile recovery facts."],
+  },
+  {
+    command: ["claude","desktop","profile","show"],
+    usage: "ocx claude desktop profile show [--json]",
+    summary: "Read the selected running proxy’s Desktop profile and available models.",
+    routes: [{"method":"GET","path":"/api/claude-desktop"}],
+    flags: [{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["The existing claude desktop show remains local. Runtime profile observation can gather model inventory; it is not guaranteed offline."],
+  },
+  {
+    command: ["claude","desktop","profile","import"],
+    usage: "ocx claude desktop profile import <file|-> [--json]",
+    summary: "Validate and save a Desktop profile on the selected running proxy.",
+    routes: [{"method":"PUT","path":"/api/claude-desktop"}],
+    flags: [{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: true,
+    json: "payload",
+    details: ["Bounded JSON file or explicit stdin; canonical DesktopProfile validation and the management owner retain availability, concurrent-save and applied-marker rules.","Save only: --apply and native-mode flags are refused, and failed management writes never save a local fallback. Apply separately through the existing Desktop workflow."],
+  },
+  {
+    command: ["integration","native","cursor","status"],
+    usage: "ocx integration native cursor status [--json]",
+    summary: "Read Cursor installation, gateway requirements and model capabilities.",
+    routes: [{"method":"GET","path":"/api/native-integrations/cursor"}],
+    flags: [{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["Status can gather model inventory but does not install or toggle Cursor. A displayed placeholder does not authorize a credential-required listener."],
+  },
+  {
+    command: ["integration","native","cursor","local-installer"],
+    usage: "ocx integration native cursor local-installer [--json]",
+    summary: "Read the available Cursor installer link without downloading or installing it.",
+    routes: [{"method":"GET","path":"/api/native-integrations/cursor/local-installer"}],
+    flags: [{"name":"--json","value":"boolean","summary":"Emit one validated task result as JSON."}],
+    mutates: false,
+    json: "payload",
+    details: ["May fetch the public update manifest. available:false and nullable reason are valid observations; no installation or trust change is performed."],
+  },
+];

package/src/cli/capabilities-lab.ts

@@ -0,0 +1,214 @@
+import type { Capability } from "./capability-types";
+
+export const LAB_CAPABILITIES: readonly Capability[] = [
+  {
+    command: ["lab", "status"],
+    usage: "ocx lab status [--json]",
+    summary: "Read local Lab projection status.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "verdicts"],
+    usage: "ocx lab verdicts [--subject <subject>] [--layer <layer>] [--suite <suite>] [--verdict <verdict>] [--from <ms>] [--to <ms>] [--limit <n>] [--cursor <cursor>] [--json]",
+    summary: "Read local Lab verdicts.",
+    routes: [],
+    flags: [{"name": "--subject", "value": "string", "summary": "Exact subject ID."}, {"name": "--layer", "value": "string", "summary": "Evidence layer."}, {"name": "--suite", "value": "string", "summary": "Suite ID."}, {"name": "--verdict", "value": "string", "summary": "Compatibility verdict."}, {"name": "--from", "value": "number", "summary": "Inclusive timestamp in milliseconds."}, {"name": "--to", "value": "number", "summary": "Timestamp upper bound in milliseconds."}, {"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--cursor", "value": "string", "summary": "Opaque page cursor."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Read commands do not start probes or scheduler ticks."],
+  },
+  {
+    command: ["lab", "subjects"],
+    usage: "ocx lab subjects [--kind <kind>] [--limit <n>] [--cursor <cursor>] [--json]",
+    summary: "Read local Lab subjects.",
+    routes: [],
+    flags: [{"name": "--kind", "value": "string", "summary": "Subject kind."}, {"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--cursor", "value": "string", "summary": "Opaque page cursor."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Read commands do not start probes or scheduler ticks."],
+  },
+  {
+    command: ["lab", "observations"],
+    usage: "ocx lab observations [--subject <subject>] [--layer <layer>] [--suite <suite>] [--scenario <scenario>] [--outcome <outcome>] [--execution-mode <execution-mode>] [--from <ms>] [--to <ms>] [--limit <n>] [--cursor <cursor>] [--json]",
+    summary: "Read local Lab observations.",
+    routes: [],
+    flags: [{"name": "--subject", "value": "string", "summary": "Exact subject ID."}, {"name": "--layer", "value": "string", "summary": "Evidence layer."}, {"name": "--suite", "value": "string", "summary": "Suite ID."}, {"name": "--scenario", "value": "string", "summary": "Scenario ID."}, {"name": "--outcome", "value": "string", "summary": "Observation outcome."}, {"name": "--execution-mode", "value": "string", "summary": "Execution mode."}, {"name": "--from", "value": "number", "summary": "Inclusive timestamp in milliseconds."}, {"name": "--to", "value": "number", "summary": "Timestamp upper bound in milliseconds."}, {"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--cursor", "value": "string", "summary": "Opaque page cursor."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Read commands do not start probes or scheduler ticks."],
+  },
+  {
+    command: ["lab", "events"],
+    usage: "ocx lab events [--event-kind <event-kind>] [--subject <subject>] [--from <ms>] [--to <ms>] [--excluded <true|false>] [--limit <n>] [--cursor <cursor>] [--json]",
+    summary: "Read local Lab events.",
+    routes: [],
+    flags: [{"name": "--event-kind", "value": "string", "summary": "Event kind."}, {"name": "--subject", "value": "string", "summary": "Exact subject ID."}, {"name": "--from", "value": "number", "summary": "Inclusive timestamp in milliseconds."}, {"name": "--to", "value": "number", "summary": "Timestamp upper bound in milliseconds."}, {"name": "--excluded", "value": "string", "summary": "true or false; takes a value."}, {"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--cursor", "value": "string", "summary": "Opaque page cursor."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Read commands do not start probes or scheduler ticks."],
+  },
+  {
+    command: ["lab", "artifacts"],
+    usage: "ocx lab artifacts [--status <status>] [--artifact-class <artifact-class>] [--limit <n>] [--cursor <cursor>] [--json]",
+    summary: "Read local Lab artifacts.",
+    routes: [],
+    flags: [{"name": "--status", "value": "string", "summary": "present, corrupt or purged_unavailable."}, {"name": "--artifact-class", "value": "string", "summary": "Artifact class."}, {"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--cursor", "value": "string", "summary": "Opaque page cursor."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Read commands do not start probes or scheduler ticks."],
+  },
+  {
+    command: ["lab", "catalog"],
+    usage: "ocx lab catalog [--layer <layer>] [--suite <suite>] [--json]",
+    summary: "Read local Lab catalog.",
+    routes: [],
+    flags: [{"name": "--layer", "value": "string", "summary": "Evidence layer."}, {"name": "--suite", "value": "string", "summary": "Suite ID."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Read commands do not start probes or scheduler ticks."],
+  },
+  {
+    command: ["lab", "subject"],
+    usage: "ocx lab subject <subjectId> [--json]",
+    summary: "Inspect one local Lab subject.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "event"],
+    usage: "ocx lab event <eventId> [--json]",
+    summary: "Inspect one local Lab event.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "artifact"],
+    usage: "ocx lab artifact <digest> [--json]",
+    summary: "Inspect one local Lab artifact.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "production-signals"],
+    usage: "ocx lab production-signals --subject <id> [--limit <n>] [--json]",
+    summary: "Read passive production context for one exact Lab route subject.",
+    routes: [],
+    flags: [{"name": "--subject", "value": "string", "summary": "Exact Lab route subject ID.", "required": true}, {"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Passive production context is not verification evidence."],
+  },
+  {
+    command: ["lab", "public", "preview"],
+    usage: "ocx lab public preview --event <eventId> [--event <eventId> ...] [--json]",
+    summary: "Preview unsigned local public evidence.",
+    routes: [],
+    flags: [{"name": "--event", "value": "string", "summary": "Event ID; repeat for multiple records.", "required": true}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "No remote publishing occurs. Preview creates no publisher key; export can create local signing identity and bundle files."],
+  },
+  {
+    command: ["lab", "public", "export"],
+    usage: "ocx lab public export --event <eventId> [--event <eventId> ...] [--json]",
+    summary: "Export signed local public evidence.",
+    routes: [],
+    flags: [{"name": "--event", "value": "string", "summary": "Event ID; repeat for multiple records.", "required": true}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: true,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "No remote publishing occurs. Preview creates no publisher key; export can create local signing identity and bundle files."],
+  },
+  {
+    command: ["lab", "public", "verify"],
+    usage: "ocx lab public verify --file <bundle.json> [--json]",
+    summary: "Verify a public evidence file.",
+    routes: [],
+    flags: [{"name": "--file", "value": "string", "summary": "Public evidence bundle path.", "required": true}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Signature validity proves integrity/continuity, not local verification.", "A verification failure emits its structured summary and then returns nonzero."],
+  },
+  {
+    command: ["lab", "public", "import"],
+    usage: "ocx lab public import --file <bundle.json> [--json]",
+    summary: "Import public evidence as untrusted community context.",
+    routes: [],
+    flags: [{"name": "--file", "value": "string", "summary": "Public evidence bundle path.", "required": true}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: true,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Signature validity proves integrity/continuity, not local verification.", "Imported community evidence never becomes locally verified evidence."],
+  },
+  {
+    command: ["lab", "public", "community"],
+    usage: "ocx lab public community [--json]",
+    summary: "List local untrusted community evidence context.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "automation", "status"],
+    usage: "ocx lab automation [status] [--json]",
+    summary: "Read local automation policy, queue and run state.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "automation", "enable"],
+    usage: "ocx lab automation enable [--protocol] [--live] [--json]",
+    summary: "Enable local Lab automation layers.",
+    routes: [],
+    flags: [{"name": "--protocol", "value": "boolean", "summary": "Select protocol conformance."}, {"name": "--live", "value": "boolean", "summary": "Select live route compatibility; may spend upstream quota."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: true,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "These flags already exist in the local handler. With neither flag, preserve current layer selection; with either flag, select only requested layers.", "Persists local policy, reconciles the queue and starts a scheduler in this CLI process; this is not a remote scheduler control API. Task-effectiveness background remains disabled."],
+  },
+  {
+    command: ["lab", "automation", "disable"],
+    usage: "ocx lab automation disable [--json]",
+    summary: "Disable local Lab automation.",
+    routes: [],
+    flags: [{"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: true,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "Persists disabled policy, reconciles the local queue and stops this process scheduler."],
+  },
+  {
+    command: ["lab", "automation", "runs"],
+    usage: "ocx lab automation runs [--limit <n>] [--cursor <c>] [--json]",
+    summary: "List locally persisted automation runs.",
+    routes: [],
+    flags: [{"name": "--limit", "value": "number", "summary": "Positive page size."}, {"name": "--cursor", "value": "string", "summary": "Opaque page cursor."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: false,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied."],
+  },
+  {
+    command: ["lab", "run"],
+    usage: "ocx lab run --layer <protocol_conformance|live_route_compatibility|task_effectiveness> --scenario <id> [--provider <name>] [--model <id>] [--json]",
+    summary: "Plan and enqueue an explicit local Lab run.",
+    routes: [],
+    flags: [{"name": "--layer", "value": "string", "summary": "Evidence layer.", "required": true}, {"name": "--scenario", "value": "string", "summary": "Scenario ID.", "required": true}, {"name": "--provider", "value": "string", "summary": "Configured provider name."}, {"name": "--model", "value": "string", "summary": "Model ID."}, {"name": "--json", "value": "boolean", "summary": "Emit the local result as JSON."}],
+    mutates: true,
+    json: "envelope",
+    details: ["Local Lab helpers and storage only; no management HTTP. Remote/live-proxy equivalence is not implied.", "The live-route layer installs a production route executor and can spend upstream quota. Explicit operator authorization is required for probes.", "An enqueued run receipt is not a completed verification. No run-cancel or full policy/routes editor is claimed."],
+  },
+];