@brainervirus/workit-cli 4.0.0 → 6.0.0

package/README.md

@@ -26,8 +26,13 @@ workit upgrade [--hosts=opencode,cursor,codex,pi] [--cli] [--preview | --apply -
 workit launch <opencode|cursor|codex|pi> [--auto-upgrade] [-- host arguments]
 workit doctor            # offline installation health report
 workit doctor --json     # machine-readable report
-workit <family> <action> [--payload <json|@file|->] [--task <id>] [--revision <uuid>] [--workspace-revision <uuid|null>] [--view full] [--actor <id>] [--confirm] [--json]
-workit action <operation> --payload <JSON> [--preview] [--confirm] [--task <id>] [--json]   # preview or run one approved external action
+workit <family> <action> [--payload <json|@file|->] [--task <id>] [--revision <uuid>] [--workspace-revision <uuid|null>] [--view full] [--actor <id>] [--json]
+workit grant show [<workspace>] [--all]              # effective autonomy grants
+workit grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr]
+workit grant unset <workspace> <kind>…
+workit youtrack note <ISSUE> (--markdown <t>|--file <p>) [--minutes n] [--date auto|YYYY-MM-DD]
+workit youtrack time|meeting <ISSUE> --minutes n [--text t] [--date …]
+workit changelog apply (--entries <JSON|@file|->|--normalize-only) [--path CHANGELOG.md] [--preview]
 workit handoff --task <id> [--json]                   # export task state and compact destination context
 workit check <name> | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--json] -- <cmd…>   # run a check, record CLI-observed evidence (exit = the command's)
 workit uninstall                           # remove host registrations (keeps ~/.config/workit)
@@ -36,7 +41,7 @@ workit                                     # help
 
 `workit init` guides you through: detected host selection, basic global config (locale, branch policy), optional advanced commit policy, YouTrack, VCS, workspaces (scoped hosting/tracker/branch/commit rules, profiles and release tracks), and project hygiene files. The wizard is a TTY application — `workit init` requires an interactive terminal and prints guidance (exiting nonzero) when stdin is not a TTY.
 
-Authenticate GitHub or GitLab with `gh auth login` or `glab auth login` before hosting actions; Workit does not need a second provider token file. `workit action` Git/hosting payloads accept `cwd` to target any checkout while task state stays in the session directory. Non-Git directories can host tasks for OS work; YouTrack keeps its own permanent token.
+Authenticate GitHub or GitLab with `gh auth login` or `glab auth login` before hosting actions; Workit does not need a second provider token file. Non-Git directories can host tasks for OS work; YouTrack keeps its own permanent token.
 
 The platforms step lists all four supported hosts. Installed tools are selected
 initially; absent tools are disabled. Select all available, clear all, or pick
@@ -71,16 +76,22 @@ or host-permission change is performed.
 
 `workit doctor` checks the offline installation health and exits nonzero when problems are found; `--json` prints the full report as JSON instead of the human-readable table.
 
-The task surface exposes the eight shared operation families (`task`, `policy`,
-`evidence`, `finding`, `decision`, `worker`, `writer`, and `state`) and their 24
-closed actions. Payloads can be inline JSON, a UTF-8 `@file`, or UTF-8 stdin
+The task surface exposes the seven shared operation families (`task`, `policy`,
+`evidence`, `finding`, `decision`, `worker`, and `state`) and their closed
+actions. Payloads can be inline JSON, a UTF-8 `@file`, or UTF-8 stdin
 with `-`; `--json` preserves the structured Result shape and exits nonzero for
-failures. Headless mutations that require consent use `--confirm` (agent-reported)
-or an observed TTY prompt; the action route additionally requires an
-interactive TTY — headless action calls return `needs_input` even with
-`--confirm`. `workit handoff --task` is read-only and refuses to
+failures. Task-family mutations ask no consent prompt; `--confirm` is accepted
+and ignored. `workit handoff --task` is read-only and refuses to
 emit a handoff when export and inspection revisions differ.
 
+Delivery authority is the host's own permission system plus per-workspace
+autonomy grants in `~/.config/workit/workspaces.json` (see the root README).
+`workit grant set` raises a grant only for a user at an interactive terminal who
+types the workspace name; headless or agent shells get `blocked` with the
+command to give the user. Lowering is always allowed, and writes keep a
+`workspaces.json.bak`. The `youtrack` and `changelog` verbs are gated by host
+permission only. Workit 5.0 removed `workit action` and the checkout lease verb.
+
 ## Behavior
 
 - **Safe apply semantics** — a malformed `config.json` is detected before the wizard renders and reported as a friendly blocked output instead of crashing; the same guard runs after the Apply preview.

package/assets/templates/plan-template.md

@@ -1,27 +1,26 @@
-# <Feature> Implementation Plan
+# <Feature> plan
 
-> **For agentic workers:** Load `workit-implement` when policy selects implementation. Use bounded `workit_worker` delegation when the host supports it; otherwise execute inline within writer scope. Steps use checkbox (`- [ ]`) syntax for tracking.
+Spec: `docs/<slug>/spec.md` · Goal: <one sentence>
 
-**Spec:** `docs/<slug>/spec.md`
-**Branch:** `feature/<slug>`
+A plan records decisions, not code: per slice the branch, what it touches, its
+acceptance, how it is verified, and what it depends on (workit-shape
+`references/slicing.md`). Independent slices fan out (workit-fanout);
+dependent ones stack (`workit stack plan <bottom> … <top>`).
 
-**Goal:** <one sentence>
+## Global constraints
 
-## Global Constraints
-
-- Each task lands exactly one contiguous non-empty commit range (`base..head`): fix rounds append commits to that range and never rewrite/amend an active review range; record the real base..head shas in task progress.
-- The final task closes the lead Workit task with `workit_task` `action: "close"` (CLI: `workit task close --payload … [--confirm]`) once requirements are satisfied and repository verification passes — never finish while the task is still `active` or `paused`.
-- <project-wide requirements, one line each>
+- <project-wide requirement, one line each>
 
 ---
 
-### Task N: <Component>
-
-- [ ] **Step 1: <action>**
+### S1 <type>/<slug>  (base: main)
 
-<!-- per-task criteria: how this task is verified -->
-**Criteria:** <verifiable check>
+Touches: <areas, not line numbers>
+Acceptance:
+- Given <state>, When <action>, Then <observable result>
+Verify: `workit check test`; verify-<app> "<feature>"
+Decisions: <ledger refs or one-line rulings>
 
-| Status | Task |
-| --- | --- |
-| pending | N: <Component> |
+| Slice | Branch | Depends on | Status |
+| --- | --- | --- | --- |
+| S1 | <type>/<slug> | — | pending |

package/assets/templates/spec-template.md

@@ -19,14 +19,15 @@ no durable agreement: `Spec: none (<reason>)`, no file.)
 
 ## Architecture
 
-<!-- May be `N/A (<reason>)` when the change has no flows or architecture. -->
-<!-- Otherwise REQUIRED: render a mermaid diagram (workit-diagram skill). -->
+<!-- Optional: only when a diagram argues a decision (workit-shape
+     references/diagrams.md); otherwise delete this section. -->
 ```mermaid
 flowchart TD
   A[Start] --> B[Step]
 ```
 
-<!-- REQUIRED if this spec touches UI: render an ASCII wireframe (workit-mockup skill). -->
+<!-- Optional: a UI choice still open gets an ASCII sketch (workit-shape
+     references/mockups.md). -->
 ```text
 ┌──────────────┐
 │ Header       │

package/assets/templates/workit-contract.md

@@ -2,9 +2,10 @@
 
 Workit keeps one accountable lead and one shared task state. Inspect current
 task state before acting; use only the shared operations for task, policy,
-evidence, finding, decision, worker, writer, and state changes. Authority is
+evidence, finding, decision, worker, and state changes. Authority is
 bounded by the requested scope, current revision, caller/session provenance, and
-observed capabilities. Never claim host enforcement or evidence that the host
+observed capabilities; delivery is bounded by the workspace autonomy grants
+(`workit grant show`). Never claim host enforcement or evidence that the host
 cannot provide. Preserve unresolved requirements, gaps, and uncertain workers.
 
 Focused methods are loaded only when the resolved policy requires them. A method