@bradheitmann/odin-sentinel 0.4.2 → 0.4.4

package/protocol/bootstrap-skill.md

@@ -1,13 +1,13 @@
 ---
 name: sentinel-coordination-protocol
 description: "Operate and improve SCP governance for multi-agent teams: self-bootstrap and teardown of federated pods, generic role topology, TEAM PM / TEAM ODIN separation, minimal bootstrap receipts, terminal locator identity, control-plane non-implementation, delegation receipts, terminal/CMUX delivery proof and verdicts, heartbeat cadence, branch-visible claims, adversarial QA, finish audit, and safe skill dissemination. Use when introducing SCP v3.5; installing SCP skills/adapters for Codex, Claude Code, OpenCode, Droid, Crush, OpenHands, Goose, KiloCode, Cursor, Zed, Pi, or other local coding agents; assigning EXEC/TEAM/WORKER roles; or preventing premature activation from an uncommitted draft artifact."
-version: 3.6.0
+version: 3.6.1
 updated: 2026-05-11
 ---
 
 # Sentinel Coordination Protocol
 
-Use this skill for SCP policy introduction, repo landing, adoption-gate proof, controlled dissemination, active multi-agent control loops, and automated team lifecycle management. SCP is a governance layer for multi-team agent operation; it does not replace external lifecycle orchestration system or `AGENTS.md`. It sits above them after activation.
+Use this skill for SCP policy introduction, repo landing, adoption-gate proof, controlled dissemination, active multi-agent control loops, and automated team lifecycle management. SCP is a governance layer for multi-team agent operation; it complements other coordination layers and `AGENTS.md` files where present. It sits above them after activation.
 
 ## Source Of Truth
 
@@ -25,22 +25,22 @@ Portable curated skill/session records may live under the skill directory, for e
 
 - Treat SCP packages or protocol bundles imported from Downloads, temp directories, external artifacts, narrative reports, or uncommitted checkouts as drafts until a repo-capable agent lands them under the canonical repo path and records proof.
 - Do not activate SCP from Downloads, a temp directory, an uncommitted checkout, or a narrative report.
-- Keep the pre-activation exception intact: the current `EXEC PM` may continue hands-on hygiene, planning, governance-artifact, and ledger-bootstrap work until Brad or the CXO explicitly declares transition after the adoption gate clears. `codex-pm` is a legacy/session alias for a pane currently acting as `EXEC PM`; it is not a role name.
+- Keep the pre-activation exception intact: the current `EXEC PM` may continue hands-on hygiene, planning, governance-artifact, and ledger-bootstrap work until the user or designated authority explicitly declares transition after the adoption gate clears. `codex-pm` is a legacy/session alias for a pane currently acting as `EXEC PM`; it is not a role name.
 - Make every closure claim claim-bound. Lifecycle closure requires both branch-visible persistence and QA-accepted correctness.
 - Require adversarial QA. A summary, spot-check, liveness check, or "looks good" is not QA acceptance.
 - Keep agents interchangeable by role, not by blurred authority. Any supported harness may serve any role only after it has a clean boot block declaring the current role, write scope, branch, cwd, model/harness, and proof source. The same assignment must not QA and close its own work.
 - Preserve strict scope. Governance/package work cannot mutate product code, Loop runtime, design prototypes, operational-team work product, or lifecycle state unless explicitly authorized.
 - Use zero-secret-output behavior. Never print tokens, API keys, OAuth material, or config values. Report secret presence by name/count/status only.
 - Under SCP, team topology is the audit surface. If work is not visible in CMUX, it is not governed work.
-- Preserve official SCP team topology. Once `EXEC PM` has bootstrapped the executive office and pods, role-named CMUX panes/surfaces are immutable operating slots. Do not close, delete, rename, repurpose, or replace the slot itself unless Brad explicitly authorizes that exact slot mutation.
+- Preserve official SCP team topology. Once `EXEC PM` has bootstrapped the executive office and pods, role-named CMUX panes/surfaces are immutable operating slots. Do not close, delete, rename, repurpose, or replace the slot itself unless the user explicitly authorizes that exact slot mutation.
 - Treat agents as occupants of durable role slots. If a model/harness is blocked, stale, over budget, in plan mode, context-exhausted, or wrong for the task, clear, restart, exit, or substitute the agent occupant inside the existing role slot. Do not remove the CMUX pane/surface.
-- Do not create extra panes, extra workers, hidden assistants, invisible subagents, or ad hoc capacity during an active SCP run unless Brad explicitly authorizes topology expansion. `EXEC PM` must route work to official roles already present in CMUX.
+- Do not create extra panes, extra workers, hidden assistants, invisible subagents, or ad hoc capacity during an active SCP run unless the user explicitly authorizes topology expansion. `EXEC PM` must route work to official roles already present in CMUX.
 - Do not use invisible internal subagents, hidden background forks, non-terminal model assistants, or `spawn_agent` while SCP is active. Delegation must be visible through CMUX/terminal surfaces, boot receipts, terminal locators, delivery proof, and ODIN polling.
 - `$delegate` under SCP means governed visible delegation to an existing CMUX role slot. It does not authorize hidden model fan-out, off-ledger research, or new worker invention.
 - Enforce model/harness diversity and cost discipline. SCP must distribute work across available inference sources and avoid concentrating routine work in ChatGPT/Codex, Claude Code, or any single scarce quota pool.
-- Current local policy: Gemini models are not assigned during SCP runs unless Brad explicitly reauthorizes Gemini for a named task. If this is later relaxed, record it as a model-mix policy update.
-- Claude Code is limited to one active instance per pod by default unless Brad explicitly authorizes an exception.
-- If `EXEC PM` believes a specialized model/harness outside the current team topology is required, it must stop and ping Brad with: exact need, why existing visible roles cannot do it, proposed model/harness, cost tier, scope, expiry condition, and risk if not added.
+- Current local policy: Gemini models are not assigned during SCP runs unless the user explicitly reauthorizes Gemini for a named task. If this is later relaxed, record it as a model-mix policy update.
+- Claude Code is limited to one active instance per pod by default unless the user explicitly authorizes an exception.
+- If `EXEC PM` believes a specialized model/harness outside the current team topology is required, it must stop and ping the user with: exact need, why existing visible roles cannot do it, proposed model/harness, cost tier, scope, expiry condition, and risk if not added.
 - `A/EXEC-PM` is the sole staffing authority. No TEAM PM staffs its own pod or any other pod. No worker spawns capacity. Any staffing action originating outside `A/EXEC-PM` is a protocol breach. TEAM PMs needing more staff must escalate to `A/EXEC-PM` and not act.
 - `A/EXEC-PM` is the sole CMUX surface custodian. `cmux new-split`, `cmux new-surface`, `cmux move-surface`, `cmux close-surface`, and `cmux drag-surface-to-split` are EXEC-PM-only operations. TEAM PMs and workers do not split, move, or close panes.
 - Surface layout follows the canonical packing rule: max two surfaces per column, equal column widths, Team A in column 0, Team A alone in the tall column when team count is odd and at least 3. See the Surface Layout Custodianship section for the full algorithm and pre-staffing gate.
@@ -77,13 +77,13 @@ SCP role names are generic. Do not bind authority to model names, harness names,
 Preferred role taxonomy:
 
 - `EXEC PM`: owns intent, priority, authorization, escalation, and final branch-visible claim framing.
-- `EXEC ODIN`: executive-office meta-control role. Reports to Brad/user authority, not to `EXEC PM`; watches governance health, polling, delivery, permission waits, role boundaries, cross-team ODIN mesh state, and closeout hygiene. Coordinates with `EXEC PM` as a coequal control-plane partner and may advise, prod, freeze, or escalate, but does not implement, QA-accept, expand scope, or act as another assistant by default.
+- `EXEC ODIN`: executive-office meta-control role. Reports to user authority, not to `EXEC PM`; watches governance health, polling, delivery, permission waits, role boundaries, cross-team ODIN mesh state, and closeout hygiene. Coordinates with `EXEC PM` as a coequal control-plane partner and may advise, prod, freeze, or escalate, but does not implement, QA-accept, expand scope, or act as another assistant by default.
 - `EXEC ASST`: owns CMUX delivery proof, heartbeat ledger, pane inventory, artifact index, reminders, and "did the command land?" checks.
 - `EXEC DISPATCH` / `SWITCHBOARD`: optional executive-office attention router. Owns CMUX notification watching, waiting-agent detection, short relay pings to responsible PM/ODIN roles, and provider/harness routing recommendations according to declared policy and health. Does not approve permissions, expand scope, implement, QA-accept, or synthesize beyond routing summaries unless separately authorized.
 - `EXEC RSCH`: read-only strategy, research, alternatives, context recovery, and architectural risk analysis.
 - `EXEC QA`: independent adversarial audit of process, evidence, closure language, branch proof, and drift.
 - `TEAM PM`: pod-level task router and assignment owner. Receives assignments from `EXEC PM`, activates pod workers, coordinates with `TEAM ODIN`, and reports pod state. Does not implement or QA-close by default.
-- `TEAM ODIN`: pod-level meta-control role. Reports to Brad/user authority through the ODIN layer while coordinating with, not subordinating to, `TEAM PM`. Monitors panes, polls lane health, intervenes on blockers, freezes unsafe work, reports health, and maintains lateral ODIN mesh awareness. Does not implement.
+- `TEAM ODIN`: pod-level meta-control role. Reports to user authority through the ODIN layer while coordinating with, not subordinating to, `TEAM PM`. Monitors panes, polls lane health, intervenes on blockers, freezes unsafe work, reports health, and maintains lateral ODIN mesh awareness. Does not implement.
 - `DEV WORKER`: bounded implementation inside exact write scope with evidence.
 - `QA WORKER`: independent adversarial QA inside exact review scope. Cannot QA own work or self-close.
 - `SHADOW REVIEWER`: read-only drift, stale-proof, scope, validator, and evidence watcher.
@@ -124,23 +124,23 @@ Every boot receipt and team manifest should include a `terminal_locator` block.
 
 ```yaml
 terminal_locator:
-  terminal_app: cmux | tmux | wezterm | iterm2 | ghostty | warp | cursor | zed | vscode | unknown
-  terminal_adapter: cmux | tmux | libghostyy | apple_script | cli | ide_terminal | unavailable
-  workspace_ref: <workspace:1 | tmux-session | unavailable>
-  workspace_id: <uuid-or-stable-id | unavailable>
-  window_ref: <window:1 | tmux-window | unavailable>
-  window_id: <uuid-or-stable-id | unavailable>
-  pane_ref: <pane:47 | %3 | unavailable>
-  pane_id: <uuid-or-stable-id | unavailable>
-  surface_ref: <surface:40 | tab/pane route | unavailable>
-  surface_id: <uuid-or-stable-id | unavailable>
-  tab_ref: <tab:40 | unavailable>
-  tab_id: <uuid-or-stable-id | unavailable>
-  surface_type: terminal | browser | editor | unknown
-  title: <visible pane/tab title>
-  route_command: <non-secret command or unavailable>
-  locator_source: <command/tool/observation used>
-  locator_captured_at: <ISO-8601 timestamp or unavailable>
+ terminal_app: cmux | tmux | wezterm | iterm2 | ghostty | warp | cursor | zed | vscode | unknown
+ terminal_adapter: cmux | tmux | libghostyy | apple_script | cli | ide_terminal | unavailable
+ workspace_ref: <workspace:1 | tmux-session | unavailable>
+ workspace_id: <uuid-or-stable-id | unavailable>
+ window_ref: <window:1 | tmux-window | unavailable>
+ window_id: <uuid-or-stable-id | unavailable>
+ pane_ref: <pane:47 | %3 | unavailable>
+ pane_id: <uuid-or-stable-id | unavailable>
+ surface_ref: <surface:40 | tab/pane route | unavailable>
+ surface_id: <uuid-or-stable-id | unavailable>
+ tab_ref: <tab:40 | unavailable>
+ tab_id: <uuid-or-stable-id | unavailable>
+ surface_type: terminal | browser | editor | unknown
+ title: <visible pane/tab title>
+ route_command: <non-secret command or unavailable>
+ locator_source: <command/tool/observation used>
+ locator_captured_at: <ISO-8601 timestamp or unavailable>
 ```
 
 For CMUX, prefer `cmux --json --id-format both identify` or equivalent because it exposes both human-short refs and UUIDs. For tmux, capture session/window/pane using `tmux display-message -p`; tmux pane ids like `%3` are the native stable handle inside a server, not UUIDs. For WezTerm, use its CLI/json pane/window/tab ids where available. For iTerm2/Ghostty/Warp/IDE terminals, record the strongest scriptable locator available and mark the rest `unavailable`.
@@ -151,36 +151,36 @@ If a terminal adapter exposes libghostty-vt or a congruent virtual-terminal API,
 
 ```yaml
 vt_state_snapshot:
-  vt_provider: libghostty-vt | terminal-capture | unavailable
-  vt_api_stability: work_in_progress_unstable | stable | unknown
-  terminal_instance_ref: <GhosttyTerminal handle/ref or unavailable>
-  terminal_instance_id: <product-generated id or unavailable>
-  pty_ref: <pty/process route or unavailable>
-  capture_source: <formatter | render_state | grid_ref | read_screen | unavailable>
-  formatter_format: plain | vt | html | unavailable
-  rows: <GHOSTTY_TERMINAL_DATA_ROWS or unavailable>
-  cols: <GHOSTTY_TERMINAL_DATA_COLS or unavailable>
-  total_rows: <GHOSTTY_TERMINAL_DATA_TOTAL_ROWS or unavailable>
-  scrollback_rows: <GHOSTTY_TERMINAL_DATA_SCROLLBACK_ROWS or unavailable>
-  width_px: <GHOSTTY_TERMINAL_DATA_WIDTH_PX or unavailable>
-  height_px: <GHOSTTY_TERMINAL_DATA_HEIGHT_PX or unavailable>
-  active_screen: primary | alternate | unavailable
-  cursor_x: <GHOSTTY_TERMINAL_DATA_CURSOR_X or unavailable>
-  cursor_y: <GHOSTTY_TERMINAL_DATA_CURSOR_Y or unavailable>
-  cursor_visible: true | false | unavailable
-  cursor_pending_wrap: true | false | unavailable
-  title: <GHOSTTY_TERMINAL_DATA_TITLE or unavailable>
-  pwd: <GHOSTTY_TERMINAL_DATA_PWD or unavailable>
-  render_dirty: false | partial | full | unavailable
-  semantic_prompt_observed: true | false | unavailable
-  semantic_input_observed: true | false | unavailable
-  semantic_output_observed: true | false | unavailable
-  paste_safety_checked: true | false | unavailable
-  paste_safe: true | false | unavailable
-  key_encoding_provider: libghostty-vt | terminal | unavailable
-  mouse_encoding_provider: libghostty-vt | terminal | unavailable
-  focus_encoding_provider: libghostty-vt | terminal | unavailable
-  snapshot_captured_at: <ISO-8601 timestamp or unavailable>
+ vt_provider: libghostty-vt | terminal-capture | unavailable
+ vt_api_stability: work_in_progress_unstable | stable | unknown
+ terminal_instance_ref: <GhosttyTerminal handle/ref or unavailable>
+ terminal_instance_id: <product-generated id or unavailable>
+ pty_ref: <pty/process route or unavailable>
+ capture_source: <formatter | render_state | grid_ref | read_screen | unavailable>
+ formatter_format: plain | vt | html | unavailable
+ rows: <GHOSTTY_TERMINAL_DATA_ROWS or unavailable>
+ cols: <GHOSTTY_TERMINAL_DATA_COLS or unavailable>
+ total_rows: <GHOSTTY_TERMINAL_DATA_TOTAL_ROWS or unavailable>
+ scrollback_rows: <GHOSTTY_TERMINAL_DATA_SCROLLBACK_ROWS or unavailable>
+ width_px: <GHOSTTY_TERMINAL_DATA_WIDTH_PX or unavailable>
+ height_px: <GHOSTTY_TERMINAL_DATA_HEIGHT_PX or unavailable>
+ active_screen: primary | alternate | unavailable
+ cursor_x: <GHOSTTY_TERMINAL_DATA_CURSOR_X or unavailable>
+ cursor_y: <GHOSTTY_TERMINAL_DATA_CURSOR_Y or unavailable>
+ cursor_visible: true | false | unavailable
+ cursor_pending_wrap: true | false | unavailable
+ title: <GHOSTTY_TERMINAL_DATA_TITLE or unavailable>
+ pwd: <GHOSTTY_TERMINAL_DATA_PWD or unavailable>
+ render_dirty: false | partial | full | unavailable
+ semantic_prompt_observed: true | false | unavailable
+ semantic_input_observed: true | false | unavailable
+ semantic_output_observed: true | false | unavailable
+ paste_safety_checked: true | false | unavailable
+ paste_safe: true | false | unavailable
+ key_encoding_provider: libghostty-vt | terminal | unavailable
+ mouse_encoding_provider: libghostty-vt | terminal | unavailable
+ focus_encoding_provider: libghostty-vt | terminal | unavailable
+ snapshot_captured_at: <ISO-8601 timestamp or unavailable>
 ```
 
 When using libghostty-vt, prefer formatter or render-state snapshots for repeated observation. `grid_ref` data is ephemeral and must be copied immediately because refs are invalidated by later terminal updates. Treat libghostty-vt's current public API as unstable unless the upstream project declares stability.
@@ -190,9 +190,9 @@ Cost-tier operating rule:
 - Each role must declare model, harness, cost tier, and current cost-policy basis in `SCP_BOOT_RECEIPT`.
 - Model/cost policy is local operating policy, not universal model truth. Refresh it when model availability, pricing, quota, or quality changes.
 - Drift from the declared cost/model policy requires a checkpoint or freeze as applicable; do not hard-code stale pricing as governance truth.
-- Bootstrap/session manifests should include non-secret `inference_provider_inventory`: provider, account tier, non-secret quota/balance class when Brad supplied it, token pool, supported harnesses, marginal cost class, throughput risk, default use policy, and `last_verified_source` with date/source URL when the policy depends on external documentation.
-- Provider inventory is non-secret. Never record API keys, secret config values, OAuth material, or hidden account details. Record account/tier/token pool/balance class only when Brad explicitly supplied non-secret information.
-- Current local provider policy: prefer Z.ai/GLM Coding Plan for routine supported coding tasks when operationally healthy because Brad identified it as the lowest marginal-cost paid plan. This is a preference, not an unconditional mandate.
+- Bootstrap/session manifests should include non-secret `inference_provider_inventory`: provider, account tier, non-secret quota/balance class when the user supplied it, token pool, supported harnesses, marginal cost class, throughput risk, default use policy, and `last_verified_source` with date/source URL when the policy depends on external documentation.
+- Provider inventory is non-secret. Never record API keys, secret config values, OAuth material, or hidden account details. Record account/tier/token pool/balance class only when the user explicitly supplied non-secret information.
+- Current local provider policy: prefer Z.ai/GLM Coding Plan for routine supported coding tasks when operationally healthy because the user identified it as the lowest marginal-cost paid plan. This is a preference, not an unconditional mandate.
 - Z.ai/GLM Coding Plan must use the documented Coding API base URL `https://api.z.ai/api/coding/paas/v4`, not the general API URL. Use subscription benefits only within documented supported tool/product scope. Treat supported tool lists as source-attributed and time-sensitive, not universal truth; record `last_verified_source` and verification date.
 - If Z.ai/GLM has throughput, rate-limit, quality, auth, or tooling blockers, classify `PROVIDER_BLOCKER` or `COST_ROUTING_BLOCKED`, route through the visible fallback ladder, and record provider, token pool, reason, wait time if known, fallback selected, and result.
 - Local server and local LLM lanes are normal visible role occupants and token pools, never hidden capacity. They require boot receipts, visible role slots, token-pool declaration, and at least one smoke/test or real assignment when activated and not explicitly standby.
@@ -204,47 +204,47 @@ Default model/harness profile is local operating policy, not universal model tru
 
 ```yaml
 default_role_model_harness_profile:
-  EXEC_PM:
-    model: GPT-5.5
-    harness: Codex CLI
-    reasoning: high
-  EXEC_ODIN:
-    model: GPT-5.5
-    harness: Codex CLI
-    reasoning: xhigh
-    note: xhigh is the Codex max-reasoning equivalent when available.
-  EXEC_ASST:
-    model: Claude Haiku latest available
-    harness: Claude Code
-    reasoning: default_or_high_if_supported
-  EXEC_RSCH:
-    model: Kimi K2.6
-    harness: Droid
-    reasoning: high
-  EXEC_QA:
-    model: Kimi K2.6
-    harness: Droid
-    reasoning: high
-  TEAM_PM:
-    model: Claude Opus 4.7 or latest available Opus
-    harness: Claude Code
-    reasoning: high_if_supported
-  TEAM_ODIN:
-    model: GPT-5.5
-    harness: Codex CLI
-    reasoning: low
-  DEV_WORKER:
-    model: Kimi K2.6
-    harness: Droid
-    reasoning: high
-  QA_WORKER:
-    model: GLM-5.1
-    harness: Crush
-    reasoning: high
-  SHADOW_REVIEWER:
-    model: Kimi K2.6
-    harness: Droid
-    reasoning: high
+ EXEC_PM:
+  model: GPT-5.5
+  harness: Codex CLI
+  reasoning: high
+ EXEC_ODIN:
+  model: GPT-5.5
+  harness: Codex CLI
+  reasoning: xhigh
+  note: xhigh is the Codex max-reasoning equivalent when available.
+ EXEC_ASST:
+  model: Claude Haiku latest available
+  harness: Claude Code
+  reasoning: default_or_high_if_supported
+ EXEC_RSCH:
+  model: Kimi K2.6
+  harness: Droid
+  reasoning: high
+ EXEC_QA:
+  model: Kimi K2.6
+  harness: Droid
+  reasoning: high
+ TEAM_PM:
+  model: Claude Opus 4.7 or latest available Opus
+  harness: Claude Code
+  reasoning: high_if_supported
+ TEAM_ODIN:
+  model: GPT-5.5
+  harness: Codex CLI
+  reasoning: low
+ DEV_WORKER:
+  model: Kimi K2.6
+  harness: Droid
+  reasoning: high
+ QA_WORKER:
+  model: GLM-5.1
+  harness: Crush
+  reasoning: high
+ SHADOW_REVIEWER:
+  model: Kimi K2.6
+  harness: Droid
+  reasoning: high
 ```
 
 Default worker fallback policy: if `Crush` fails for a worker-style role, try `Droid`; if both `Crush` and `Droid` fail, use `Claude Code` with Claude Sonnet 4.6 or the latest available Sonnet. For worker backup generally, prefer Kimi K2.6 on Droid or Claude Sonnet 4.6/latest Sonnet on Claude Code with high reasoning when supported.
@@ -255,19 +255,19 @@ Default operating architecture is a small executive office plus horizontally sca
 - Each pod: `TEAM PM`, `TEAM ODIN`, `DEV WORKER`, `QA WORKER`, and optional `SHADOW REVIEWER`.
 - Floaters: `INTEGRATION STEWARD` and `QUEUE TRIAGE` when branch integration or queue pressure warrants them.
 
-During SCP setup/bootstrap, the named `EXEC PM` must ask Brad how many pods/teams he wants unless Brad already specified topology. When useful, `EXEC PM` should briefly present grouping options. Default topology, when Brad does not specify otherwise, is executive office plus one development pod. Default executive office: `A/EXEC-PM`, `A/EXEC-ODIN`, `A/EXEC-ASST`, `A/EXEC-RSCH`, and `A/EXEC-QA`. Default development pod: `<TEAM>/TEAM-PM`, `<TEAM>/ODIN`, `<TEAM>/DEV-1`, `<TEAM>/QA-1`, optional `<TEAM>/SHADOW-1`. Additional pods, floaters, specialized roles, or model/harness capacity outside this topology require Brad authorization through `[SCP-TOPOLOGY-EXPANSION-REQUEST]`.
+During SCP setup/bootstrap, the named `EXEC PM` must ask the user how many pods/teams he wants unless the user already specified topology. When useful, `EXEC PM` should briefly present grouping options. Default topology, when the user does not specify otherwise, is executive office plus one development pod. Default executive office: `A/EXEC-PM`, `A/EXEC-ODIN`, `A/EXEC-ASST`, `A/EXEC-RSCH`, and `A/EXEC-QA`. Default development pod: `<TEAM>/TEAM-PM`, `<TEAM>/ODIN`, `<TEAM>/DEV-1`, `<TEAM>/QA-1`, optional `<TEAM>/SHADOW-1`. Additional pods, floaters, specialized roles, or model/harness capacity outside this topology require the user authorization through `[SCP-TOPOLOGY-EXPANSION-REQUEST]`.
 
-Specialized teams may require a team profile instead of the generic federated development pod. UX/design teams are not automatically treated as generic DEV/QA pods; preserve their prototype/design boundaries until Brad or `EXEC PM` assigns a UX-specific topology.
+Specialized teams may require a team profile instead of the generic federated development pod. UX/design teams are not automatically treated as generic DEV/QA pods; preserve their prototype/design boundaries until the user or `EXEC PM` assigns a UX-specific topology.
 
-`EXEC ODIN` is the executive ODIN primitive. Do not create separate default personal continuity, holdout, or watchdog roles unless Brad explicitly authorizes them. A resumed private continuity or holdout agent may exist outside the declared team topology when Brad intentionally withholds or masks that role; it must not be treated as governed team capacity unless Brad brings it into the visible topology.
+`EXEC ODIN` is the executive ODIN primitive. Do not create separate default personal continuity, holdout, or watchdog roles unless the user explicitly authorizes them. A resumed private continuity or holdout agent may exist outside the declared team topology when the user intentionally withholds or masks that role; it must not be treated as governed team capacity unless the user brings it into the visible topology.
 
-`TEAM PM` and `TEAM ODIN` are complementary, not aliases. `TEAM PM` owns pod assignment routing and worker activation; `TEAM ODIN` owns governance/control integrity, polling, intervention, and role/scope enforcement. `TEAM ODIN` is not subordinate to `TEAM PM` and is not superior to it; it is a coequal meta-control layer accountable to Brad/user authority and the ODIN mesh. Either may relay to workers only within the assignment contract, but neither implements or QA-closes by default.
+`TEAM PM` and `TEAM ODIN` are complementary, not aliases. `TEAM PM` owns pod assignment routing and worker activation; `TEAM ODIN` owns governance/control integrity, polling, intervention, and role/scope enforcement. `TEAM ODIN` is not subordinate to `TEAM PM` and is not superior to it; it is a coequal meta-control layer accountable to user authority and the ODIN mesh. Either may relay to workers only within the assignment contract, but neither implements or QA-closes by default.
 
 Team PMs and team ODINs may coordinate laterally when needed, but lateral messages must be logged as coordination events. Top-down command is the default; lateral coordination is for dependency, blocker, or health propagation, not unsupervised work selection.
 
 ODINs must establish a lateral ODIN mesh at bootstrap. `A/EXEC-ODIN` and each `TEAM ODIN` must exchange a short introduction containing role, team, reports-to/coordinates-with chain, team composition, active agent occupants, model/harness/cost tier, known blockers, and next poll time. This is a meta-communication layer, not command authority.
 
-During active execution, `A/EXEC-ODIN` should run an ODIN round-robin health pass on a declared cadence, default 10 minutes unless Brad or `EXEC PM` sets another cadence. The executive ODIN starts with its own executive-office health note, sends it to the first team ODIN, and instructs each team ODIN to append its short team composition/status/health note and forward to the next ODIN. The final team ODIN returns the appended packet to `A/EXEC-ODIN`. `A/EXEC-ODIN` compiles the packet, may ask `EXEC DISPATCH` / `SWITCHBOARD` for outstanding communication or waiting-agent notes, then sends a concise status report to `EXEC PM`.
+During active execution, `A/EXEC-ODIN` should run an ODIN round-robin health pass on a declared cadence, default 10 minutes unless the user or `EXEC PM` sets another cadence. The executive ODIN starts with its own executive-office health note, sends it to the first team ODIN, and instructs each team ODIN to append its short team composition/status/health note and forward to the next ODIN. The final team ODIN returns the appended packet to `A/EXEC-ODIN`. `A/EXEC-ODIN` compiles the packet, may ask `EXEC DISPATCH` / `SWITCHBOARD` for outstanding communication or waiting-agent notes, then sends a concise status report to `EXEC PM`.
 
 ODIN mesh reports must stay short by default and include: team, active occupants, provider/model/harness mix, blocked agents, permission waits, plan-mode/quota/provider failures, role breaches, delivery failures, outstanding relays, and recommended intervention. ODINs may request temporary secondment of another control-plane agent through `EXEC PM` when a PM/ODIN lane fails, but they must not directly reassign agents or expand topology without authorization.
 
@@ -281,7 +281,7 @@ Definitions:
 - `terminal_surface`: CMUX/tmux/terminal object hosting that slot.
 - `agent_occupant`: current model/harness process inside that slot.
 
-During active SCP operation, role slots must remain present in CMUX. Closing a role-named pane/surface is a topology mutation and requires explicit Brad authorization.
+During active SCP operation, role slots must remain present in CMUX. Closing a role-named pane/surface is a topology mutation and requires explicit the user authorization.
 
 Allowed occupant-level remediation:
 
@@ -293,7 +293,7 @@ Allowed occupant-level remediation:
 - mark the slot `VACANT_ROLE_SLOT`;
 - mark the slot `AGENT_CONTEXT_RESET_REQUIRED`, `AGENT_RESTART_REQUIRED`, or `AGENT_SUBSTITUTION_REQUIRED`.
 
-Forbidden without explicit Brad authorization:
+Forbidden without explicit the user authorization:
 
 - closing a role-named pane/surface;
 - deleting a role slot from CMUX;
@@ -302,7 +302,7 @@ Forbidden without explicit Brad authorization:
 - renaming a role slot to serve a different role;
 - moving work to a hidden or non-terminal agent.
 
-If a role slot is accidentally closed, emit `[SCP-FREEZE]` or `[SCP-FEEDBACK]`, classify `ROLE_SLOT_CLOSURE_VIOLATION`, and record the restoration or next-run correction requirement. When possible, recreate or re-reserve the same role slot, mark the prior occupant `AGENT_STOOD_DOWN` or lost, and require Brad or `A/EXEC-PM` reconciliation before any clean, ready, closure, or finish claim.
+If a role slot is accidentally closed, emit `[SCP-FREEZE]` or `[SCP-FEEDBACK]`, classify `ROLE_SLOT_CLOSURE_VIOLATION`, and record the restoration or next-run correction requirement. When possible, recreate or re-reserve the same role slot, mark the prior occupant `AGENT_STOOD_DOWN` or lost, and require the user or `A/EXEC-PM` reconciliation before any clean, ready, closure, or finish claim.
 
 Plan-mode and read-only blockers are occupant state failures, not topology failures. They trigger `AGENT_SUBSTITUTION_REQUIRED`, `AGENT_CONTEXT_RESET_REQUIRED`, or operator exit from plan mode inside the same role slot. They do not justify hidden subagents, invisible delegation, or new panes.
 
@@ -314,15 +314,15 @@ Default official grouping:
 
 - Executive office: `A/EXEC-PM`, `A/EXEC-ODIN`, `A/EXEC-ASST`, `A/EXEC-RSCH`, `A/EXEC-QA`.
 - Each pod: `<TEAM>/TEAM-PM`, `<TEAM>/ODIN`, `<TEAM>/DEV-1`, `<TEAM>/QA-1`, optional `<TEAM>/SHADOW-1`.
-- Optional official executive support roles only when intentionally bootstrapped or Brad-authorized: `A/EXEC-DISPATCH`, `A/SWITCHBOARD`, `A/INTEGRATION-STEWARD`, `A/QUEUE-TRIAGE`, or named specialized roles.
+- Optional official executive support roles only when intentionally bootstrapped or user-authorized: `A/EXEC-DISPATCH`, `A/SWITCHBOARD`, `A/INTEGRATION-STEWARD`, `A/QUEUE-TRIAGE`, or named specialized roles.
 
 `EXEC PM` must route work to the appropriate existing role, not to any convenient model. The first routing question is always:
 
 > Which existing CMUX role owns this work?
 
-If no existing role is appropriate, `EXEC PM` must request Brad authorization before creating capacity.
+If no existing role is appropriate, `EXEC PM` must request the user authorization before creating capacity.
 
-Active SCP visible role-slot rules override generic external orchestration subagent language while SCP is active. Generic external dispatch concepts may describe Dev/QA capacity, but under SCP that capacity must be represented by visible CMUX role slots unless Brad authorizes topology expansion.
+Active SCP visible role-slot rules override generic external subagent language while SCP is active. Generic external coordination concepts may describe Dev/QA capacity, but under SCP that capacity must be represented by visible CMUX role slots unless the user authorizes topology expansion.
 
 ## Surface Layout Custodianship
 
@@ -338,14 +338,14 @@ Surface layout follows a deterministic packing rule:
 Reference layouts (slash separates stacked surfaces in a column, single bracket = single surface):
 
 ```
-N=1   [A]
-N=2   [A] [B]
-N=3   [A] [B/C]                    ← A tall, B+C stacked
-N=4   [A/D] [B/C]                  ← balanced
-N=5   [A] [B/C] [D/E]              ← new column, A returns to tall
-N=6   [A/F] [B/C] [D/E]            ← balanced
-N=7   [A] [B/C] [D/E] [F/G]
-N=8   [A/H] [B/C] [D/E] [F/G]
+N=1  [A]
+N=2  [A] [B]
+N=3  [A] [B/C]          ← A tall, B+C stacked
+N=4  [A/D] [B/C]         ← balanced
+N=5  [A] [B/C] [D/E]       ← new column, A returns to tall
+N=6  [A/F] [B/C] [D/E]      ← balanced
+N=7  [A] [B/C] [D/E] [F/G]
+N=8  [A/H] [B/C] [D/E] [F/G]
 ```
 
 ### Pre-Staffing Gate
@@ -366,7 +366,7 @@ When the odin-sentinel MCP server is not available (rare; the published `@bradhe
 
 Under SCP, `$delegate` is constrained by visible CMUX topology.
 
-Delegation must target an existing role slot unless Brad authorizes topology expansion. A valid delegation target must have:
+Delegation must target an existing role slot unless the user authorizes topology expansion. A valid delegation target must have:
 
 - role identity;
 - terminal locator;
@@ -388,9 +388,9 @@ Prohibited by default:
 
 If the current occupant cannot perform the task, use the role's fallback ladder inside the same CMUX slot.
 
-Hidden/internal subagent output produced during active SCP is non-governed and advisory only. It cannot support QA acceptance, closure, lifecycle mutation, branch-visible claims, evidence-gate satisfaction, policy synthesis, or dispatch decisions unless Brad explicitly records an `[SCP-EXCEPTION]` and reconciles provenance into the visible SCP ledger.
+Hidden/internal subagent output produced during active SCP is non-governed and advisory only. It cannot support QA acceptance, closure, lifecycle mutation, branch-visible claims, evidence-gate satisfaction, policy synthesis, or dispatch decisions unless the user explicitly records an `[SCP-EXCEPTION]` and reconciles provenance into the visible SCP ledger.
 
-When `delegate` is invoked during active SCP, SCP topology rules override generic delegation behavior. `delegate` may compose instruction bundles and harness commands, but launch targets must be existing visible SCP role slots unless Brad authorizes topology expansion. `delegate` must not create hidden subagents, non-CMUX background workers, or off-ledger research capacity during active SCP.
+When `delegate` is invoked during active SCP, SCP topology rules override generic delegation behavior. `delegate` may compose instruction bundles and harness commands, but launch targets must be existing visible SCP role slots unless the user authorizes topology expansion. `delegate` must not create hidden subagents, non-CMUX background workers, or off-ledger research capacity during active SCP.
 
 ## Role Occupant Fallback Ladders
 
@@ -408,188 +408,188 @@ When a role needs substitution:
 
 Fallback may be triggered by quota exhaustion, plan mode blocking required work, missing tools, auth failure, context degradation, model/harness mismatch, cost guardrail violation, repeated low-quality output, or role breach.
 
-Default ladders are local operating policy, not universal model truth. They are overridable only by Brad authorization or recorded `[SCP-EXCEPTION]`, and they must be refreshed when model availability, local harness health, pricing, quota, or quality changes.
+Default ladders are local operating policy, not universal model truth. They are overridable only by the user authorization or recorded `[SCP-EXCEPTION]`, and they must be refreshed when model availability, local harness health, pricing, quota, or quality changes.
 
 ```yaml
 role_model_fallback_ladders:
-  EXEC_PM:
-    - model: GPT-5.5
-      harnesses: [codex]
-      reasoning: high
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: high
-
-  EXEC_ODIN:
-    - model: GPT-5.5
-      harnesses: [codex]
-      reasoning: xhigh
-    - model: GPT-5.5
-      harnesses: [codex]
-      reasoning: high
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-
-  EXEC_ASST:
-    - model: Claude Haiku latest available
-      harnesses: [claude]
-      reasoning: default_or_high_if_supported
-    - model: MiniMax
-      harnesses: [droid]
-      reasoning: medium
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: medium
-
-  EXEC_RSCH:
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: high
-    - model: MiniMax
-      harnesses: [droid]
-      reasoning: medium
-
-  EXEC_QA:
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: high
-    - model: Claude Sonnet latest available
-      harnesses: [claude]
-      reasoning: high_if_supported
-
-  TEAM_PM:
-    - model: Claude Opus 4.7 or latest available Opus
-      harnesses: [claude]
-      reasoning: high_if_supported
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: GPT-5.5
-      harnesses: [codex]
-      reasoning: high
-
-  TEAM_ODIN:
-    - model: GPT-5.5
-      harnesses: [codex]
-      reasoning: low
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: medium
-
-  DEV_WORKER:
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: Claude Sonnet 4.6 or latest available Sonnet
-      harnesses: [claude]
-      reasoning: high_if_supported
-      limit: one_claude_code_per_pod
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: high
-
-  QA_WORKER:
-    - model: GLM-5.1
-      harnesses: [crush]
-      reasoning: high
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-      condition: if_crush_fails
-    - model: Claude Sonnet 4.6 or latest available Sonnet
-      harnesses: [claude]
-      reasoning: high_if_supported
-      condition: if_crush_and_droid_fail
-
-  SHADOW_REVIEWER:
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: Claude Sonnet 4.6 or latest available Sonnet
-      harnesses: [claude]
-      reasoning: high_if_supported
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: medium
-
-  INTEGRATION_STEWARD:
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: high
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: high
-    - model: Claude Opus
-      harnesses: [claude]
-      reasoning: high
-      condition: Brad_authorized_high_risk_exception_only
-
-  QUEUE_TRIAGE:
-    - model: Kimi K2.6
-      harnesses: [droid]
-      reasoning: medium
-    - model: MiniMax
-      harnesses: [droid]
-      reasoning: medium
-    - model: GLM-5.1
-      harnesses: [crush, opencode]
-      reasoning: medium
+ EXEC_PM:
+  - model: GPT-5.5
+   harnesses: [codex]
+   reasoning: high
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: high
+
+ EXEC_ODIN:
+  - model: GPT-5.5
+   harnesses: [codex]
+   reasoning: xhigh
+  - model: GPT-5.5
+   harnesses: [codex]
+   reasoning: high
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+
+ EXEC_ASST:
+  - model: Claude Haiku latest available
+   harnesses: [claude]
+   reasoning: default_or_high_if_supported
+  - model: MiniMax
+   harnesses: [droid]
+   reasoning: medium
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: medium
+
+ EXEC_RSCH:
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: high
+  - model: MiniMax
+   harnesses: [droid]
+   reasoning: medium
+
+ EXEC_QA:
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: high
+  - model: Claude Sonnet latest available
+   harnesses: [claude]
+   reasoning: high_if_supported
+
+ TEAM_PM:
+  - model: Claude Opus 4.7 or latest available Opus
+   harnesses: [claude]
+   reasoning: high_if_supported
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: GPT-5.5
+   harnesses: [codex]
+   reasoning: high
+
+ TEAM_ODIN:
+  - model: GPT-5.5
+   harnesses: [codex]
+   reasoning: low
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: medium
+
+ DEV_WORKER:
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: Claude Sonnet 4.6 or latest available Sonnet
+   harnesses: [claude]
+   reasoning: high_if_supported
+   limit: one_claude_code_per_pod
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: high
+
+ QA_WORKER:
+  - model: GLM-5.1
+   harnesses: [crush]
+   reasoning: high
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+   condition: if_crush_fails
+  - model: Claude Sonnet 4.6 or latest available Sonnet
+   harnesses: [claude]
+   reasoning: high_if_supported
+   condition: if_crush_and_droid_fail
+
+ SHADOW_REVIEWER:
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: Claude Sonnet 4.6 or latest available Sonnet
+   harnesses: [claude]
+   reasoning: high_if_supported
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: medium
+
+ INTEGRATION_STEWARD:
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: high
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: high
+  - model: Claude Opus
+   harnesses: [claude]
+   reasoning: high
+   condition: Brad_authorized_high_risk_exception_only
+
+ QUEUE_TRIAGE:
+  - model: Kimi K2.6
+   harnesses: [droid]
+   reasoning: medium
+  - model: MiniMax
+   harnesses: [droid]
+   reasoning: medium
+  - model: GLM-5.1
+   harnesses: [crush, opencode]
+   reasoning: medium
 ```
 
 `SCP-TEAM-MANIFEST` must include model mix policy and per-slot occupant state:
 
 ```yaml
 model_mix_policy:
-  scarce_quota_pools:
-    - chatgpt_codex
-    - claude_code
-  locally_disallowed_without_brad_reauth:
-    - gemini
-  hidden_subagents_allowed: false
-  role_slot_closure_allowed: false
-  topology_expansion_allowed_without_brad: false
-  max_claude_code_instances_per_pod: 1
-  min_distinct_inference_sources_per_pod: 3
-  dev_qa_same_provider_allowed: false
-  fallback_ladder_required: true
-  delegate_must_use_cmux_visible_roles: true
+ scarce_quota_pools:
+  - chatgpt_codex
+  - claude_code
+ locally_disallowed_without_brad_reauth:
+  - gemini
+ hidden_subagents_allowed: false
+ role_slot_closure_allowed: false
+ topology_expansion_allowed_without_brad: false
+ max_claude_code_instances_per_pod: 1
+ min_distinct_inference_sources_per_pod: 3
+ dev_qa_same_provider_allowed: false
+ fallback_ladder_required: true
+ delegate_must_use_cmux_visible_roles: true
 
 role_slot:
-  title: B/DEV-1
-  role: DEV WORKER
-  surface_ref:
-  current_occupant:
-    model:
-    harness:
-    reasoning:
-    cost_tier:
-    status:
-  fallback_ladder:
-    - model:
-      acceptable_harnesses:
-      reasoning:
-      substitution_trigger:
-  topology_mutable: false
+ title: B/DEV-1
+ role: DEV WORKER
+ surface_ref:
+ current_occupant:
+  model:
+  harness:
+  reasoning:
+  cost_tier:
+  status:
+ fallback_ladder:
+  - model:
+   acceptable_harnesses:
+   reasoning:
+   substitution_trigger:
+ topology_mutable: false
 ```
 
 ## Self-Bootstrap Team Lifecycle
 
-The preferred operating mode is one human-started `EXEC PM` pane that bootstraps, operates, and tears down the rest of the organization. Brad should not have to manually create panes, name agents, invoke harnesses, or clean up temporary teams during normal SCP operation.
+The preferred operating mode is one human-started `EXEC PM` pane that bootstraps, operates, and tears down the rest of the organization. the user should not have to manually create panes, name agents, invoke harnesses, or clean up temporary teams during normal SCP operation.
 
-When Brad asks `EXEC PM` to spin up teams, `EXEC PM` must load `references/team-bootstrap-runbook.md` and compose these supporting skills:
+When the user asks `EXEC PM` to spin up teams, `EXEC PM` must load `references/team-bootstrap-runbook.md` and compose these supporting skills:
 
 - `team-composition-patterns` for pod sizing and role coverage,
 - `dispatching-parallel-agents` for independent workstream decomposition,
@@ -626,9 +626,9 @@ Teardown sequence:
 3. Snapshot official topology before cleanup, classify each surface as official role slot vs temporary/ad hoc, and list any proposed closures.
 4. Run post-run hygiene and cleanup QA.
 5. Choose and record teardown mode:
-   - `PARK_FOR_CONTINUITY`: park official role slots as `BOOTSTRAPPED_IDLE`, `VACANT_ROLE_SLOT`, `AGENT_STOOD_DOWN`, `AGENT_CONTEXT_RESET_REQUIRED`, `AGENT_RESTART_REQUIRED`, or `AGENT_SUBSTITUTION_REQUIRED`; close only non-role temporary panes/surfaces listed as closable in `SCP-TEAM-MANIFEST`.
-   - `FULL_SESSION_SHUTDOWN`: when Brad explicitly wants the session closed, collect handoffs first, then quit each agent occupant using the harness-specific quit/exit action, verify it actually exited, close the CMUX surface/pane, and leave only Brad-designated retained surfaces. Do not rely on agents to self-prune; older occupants may not have the current SCP skill or may stop at stand-down without quitting.
-6. For either mode, close panes/surfaces only after `[SCP-FINISH]`, handoff/session report, ODIN snapshot, and Brad or recorded cleanup-policy authorization.
+  - `PARK_FOR_CONTINUITY`: park official role slots as `BOOTSTRAPPED_IDLE`, `VACANT_ROLE_SLOT`, `AGENT_STOOD_DOWN`, `AGENT_CONTEXT_RESET_REQUIRED`, `AGENT_RESTART_REQUIRED`, or `AGENT_SUBSTITUTION_REQUIRED`; close only non-role temporary panes/surfaces listed as closable in `SCP-TEAM-MANIFEST`.
+  - `FULL_SESSION_SHUTDOWN`: when the user explicitly wants the session closed, collect handoffs first, then quit each agent occupant using the harness-specific quit/exit action, verify it actually exited, close the CMUX surface/pane, and leave only the user-designated retained surfaces. Do not rely on agents to self-prune; older occupants may not have the current SCP skill or may stop at stand-down without quitting.
+6. For either mode, close panes/surfaces only after `[SCP-FINISH]`, handoff/session report, ODIN snapshot, and the user or recorded cleanup-policy authorization.
 7. Leave standing executive/UX or explicitly retained panes parked with fresh restart instructions only when teardown mode is `PARK_FOR_CONTINUITY`.
 
 The `EXEC PM` may automate CMUX setup and teardown, but destructive cleanup of worktrees, untracked files, or branch state still requires the same branch/scope/proof gates and explicit approval rules as the rest of SCP.
@@ -649,7 +649,7 @@ Control-plane roles include `EXEC PM`, `EXEC ODIN`, `EXEC ASST`, `EXEC RSCH`, `E
 
 A control-plane pane may not self-reclassify as `DEV WORKER` or `QA WORKER`. Worker exception requires all of:
 
-- explicit Brad or `EXEC PM` authorization naming the pane,
+- explicit the user or `EXEC PM` authorization naming the pane,
 - proof downstream capacity is unavailable, blocked, or inappropriate,
 - exact write/review scope and prohibited paths,
 - independent QA assignment by a different pane,
@@ -658,7 +658,7 @@ A control-plane pane may not self-reclassify as `DEV WORKER` or `QA WORKER`. Wor
 
 If a control-plane pane begins product/source/test implementation, authors worker evidence, or accepts QA without the exception record, emit `[SCP-FREEZE]` and classify it as a role breach.
 
-Editing canonical skills, adapters, runtime skill copies, sync scripts, lifecycle ledgers, branch state, or policy text is a control-plane governance mutation and requires `[SCP-CONTROL-PLANE-MUTATION]` before or with the mutation. ODIN/control-plane roles must not self-accept governance mutations they authored. Acceptance requires independent QA, Brad ratification, or explicitly named `EXEC PM` ratification after evidence review. An authorized control-plane mutation may be reported as implemented and validation complete, but remains pending ratification until the named ratifier accepts the evidence.
+Editing canonical skills, adapters, runtime skill copies, sync scripts, lifecycle ledgers, branch state, or policy text is a control-plane governance mutation and requires `[SCP-CONTROL-PLANE-MUTATION]` before or with the mutation. ODIN/control-plane roles must not self-accept governance mutations they authored. Acceptance requires independent QA, user ratification, or explicitly named `EXEC PM` ratification after evidence review. An authorized control-plane mutation may be reported as implemented and validation complete, but remains pending ratification until the named ratifier accepts the evidence.
 
 Canonical SCP audit, research, ODIN, and control-plane outputs must be written under a durable governance path such as `.odin/local/audit/<audit-id>/` or another declared `evidence_path`. `/tmp` may be used for intermediate captures, cache, delivery-proof repair, or mirrors only. Before `[SCP-FINISH]`, any `/tmp` artifact used for a claim must be copied, summarized, hashed, or explicitly declared non-canonical in the durable audit ledger.
 
@@ -690,7 +690,7 @@ A role receiving a HALT directive must:
 2. Reply with a remediation plan within the next heartbeat interval.
 3. Resume only after the supervising ODIN acknowledges the remediation.
 
-Continuing past a HALT without remediation is itself a protocol breach. ODIN must escalate to `A/EXEC-ODIN`, which may escalate to Brad.
+Continuing past a HALT without remediation is itself a protocol breach. ODIN must escalate to `A/EXEC-ODIN`, which may escalate to the user.
 
 ### Health Escalation
 
@@ -782,7 +782,7 @@ Staffing audit fields, required for any role outside the executive office (`team
 
 Receipts missing these fields on non-exec roles produce ODIN warnings via `odin.validate_boot_receipt`. Receipts that declare `staffed_by` != `A/EXEC-PM` are halt-eligible: TEAM PMs and workers cannot self-staff.
 
-If the harness is running with bypass, dangerous, or skip-permission mode, declare `permission_mode: DEGRADED_READ_ONLY` unless Brad explicitly authorized write mode for that pane. A degraded pane may not write, commit, push, move lifecycle state, or claim closure.
+If the harness is running with bypass, dangerous, or skip-permission mode, declare `permission_mode: DEGRADED_READ_ONLY` unless the user explicitly authorized write mode for that pane. A degraded pane may not write, commit, push, move lifecycle state, or claim closure.
 
 When EXEC PM, EXEC ASST, or the terminal adapter already captured exact `terminal_locator` refs/ids, use those values as authoritative. The pane may acknowledge or add missing fields, but self-reported locator data must not override adapter-captured refs.
 
@@ -940,22 +940,22 @@ Canonical frozen state is `FROZEN`. `FROZEN_IDLE` is a `FROZEN` substate/alias m
 
 Emit `[SCP-FREEZE]` if:
 
-- a role-named pane/surface is closed without Brad authorization;
-- `EXEC PM` creates extra panes/workers beyond official topology without Brad authorization;
-- hidden `spawn_agent` or invisible subagent capacity is used without Brad authorization;
+- a role-named pane/surface is closed without the user authorization;
+- `EXEC PM` creates extra panes/workers beyond official topology without the user authorization;
+- hidden `spawn_agent` or invisible subagent capacity is used without the user authorization;
 - `$delegate` routes outside visible CMUX role slots;
 - hidden output is used for QA, closure, branch-visible claims, lifecycle mutation, evidence validation, policy synthesis, or dispatch decisions;
-- Gemini is assigned without Brad reauthorization under the current local model policy;
+- Gemini is assigned without the user reauthorization under the current local model policy;
 - a pod exceeds one active Claude Code instance;
 - DEV and QA use the same provider/model family without exception;
 - ChatGPT/Codex is used for routine work while non-Codex fallback rungs are available;
 - a role skips its fallback ladder without `[SCP-EXCEPTION]`;
 - cleanup removes team structure instead of clearing/restarting/substituting the occupant;
-- an agent claims exception status without a recorded `[SCP-EXCEPTION]` or Brad authorization.
+- an agent claims exception status without a recorded `[SCP-EXCEPTION]` or the user authorization.
 
 ### `[SCP-PERMISSION-ASSIST]`
 
-Emit when `EXEC PM`, Brad, ODIN, or an operator approves, clicks through, or sends keys into another role's pane.
+Emit when `EXEC PM`, the user, ODIN, or an operator approves, clicks through, or sends keys into another role's pane.
 
 Required fields:
 
@@ -976,7 +976,7 @@ Permissions remain on by default for write, destructive, lifecycle, branch, scop
 
 ### `[SCP-ROUND-ROBIN-CHECKPOINT]`
 
-Routine bilateral coordination has `agent_exchange_budget: 3`; high-stakes synthesis or QA loops have max 5 unless Brad or `EXEC PM` authorizes a higher limit with a stop condition. One exchange is an outbound message plus the response. Sequence is not authority; refinement is not corroboration. No two agents may continue bilateral debate after checkpoint without divergence reviewer, `EXEC PM` decision, or Brad decision. Repeated permission prompts stop after 2 blocked approvals and emit `BLOCKED_BY_PERMISSION`.
+Routine bilateral coordination has `agent_exchange_budget: 3`; high-stakes synthesis or QA loops have max 5 unless the user or `EXEC PM` authorizes a higher limit with a stop condition. One exchange is an outbound message plus the response. Sequence is not authority; refinement is not corroboration. No two agents may continue bilateral debate after checkpoint without divergence reviewer, `EXEC PM` decision, or the user decision. Repeated permission prompts stop after 2 blocked approvals and emit `BLOCKED_BY_PERMISSION`.
 
 Required fields:
 
@@ -1099,7 +1099,7 @@ Exceptions do not implicitly authorize implementation, QA acceptance, evidence w
 
 ## Session Closeout Metrics And Improvement Lifecycle
 
-Session closeout is an explicit SCP lifecycle phase. It begins when objectives are achieved or intentionally paused, branch/repo state is clean or classified, QA/quality gates are complete or blocked with owner, next-session path is clear, and `EXEC PM` is ready to hand off. Brad may also trigger closeout with `$sentinel-coordination-protocol --finish` or `$sentinel-coordination-protocol --session-closeout`.
+Session closeout is an explicit SCP lifecycle phase. It begins when objectives are achieved or intentionally paused, branch/repo state is clean or classified, QA/quality gates are complete or blocked with owner, next-session path is clear, and `EXEC PM` is ready to hand off. the user may also trigger closeout with `$sentinel-coordination-protocol --finish` or `$sentinel-coordination-protocol --session-closeout`.
 
 At bootstrap, `EXEC PM` must record a `SESSION_OBJECTIVES` contract before broad dispatch:
 
@@ -1112,7 +1112,7 @@ At bootstrap, `EXEC PM` must record a `SESSION_OBJECTIVES` contract before broad
 - expected durable evidence paths,
 - whether teams are expected to park, stand down, or remain active.
 
-If Brad has not supplied these, `EXEC PM` asks concise clarifying questions before broad dispatch.
+If the user has not supplied these, `EXEC PM` asks concise clarifying questions before broad dispatch.
 
 Before final park, `EXEC PM` must emit `EXEC_PM_SESSION_REPORT` covering:
 
@@ -1163,7 +1163,7 @@ Decision trace fields:
 
 After handoff, hygiene, metrics, and decision trace, `EXEC PM` asks ODINs, `EXEC QA`, and `EXEC RSCH` for protocol/skill/harness improvement hypotheses. Each hypothesis must include observation, metric signal, proposed change, expected score impact, risk, validation plan, owner, scope, and whether it is patch-now, defer, or reject.
 
-Skill edits are the last closeout action after session data, `EXEC_PM_SESSION_REPORT`, metrics, decision trace, and improvement hypotheses are captured. Any skill patch still requires `[SCP-CONTROL-PLANE-MUTATION]`, validation, sync/hash reporting, and independent, `EXEC PM`, or Brad ratification.
+Skill edits are the last closeout action after session data, `EXEC_PM_SESSION_REPORT`, metrics, decision trace, and improvement hypotheses are captured. Any skill patch still requires `[SCP-CONTROL-PLANE-MUTATION]`, validation, sync/hash reporting, and independent, `EXEC PM`, or user ratification.
 
 `EXEC PM` remains parked with the session report, decision trace pointer, metrics snapshot, and next actions. Other teams park, stand down, or become `VACANT_ROLE_SLOT` by durable role-slot policy. Finished teams are parked, not destroyed.
 
@@ -1205,78 +1205,78 @@ Recommended schema:
 
 ```yaml
 scp_session_metrics:
-  metric_version: scp_efficiency_v0
-  run_id:
-  session_objectives:
-    objectives: []
-    success_criteria: []
-    expected_stopping_point:
-    required_branch_visible_outcomes: []
-    cleanup_expectations: []
-    handoff_standard:
-  collection_basis:
-    cmux_inventory: captured|partial|missing
-    git_state: captured|partial|missing
-    receipts_scan: captured|partial|missing
-    harness_token_reports: exact|reported|partial|missing
-    transcript_estimates: used|not_used
-  per_agent:
-    - role_slot:
-      occupant:
-      model:
-      harness:
-      cost_tier:
-      token_pool: chatgpt_codex|claude_code|local|other|unknown
-      tasks_assigned:
-      deliverables_completed:
-      deliverables_accepted:
-      deliverables_rejected:
-      deliverables_partial:
-      deliverables_missing:
-      interventions:
-      blockers:
-      permission_assists:
-      exchange_checkpoints:
-      delivery_failures:
-      input_bar_only_events:
-      provider:
-      provider_token_pool:
-      provider_blockers:
-      throughput_wait:
-      fallback_reason:
-      fallback_selected:
-      role_breaches:
-      hidden_agent_violations:
-      elapsed_time_basis: exact|estimated|unknown
-      raw_tokens:
-      token_count_basis: exact|reported|estimated|unknown
-      token_count_confidence: high|medium|low|unknown
-      efficiency_note:
-      smoke_or_test_assignment: completed|failed|standby_exempt|not_done
-  per_team:
-    - team:
-      role_slots: []
-      tasks_assigned:
-      accepted:
-      rejected:
-      partial:
-      missing:
-      cleanup_findings: []
-  score:
-    scale: 0-4
-    objective_completion:
-    qa_evidence_quality:
-    branch_repo_hygiene:
-    coordination_compliance:
-    token_efficiency:
-    model_mix_diversity:
-    autonomy_low_human_intervention:
-    rework_rate:
-    cleanup_completeness:
-    handoff_quality:
-    confidence: high|medium|low
-    basis:
-    unknown_metrics: []
+ metric_version: scp_efficiency_v0
+ run_id:
+ session_objectives:
+  objectives: []
+  success_criteria: []
+  expected_stopping_point:
+  required_branch_visible_outcomes: []
+  cleanup_expectations: []
+  handoff_standard:
+ collection_basis:
+  cmux_inventory: captured|partial|missing
+  git_state: captured|partial|missing
+  receipts_scan: captured|partial|missing
+  harness_token_reports: exact|reported|partial|missing
+  transcript_estimates: used|not_used
+ per_agent:
+  - role_slot:
+   occupant:
+   model:
+   harness:
+   cost_tier:
+   token_pool: chatgpt_codex|claude_code|local|other|unknown
+   tasks_assigned:
+   deliverables_completed:
+   deliverables_accepted:
+   deliverables_rejected:
+   deliverables_partial:
+   deliverables_missing:
+   interventions:
+   blockers:
+   permission_assists:
+   exchange_checkpoints:
+   delivery_failures:
+   input_bar_only_events:
+   provider:
+   provider_token_pool:
+   provider_blockers:
+   throughput_wait:
+   fallback_reason:
+   fallback_selected:
+   role_breaches:
+   hidden_agent_violations:
+   elapsed_time_basis: exact|estimated|unknown
+   raw_tokens:
+   token_count_basis: exact|reported|estimated|unknown
+   token_count_confidence: high|medium|low|unknown
+   efficiency_note:
+   smoke_or_test_assignment: completed|failed|standby_exempt|not_done
+ per_team:
+  - team:
+   role_slots: []
+   tasks_assigned:
+   accepted:
+   rejected:
+   partial:
+   missing:
+   cleanup_findings: []
+ score:
+  scale: 0-4
+  objective_completion:
+  qa_evidence_quality:
+  branch_repo_hygiene:
+  coordination_compliance:
+  token_efficiency:
+  model_mix_diversity:
+  autonomy_low_human_intervention:
+  rework_rate:
+  cleanup_completeness:
+  handoff_quality:
+  confidence: high|medium|low
+  basis:
+  unknown_metrics: []
 ```
 
 Provider/token-pool metrics must record provider, token pool, raw tokens, token count basis, task result, acceptance/rejection/partial status, rework count, blocker, throughput wait when known, fallback reason, and efficiency note. Provider routing claims must distinguish exact/reported/estimated/unknown token data and must not invent cost precision.
@@ -1294,28 +1294,28 @@ Close-out is not just cleanup. Close-out must prove the coordination process its
 5. `EXEC PM` emits `EXEC_PM_SESSION_REPORT`, `[SCP-SESSION-METRICS]`, and a curated session decision trace when skill/protocol changes occurred.
 6. `EXEC PM` records a `$handoff` and session report with branch, SHA, worktree, evidence, dirty state, blockers, pane disposition, metrics snapshot, decision trace pointer, and next-session instructions.
 7. ODIN captures CMUX pane snapshots and runs the post-run self-audit before temporary panes are closed:
-   - one pane auditor per pane,
-   - boolean SCP effectiveness heuristic including role-contract compliance, control-plane non-implementation, delegation receipts, CMUX delivery confirmation, poll/action liveness, QA independence, branch proof, and hygiene reset,
-   - `$atlas-synthesis` canonical packet,
-   - adversarial `$qa-review` panel,
-   - protocol/skill patch proposals,
-   - metric deltas for the next run.
+  - one pane auditor per pane,
+  - boolean SCP effectiveness heuristic including role-contract compliance, control-plane non-implementation, delegation receipts, CMUX delivery confirmation, poll/action liveness, QA independence, branch proof, and hygiene reset,
+  - `$atlas-synthesis` canonical packet,
+  - adversarial `$qa-review` panel,
+  - protocol/skill patch proposals,
+  - metric deltas for the next run.
 8. `EXEC PM` performs post-run hygiene reset:
-   - prove every non-excluded repo/worktree has a classified branch, HEAD/upstream state, dirty state, staged state, and retained/deferred/deleted disposition,
-   - record teardown mode as `PARK_FOR_CONTINUITY` or `FULL_SESSION_SHUTDOWN`,
-   - for `PARK_FOR_CONTINUITY`, return standing executive-office and pod control-plane panes to their baseline roles with fresh-context restart or explicit parked handoff,
-   - snapshot official topology before cleanup, classify each surface as official role slot vs temporary/ad hoc, and list any proposed closures,
-   - in `PARK_FOR_CONTINUITY`, preserve official role slots; cleanup may stand down occupants, clear context, restart agents, mark slots vacant, or request substitution, but it must not close role-named CMUX panes/surfaces,
-   - in `FULL_SESSION_SHUTDOWN`, after handoffs and snapshots are captured, explicitly quit each agent occupant using the correct app/harness-specific exit path, verify the occupant is no longer live, then close its CMUX surface/pane; if an occupant only stands down but remains live, classify `AGENT_STOOD_DOWN_NOT_EXITED` and close the surface directly if Brad authorized full shutdown,
-   - close temporary ad hoc panes only if they are listed as closable in `SCP-TEAM-MANIFEST`, have emitted `[SCP-FINISH]` or are classified stale/unresponsive, have handoff/snapshot captured, and Brad or the recorded cleanup policy authorizes closure,
-   - if cleanup discovers official role slots were closed during `PARK_FOR_CONTINUITY`, classify `ROLE_SLOT_CLOSURE_VIOLATION` and record restoration or next-run correction; official role-slot closure is expected only under `FULL_SESSION_SHUTDOWN`,
-   - clean or archive stray worktrees only when the exact path, branch, dirty state, and approval requirement are recorded,
-   - keep UX/design panes and design/prototype worktrees excluded unless Brad explicitly includes them with a UX-specific team profile,
-   - run `$qa-swarm-review` or equivalent adversarial review over the run's branch-visible artifacts and cleanup report before any clean/ready claim,
-   - leave a final hygiene ledger listing active panes, closed panes, retained worktrees, pruned/deferred worktrees, retained local debris, branch SHAs, and unresolved risks.
+  - prove every non-excluded repo/worktree has a classified branch, HEAD/upstream state, dirty state, staged state, and retained/deferred/deleted disposition,
+  - record teardown mode as `PARK_FOR_CONTINUITY` or `FULL_SESSION_SHUTDOWN`,
+  - for `PARK_FOR_CONTINUITY`, return standing executive-office and pod control-plane panes to their baseline roles with fresh-context restart or explicit parked handoff,
+  - snapshot official topology before cleanup, classify each surface as official role slot vs temporary/ad hoc, and list any proposed closures,
+  - in `PARK_FOR_CONTINUITY`, preserve official role slots; cleanup may stand down occupants, clear context, restart agents, mark slots vacant, or request substitution, but it must not close role-named CMUX panes/surfaces,
+  - in `FULL_SESSION_SHUTDOWN`, after handoffs and snapshots are captured, explicitly quit each agent occupant using the correct app/harness-specific exit path, verify the occupant is no longer live, then close its CMUX surface/pane; if an occupant only stands down but remains live, classify `AGENT_STOOD_DOWN_NOT_EXITED` and close the surface directly if the user authorized full shutdown,
+  - close temporary ad hoc panes only if they are listed as closable in `SCP-TEAM-MANIFEST`, have emitted `[SCP-FINISH]` or are classified stale/unresponsive, have handoff/snapshot captured, and the user or the recorded cleanup policy authorizes closure,
+  - if cleanup discovers official role slots were closed during `PARK_FOR_CONTINUITY`, classify `ROLE_SLOT_CLOSURE_VIOLATION` and record restoration or next-run correction; official role-slot closure is expected only under `FULL_SESSION_SHUTDOWN`,
+  - clean or archive stray worktrees only when the exact path, branch, dirty state, and approval requirement are recorded,
+  - keep UX/design panes and design/prototype worktrees excluded unless the user explicitly includes them with a UX-specific team profile,
+  - run `$qa-swarm-review` or equivalent adversarial review over the run's branch-visible artifacts and cleanup report before any clean/ready claim,
+  - leave a final hygiene ledger listing active panes, closed panes, retained worktrees, pruned/deferred worktrees, retained local debris, branch SHAs, and unresolved risks.
 9. Only after session data, `EXEC_PM_SESSION_REPORT`, metrics, decision trace, and improvement hypotheses are captured may `EXEC PM` authorize a final self-improvement skill patch through `[SCP-CONTROL-PLANE-MUTATION]`.
 
-The close-out meta-analysis must enumerate every delegated agent/role and required deliverable; record each deliverable status as `DELIVERED_FULL`, `DELIVERED_PARTIAL`, `NO_FINDINGS_WITH_SCOPE`, `BLOCKED_PARTIAL_REPORT`, `MISSING`, `MALFORMED`, or `NONCOMPLIANT_OUTPUT`; diagnose any missing/partial/noncompliant deliverable using visible pane state and last receipts; state which findings were incorporated or excluded and why; record orchestrator self-review including premature synthesis, permission assistance, scope changes, or audit bias; apply confidence downgrade where required; and choose corrective action: continue audit, accept partial with downgrade, reassign/substitute inside role slot, ask Brad, or park with owner/reason.
+The close-out meta-analysis must enumerate every delegated agent/role and required deliverable; record each deliverable status as `DELIVERED_FULL`, `DELIVERED_PARTIAL`, `NO_FINDINGS_WITH_SCOPE`, `BLOCKED_PARTIAL_REPORT`, `MISSING`, `MALFORMED`, or `NONCOMPLIANT_OUTPUT`; diagnose any missing/partial/noncompliant deliverable using visible pane state and last receipts; state which findings were incorporated or excluded and why; record orchestrator self-review including premature synthesis, permission assistance, scope changes, or audit bias; apply confidence downgrade where required; and choose corrective action: continue audit, accept partial with downgrade, reassign/substitute inside role slot, ask the user, or park with owner/reason.
 
 When an assigned agent fails, stalls, emits partial output, ignores scope, or does not deliver required findings, the orchestrator must not hand-wave, gloss over, synthesize around, or silently replace the missing deliverable. Required behavior: identify the missing required output; inspect visible pane state and last receipt; classify the failure state; issue a corrective directive or substitution inside the role slot; record whether downstream synthesis is blocked, partial, or safe to proceed; and explicitly state which required inputs were received and which were not before synthesis. Agents must either perform the delegated task exactly, emit a valid blocker/check-in, or emit a bounded partial/no-findings report when stopped. Silent parking after a force-report or required-deliverable directive is a protocol failure. This rule applies to `EXEC PM`: `EXEC PM` must not synthesize before required reports arrive unless it explicitly downgrades to `PARTIAL` and states missing inputs and reason.
 
@@ -1325,7 +1325,7 @@ The finish loop is observational and governance-only. It must not mutate product
 
 Post-run hygiene is not proof of product readiness. It is only proof that the orchestration surface has been returned to a known, auditable state.
 
-A finished team is parked, not destroyed, unless Brad has explicitly selected `FULL_SESSION_SHUTDOWN`; in that mode the goal is a verified quiet surface set, not durable visible role-slot preservation.
+A finished team is parked, not destroyed, unless the user has explicitly selected `FULL_SESSION_SHUTDOWN`; in that mode the goal is a verified quiet surface set, not durable visible role-slot preservation.
 
 ## Terminal State Vocabulary
 
@@ -1364,17 +1364,17 @@ Allowed pre-acceptance states:
 - `AGENT_SUBSTITUTION_REQUIRED`: role slot remains, but occupant model/harness must change.
 - `FALLBACK_RUNG_EXHAUSTED`: all authorized fallback occupants for the role failed or are unavailable.
 - `COST_GUARDRAIL_BLOCKED`: role cannot continue on current provider/model because budget/quota pressure violates model mix policy.
-- `HIDDEN_AGENT_VIOLATION`: hidden subagent or non-visible fork was used without explicit Brad-authorized exception.
-- `ROLE_SLOT_CLOSURE_VIOLATION`: role-named pane/surface was closed or deleted without explicit Brad authorization.
+- `HIDDEN_AGENT_VIOLATION`: hidden subagent or non-visible fork was used without explicit user-authorized exception.
+- `ROLE_SLOT_CLOSURE_VIOLATION`: role-named pane/surface was closed or deleted without explicit the user authorization.
 - `MODEL_MIX_VIOLATION`: active model/harness assignment violates the declared model mix policy.
-- `TOPOLOGY_EXPANSION_REQUESTED`: new role slot, pane, pod, floater, or specialized model/harness has been requested and awaits Brad decision.
-- `TOPOLOGY_EXPANSION_BLOCKED_PENDING_BRAD`: topology expansion is blocked until Brad explicitly authorizes it.
+- `TOPOLOGY_EXPANSION_REQUESTED`: new role slot, pane, pod, floater, or specialized model/harness has been requested and awaits the user decision.
+- `TOPOLOGY_EXPANSION_BLOCKED_PENDING_BRAD`: topology expansion is blocked until the user explicitly authorizes it.
 
 If repo mechanics require moving a DEV slice to `done/` before independent QA, the handoff and ledger must say `DEV_COMPLETE_QA_PENDING`; it is not lifecycle closure.
 
 ## Role And QA Hard Gates
 
-- Control-plane panes are command, coordination, monitoring, and QA-health surfaces. They may edit only governance, ledger, status, or remediation artifacts explicitly named by Brad or `EXEC PM`.
+- Control-plane panes are command, coordination, monitoring, and QA-health surfaces. They may edit only governance, ledger, status, or remediation artifacts explicitly named by the user or `EXEC PM`.
 - Control-plane roles including `EXEC PM`, `EXEC ODIN`, `EXEC ASST`, `EXEC RSCH`, `EXEC QA`, `TEAM PM`, and `TEAM ODIN` may do read-only proof, audit, coordination, CMUX delivery, polling, and blocker reporting by default. Implementation, QA acceptance, branch mutation, evidence writing, lifecycle mutation, push, merge, cleanup, or closure claims require explicit scoped authorization.
 - Product/source/test/evidence implementation must be delegated to `DEV WORKER` capacity. Control-plane reclassification is not self-service and requires the worker-exception record above.
 - `EXEC PM` or orchestration authority does not imply product-code write authority.
@@ -1393,7 +1393,7 @@ If repo mechanics require moving a DEV slice to `done/` before independent QA, t
 - Any hook output containing `blocking error` requires `[SCP-FREEZE]` unless a named `HOOK-EXCEPTION` is recorded.
 - `HOOK-EXCEPTION` must include: owner, hook name, exact command, exit status, why the hook is non-governing, compensating validators, scope proof, branch proof, expiration, and artifact location.
 - `SKIP_*`, `NO_*`, `BYPASS_*`, `--no-verify`, dangerous permission flags, and equivalent bypasses are governance bypasses by default.
-- A bypass flag is allowed only when Brad or `EXEC PM` explicitly authorizes the exact flag for the exact non-governing hook and the pane records compensating validators. Hook help text is not authorization.
+- A bypass flag is allowed only when the user or `EXEC PM` explicitly authorizes the exact flag for the exact non-governing hook and the pane records compensating validators. Hook help text is not authorization.
 - Missing expected validator path means stop and ask for the canonical path. Do not substitute a narrower validator unless `EXEC PM` explicitly authorizes it with compensating validators.
 - Non-blocking PreToolUse or PostToolUse hook errors in governance-sensitive writes must be recorded as `HOOK HEALTH: WATCH` or escalated before closure language.
 
@@ -1426,39 +1426,39 @@ If a closure/evidence hook fails after a lifecycle move or verdict attempt, mark
 ## Core Workflow
 
 1. Verify package provenance.
-   - Confirm the zip exists.
-   - Capture `unzip -l` and `shasum -a 256`.
-   - Extract only to a temp directory.
-   - Read `00-SCP-protocol.md`, especially sections 0, 6, 7, 8, 10, 18, and 20.
+  - Confirm the zip exists.
+  - Capture `unzip -l` and `shasum -a 256`.
+  - Extract only to a temp directory.
+  - Read `00-SCP-protocol.md`, especially sections 0, 6, 7, 8, 10, 18, and 20.
 
 2. Land the package, but do not activate it.
-   - Canonical package path: `project/planning/org/agentic-executive-mgmt/`.
-   - Package landing branch: use a deterministic ops branch unless Brad supplies another branch.
-   - Ledger branch: `ops/ledger` for `ledger.yaml`.
-   - If branch topology is ambiguous or conflicts with current repo state, stop and ask Brad.
+  - Canonical package path: `project/planning/org/agentic-executive-mgmt/`.
+  - Package landing branch: use a deterministic ops branch unless the user supplies another branch.
+  - Ledger branch: `ops/ledger` for `ledger.yaml`.
+  - If branch topology is ambiguous or conflicts with current repo state, stop and ask the user.
 
 3. Create adoption-gate scaffolding.
-   - `project/planning/org/agentic-executive-mgmt/artifacts/adoption/adoption-gate.md`
-   - `project/planning/org/agentic-executive-mgmt/ledger.yaml`
-   - `tools/agentic-executive-mgmt/audit/banned-phrases.txt`
-   - `tools/agentic-executive-mgmt/qa-review/RUBRIC.md`
-   - Other artifact directories required by the SCP package.
+  - `project/planning/org/agentic-executive-mgmt/artifacts/adoption/adoption-gate.md`
+  - `project/planning/org/agentic-executive-mgmt/ledger.yaml`
+  - `tools/agentic-executive-mgmt/audit/banned-phrases.txt`
+  - `tools/agentic-executive-mgmt/qa-review/RUBRIC.md`
+  - Other artifact directories required by the SCP package.
 
 4. Install or verify local skill/adapters.
-   - Native SKILL.md surfaces get this skill directory.
-   - Non-native harnesses get an adapter prompt that points them at the canonical skill and SCP repo package.
-   - Do not claim a harness has native skill support unless verified from local CLI/config.
+  - Native SKILL.md surfaces get this skill directory.
+  - Non-native harnesses get an adapter prompt that points them at the canonical skill and SCP repo package.
+  - Do not claim a harness has native skill support unless verified from local CLI/config.
 
 5. Validate before adoption.
-   - `git diff --check`
-   - `bash scripts/validate-planning-integrity.sh`
-   - `bash scripts/validate-artifact-sync.sh`
-   - Banned-phrases audit against the committed package.
-   - Adversarial `$qa-review` or rubric-equivalent 16-point review of the SCP package itself. Minimum 14/16, no CRITICAL, no HIGH, evidence authentic.
+  - `git diff --check`
+  - `bash scripts/validate-planning-integrity.sh`
+  - `bash scripts/validate-artifact-sync.sh`
+  - Banned-phrases audit against the committed package.
+  - Adversarial `$qa-review` or rubric-equivalent 16-point review of the SCP package itself. Minimum 14/16, no CRITICAL, no HIGH, evidence authentic.
 
 6. Disseminate in two steps.
-   - Pre-activation notice: awareness only, no behavior switch.
-   - Activation announcement: only after the adoption gate is branch-visible, QA-accepted, ledger scaffolded, and Brad or the CXO declares transition.
+  - Pre-activation notice: awareness only, no behavior switch.
+  - Activation announcement: only after the adoption gate is branch-visible, QA-accepted, ledger scaffolded, and the user or the CXO declares transition.
 
 ## Meta-Governance Recursion