@caddis/cli 0.4.53 → 0.4.55

package/bundles/antigravity-plugin/scripts/caddis_roadmap_run.py

@@ -144,7 +144,10 @@ ENGINES: dict[str, dict] = {
 PROMPT_ON_STDIN = {"claude"}
 STUCK_SESSIONS = 3
 PLAN_PROMPT_NAME = "plan-resume-prompt.md"
-HEADLESS_ENV = {"CADDIS_HEADLESS": "1"}
+# CLAUDE_CODE_FORK_SUBAGENT=0: since 2.1.302 fork subagents are on by default in `claude -p`. A fork can run in the
+# background, and a print-mode session can end before it finishes, so its work is lost; the session prompt already
+# asks for foreground work only. Normal subagents stay available.
+HEADLESS_ENV = {"CADDIS_HEADLESS": "1", "CLAUDE_CODE_FORK_SUBAGENT": "0"}
 ROADMAP_WRITE_TIMEOUT_S = caddis_roadmap.MERGE_CHAIN_TIMEOUT + 600  # a backstop: every call inside is bounded
 RUNNING = "running"  # the last-stop record while a runner holds the lock; a killed run leaves it (needs the owner)
 GH_STOP_PREFIX = "BLOCKED gh cannot see"  # a gh error at a restart: waiting.json stays, a later tick may resume
@@ -192,7 +195,11 @@ def build_command(engine: str, model: str, prompt: str, *, usd: float, timeout_m
         raise ValueError(f"unknown engine {engine!r}; known: {', '.join(ENGINES)}")
     exe = list(engine_cmd) if engine_cmd else [engine]
     if engine == "claude":
-        tail = [*exe, "-p", "--model", model, "--output-format", "json", "--max-budget-usd", _usd(usd)]
+        # The mode is explicit: since Claude Code 2.1.302 a headless run with no mode starts in `default` (third-party
+        # providers) and no longer in auto mode, so a machine without `defaultMode` in its settings would stop at
+        # every permission prompt. The session runs in its own worktree under the governor, and the guard still runs.
+        tail = [*exe, "-p", "--permission-mode", "bypassPermissions", "--model", model, "--output-format", "json",
+                "--max-budget-usd", _usd(usd)]
     elif engine == "agy":  # probe 5: --model must come before --print
         tail = [*exe, "--model", model, "--print", prompt, "--output-format", "json",
                 "--print-timeout", f"{max(1, int(timeout_min))}m"]
@@ -481,6 +488,11 @@ def _create_with(path: Path, text: str) -> None:
         os.link(tmp, path)
     except FileExistsError:
         raise
+    except PermissionError as exc:
+        if not caddis_roadmap._WINDOWS:
+            raise
+        # Windows refuses while the old lock's delete is still pending: the name is taken, for now.
+        raise FileExistsError(str(path)) from exc
     except OSError:  # no hard links on this file system: O_EXCL, then the text
         fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
         with os.fdopen(fd, "w", encoding="utf-8") as fh:
@@ -1187,13 +1199,33 @@ def run(*, repo: Path, plan: str | None = None, roadmap: str | None = None, caps
         if value:
             ctx.masks.append(value)
     if roadmap is not None:
-        return _run_roadmap(ctx, template, dry_run, after_session, list(roadmap_cmd or default_roadmap_cmd()),
-                            hostname or socket.gethostname(), publish or default_publish,
-                            pr_merged or default_pr_merged, worktree_root,
-                            delete_remote_branch or default_delete_remote_branch, pr_closed or default_pr_closed)
+        rm_cmd = list(roadmap_cmd or default_roadmap_cmd())
+        try:
+            return _run_roadmap(ctx, template, dry_run, after_session, rm_cmd,
+                                hostname or socket.gethostname(), publish or default_publish,
+                                pr_merged or default_pr_merged, worktree_root,
+                                delete_remote_branch or default_delete_remote_branch, pr_closed or default_pr_closed)
+        finally:
+            if not dry_run:
+                _render_page(ctx, rm_cmd)  # the page shows where the run stopped and what waits for the owner
     return _run_plan(ctx, template, dry_run, after_session)
 
 
+PAGE_RENDER_TIMEOUT_S = 120
+
+
+def _render_page(ctx: "_Ctx", roadmap_cmd: Sequence[str]) -> None:
+    """Re-render the local roadmap page (roadmap-page Phase 3). Best effort: a failure is one stderr line, never a stop."""
+    argv = [*roadmap_cmd, "render", "--roadmap", ctx.target.slug, "--root", str(ctx.repo)]
+    try:
+        proc = subprocess.run(argv, cwd=ctx.repo, env=headless_env(), stdin=subprocess.DEVNULL, capture_output=True,
+                              text=True, encoding="utf-8", errors="replace", timeout=PAGE_RENDER_TIMEOUT_S)
+        if proc.returncode != 0:
+            print(f"caddis_roadmap_run: page not rendered (exit {proc.returncode})", file=sys.stderr)
+    except Exception as exc:  # a page must never change how a run ends
+        print(f"caddis_roadmap_run: page not rendered: {type(exc).__name__}", file=sys.stderr)
+
+
 def _dry_run_tail(ctx: _Ctx, template: Path, prompt: str, cwd: Path | None = None) -> None:
     caps = ctx.caps
     cmd = build_command(ctx.engine, ctx.model, "<resume prompt>", usd=min(caps.max_usd_per_session, caps.max_usd_total),
@@ -2042,6 +2074,7 @@ def _run_roadmap(ctx: _Ctx, template: Path, dry_run: bool, after_session: Callab
             finally:
                 s.record.setdefault("status", "FAILED")
                 ctx.log(s.record)
+            _render_page(ctx, roadmap_cmd)
             if after_session is not None:
                 after_session(sessions)
     except _Stop as stop:

package/bundles/antigravity-plugin/scripts/caddis_routing.py

@@ -16,14 +16,14 @@ import oss_model
 
 # agy is Flash-only on some machines and is good only at small, exact, mechanical cards (112 of 114 passed
 # in the 2026-10-08 UI-upgrade run) and CI watching. Give design-fidelity, cross-file refactor and judgment
-# work to codex or claude. See .caddis/kb/agy-headless-implementer-limits.md. A separate `design` role is an
+# work to claude. Codex left the routing on 2026-10-12 (owner); a config may still name it. See .caddis/kb/agy-headless-implementer-limits.md. A separate `design` role is an
 # owner decision: it changes the routing line every session prints.
 DEFAULT_ROUTING: dict[str, list[str]] = {
     "critical": ["opus"],
     "light": ["sonnet"],
-    "coding": ["agy", "codex"],
-    "review": ["glm", "deepseek"],
-    "consult": ["agy", "glm", "codex"],
+    "coding": ["agy"],
+    "review": ["deepseek", "glm"],  # owner order 2026-10-16; an agy review runs through caddis_spend.py
+    "consult": ["agy", "glm"],
     "ci-watch": ["agy"],
     "mechanical": ["haiku"],
 }

package/bundles/antigravity-plugin/skills/_registry.md

@@ -84,6 +84,8 @@
 | Digress | `digress/` | Park the current workstream on the stack and switch to a new task — without losing the original |
 | Excalidraw Db | `excalidraw-db/` | Turn a SQL artifact into an Excalidraw diagram for a design review / ARB pack / slide — higher-level, drag-the-boxes format |
 | Feature Plan | `feature-plan/` | Create a phased, TDD-structured implementation plan that acts as the durable spine for multi-session work |
+| Fleet Close | `fleet-close/` | Close a fleet of sessions — every session writes its handoff and acks, then print one restart sheet for the owner |
+| Fleet Open | `fleet-open/` | Restore one role from the fleet restart sheet in a new session — name check, relay, tasks, peer greeting, watchers |
 | Gate Preflight | `gate-preflight/` | Deterministic headless preflight — validates a plan against the actual codebase, self-contained (never depends on a skill activating) |
 | Gate Review | `gate-review/` | Deterministic headless code review — adversarial diff review, self-contained (never depends on a skill activating) |
 | Glossary | `glossary/` | Define the words this project invented, in one place — .caddis/kb/GLOSSARY.md |

package/bundles/antigravity-plugin/skills/catchup/SKILL.md

@@ -46,6 +46,10 @@ Keep it short enough to read at a glance. Roughly:
 - **The next step**, if one is recorded. Say which file it came from.
 - **Uncommitted work**, if `git status` is dirty — this is the thing most likely to be lost, and
   the state file does not track it. Check it; do not assume clean.
+- **The roadmap page**, when the repo has a roadmap (`.caddis/roadmaps/`): re-render it with
+  `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_roadmap.py" render --all` (best effort) and give the path it prints
+  (`~/.caddis/roadmap-pages/<repo>/<slug>.html`); it shows every session waiting for the owner. The hub of every
+  repo on this machine is `~/.caddis/roadmap-pages/index.html`.
 
 Leave out anything already done unless the user asks. "What is finished" is a different question
 from "where are we", and the completed list is usually the longest part of both files.

package/bundles/antigravity-plugin/skills/feature-plan/SKILL.md

@@ -54,6 +54,12 @@ points), read it first. It's a free, token-zero project fingerprint that anchors
 exists instead of assumed. If the work fits comfortably in one session, say so and offer to just do it
 instead of planning. Only produce a plan for genuinely multi-phase work.
 
+**Check upstream first when the plan builds on Claude Code behaviour** (hooks, headless `claude -p`, permission
+modes, subagents, worktrees, plugins and skills, Remote Control, background sessions). Read
+`.caddis/kb/claude-code-upstream-watch.md` if the repo has it, and the latest Claude Code changelog for that area
+(Improvements, Bug fixes, In development). Do not plan a fix or a workaround for something Claude Code has already
+changed, fixed or announced; cite the release in **Constraints & decisions** instead.
+
 ### Evidence gate — do not write plan content while a BLOCKER is unresolved
 This is the direct counter to the failure
 mode that makes a plan dangerous: **you write the spec, so you cannot see its gaps.** A phase built

package/bundles/antigravity-plugin/skills/fleet-close/SKILL.md

@@ -0,0 +1,167 @@
+---
+name: fleet-close
+description: Close a fleet of sessions — every session writes its handoff and acks, then print one restart sheet for the owner
+---
+
+# /caddis:fleet-close — close every session, collect acks, print the restart sheet
+
+Use this when **several** sessions must stop together (a machine restart, a long break, a context
+reset for the whole fleet). For one session, run `/caddis:handoff` instead. This session is the
+**coordinator**: it asks every other session to write its own handoff, collects one ack from each,
+writes its own handoff last, and prints a restart sheet. The owner starts each new session from that
+sheet, and each new session runs `/caddis:fleet-open <role>`.
+
+Every fleet rule (names, ack format, order, checks) lives in
+`${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py`; this command only calls it. Run the steps in order.
+
+**Safety rules for the whole command** (a wrong close loses another session's relay or tasks):
+- Never write, edit or move another session's relay, tasks file or watcher files. Each session writes
+  its own; you only collect acks.
+- Never stop, end or kill another session, and never tell one to exit. The owner closes terminals
+  after reading the sheet.
+- Never wait with a foreground `sleep`. Every wait is a background timer (`run_in_background`).
+- A session that does not ack is never guessed: its row says `no ack`, and the owner runs
+  `/caddis:handoff` in it by hand.
+
+The ack format (one line in a fenced block, then the session's full resume prompt):
+
+```
+FLEET-ACK name=<n> role=<r> machine=<m> folder=<abs> relay=<path> tasks=<path|none> mode=<new|keeps-running|restore-on:<machine>|nothing> owns-watchers=<yes|no> worktrees=<abs;abs|none>
+```
+
+## Step 1 — list the fleet
+
+Run `ListAgents`. Your own name is in its header line (`This session is <name>`): you are the
+coordinator. Candidates:
+- every local interactive or background session, and every Remote Control session that is not
+  `offline`: each gets the close message in Step 3;
+- every cloud session: it is listed as `keeps-running` and gets **no** message (it keeps running in
+  the cloud). In Step 4 you save its ack yourself:
+  `FLEET-ACK name=<n> role=<role-of n> machine=cloud folder=- relay=- tasks=none mode=keeps-running owns-watchers=no worktrees=none`,
+  then the prompt line `Cloud session: keeps running; nothing to restore.`;
+- `offline` rows and your own row are not candidates.
+
+For each candidate, and for yourself, get the role:
+`python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" role-of <name>`. **Two sessions with the same role**
+would get one start line and one new name, and one of them would be lost. So when roles repeat, keep the
+role for the first name (sorted), and give each other one a distinct role `<role>-b`, `<role>-c`, ...; tell
+that session its role in Step 3 (rule 5).
+
+Print the candidate list (name, kind, machine, role) before you send anything. If there are no candidates,
+say so, run `/caddis:handoff` for this session only, and **stop**.
+
+## Step 2 — make the fleet dir
+
+The fleet dir is `.caddis/relay/fleet/<MMDD>-<HH>/` in this repo, at the coordinator's local time:
+
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" new-name fleet
+```
+
+prints `fleet-<MMDD>-<HH>`; the dir name is the `<MMDD>-<HH>` part. Create it. It is local and
+gitignored (it holds machine paths). Use the same dir for every later step, even if the hour changes.
+
+## Step 3 — send the close message
+
+Send each candidate (from Step 1) one `SendMessage`. The first line must be exactly:
+
+```
+FLEET CLOSE from <coordinator>: write your handoff and ack.
+```
+
+Then these close rules, in the message:
+1. Run `/caddis:handoff` for **your own** relay only. Never touch another session's files. Skip its
+   Step 7 (the `Push this note for another machine?` question): the restart sheet carries your prompt,
+   and a question nobody answers would stop you before you ack.
+2. In a shared checkout (its `AGENTS.md` says `Shared checkout: yes`, or `git status` shows changes you
+   did not make), skip the steps the handoff checklist skips there.
+3. If you run watchers: copy each watcher script to `.caddis/relay/<your name>-files/watchers/`, and fill
+   the relay's `## Watchers` section (per watcher: script path, exact start command, stop condition,
+   the action after the stop).
+4. Your resume prompt must load your tasks file, greet peers with `<role> is now <your new name>`, and,
+   in a shared checkout, say: "read code facts from origin/main; a worktree needs its own fresh
+   dependencies".
+5. Reply to `<coordinator>` with this block (one line, every field filled), then your full resume prompt:
+   ```
+   FLEET-ACK name=<n> role=<r> machine=<m> folder=<abs> relay=<path> tasks=<path|none> mode=<new|keeps-running|restore-on:<machine>|nothing> owns-watchers=<yes|no> worktrees=<abs;abs|none>
+   ```
+   Use `name=<your current name>` exactly as `ListAgents` shows it, and `role=<role>` as given in this
+   message (a role that repeats in the fleet gets `<role>-b`, ...). `mode=new` if your work continues
+   in a new session; `mode=nothing` if it needs no new session (for example a finished read-only review).
+6. Remote sessions (another machine): also put your open task rows inline after the prompt, as a table
+   with exactly this header line (other headers are not read):
+   ```
+   | Old # | Status | Subject |
+   |---|---|---|
+   ```
+   and say whether your machine restarts (`mode=restore-on:<machine>`) or not (`mode=keeps-running`).
+7. Do not exit or stop after the ack; the owner closes sessions.
+
+## Step 4 — collect acks (first wait: 10 minutes)
+
+Start a background timer, never a foreground wait:
+
+```
+sleep 600
+```
+
+with `run_in_background`. Each ack arrives as a cross-session message. For each one:
+1. Write the message text (from the `FLEET-ACK` line to the end) to a temp file in your scratchpad.
+2. Save it:
+   ```
+   python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" ack add --dir <fleet dir> --text-file <temp file>
+   ```
+3. Exit 0 → acked. An error names the missing or bad field: send that session **one** reply that
+   quotes the error and asks for a corrected ack. Do not fix the ack yourself.
+4. The ack's `name=` must be the name of the candidate that sent it, and its `role=` the role you gave
+   it. If not, send **one** reply asking for a corrected ack (a wrong name makes a phantom row and marks
+   the real session `no ack`). A second ack from the same session replaces the first (`ack add` saves by
+   name).
+
+Also save the cloud-session acks from Step 1 here, the same way.
+
+## Step 5 — remind once (second wait: 20 minutes)
+
+When the 10-minute timer ends, send each silent candidate **one** reminder:
+`FLEET CLOSE reminder from <coordinator>: your ack is still missing.` Start a 20-minute background
+timer (`sleep 1200`, `run_in_background`) and keep saving acks as in Step 4. When it ends (or every
+candidate has acked), stop waiting. Each session still silent is a `no ack` row (Step 7).
+
+**A late ack is never dropped.** Until Step 8 ends, keep saving every ack that arrives, as in Step 4, and
+remove that session from the `--no-ack` list before the next `write`.
+
+## Step 6 — your own handoff and ack
+
+Run `/caddis:handoff` for this session (the coordinator's own relay). Then write your own ack (the
+`FLEET-ACK` block with your fields and your resume prompt) to a temp file and save it with
+`ack add`, as in Step 4. The coordinator's ack is never skipped. Then record this session's presence
+(your session id is printed at session start as `[caddis] this session's id: <id>`; never guess one):
+
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" whoami --session-id <id> --name <your name> --root .
+```
+
+## Step 7 — write and check the sheet
+
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" write --dir <fleet dir> --coordinator <your name> --no-ack <name> [--no-ack <name> ...]
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" check --dir <fleet dir>
+```
+
+Pass `--no-ack <name>` once for each silent session from Step 5, **on every `write`**, and leave it out
+when every session acked (a placeholder would become a fake row) (the no-ack rows are not
+saved between runs). `write` saves `roster.md` and `restart-sheet.md` in the fleet dir.
+
+- `check` exit 0 → go to Step 8.
+- `check` exit 1 → send each named session **one** message that quotes its error and asks for a
+  corrected ack. Start one 5-minute background timer (`sleep 300`, `run_in_background`) and save the
+  corrected acks that arrive. Then run `write` (same `--no-ack` flags) and `check` once more. Errors that
+  remain go at the end of `restart-sheet.md` under a heading `## Needs the owner:`, one line each,
+  quoted exactly.
+- `write` or `check` exit 3 (no acks, or a file it cannot read) → do not print a sheet. Report the exact
+  error, list every ack file in `<fleet dir>/acks/`, and **stop**: the owner decides.
+
+## Step 8 — final reply
+
+Reply with the whole text of `restart-sheet.md`, then its absolute path, and nothing else. The
+restart closes this session too, so the sheet must be on screen and on disk.

package/bundles/antigravity-plugin/skills/fleet-open/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: fleet-open
+description: Restore one role from the fleet restart sheet in a new session — name check, relay, tasks, peer greeting, watchers
+---
+
+# /caddis:fleet-open — restore a role from the restart sheet
+
+A fleet close (`/caddis:fleet-close`) wrote a restart sheet: one row per role, with the folder to
+start `claude` in, a start line that names the new session, and the role's resume prompt. You are the new session
+for one of those rows. This command restores that role in one go.
+
+The argument is the role: `$ARGUMENTS`. If it is empty, list the roles of the newest sheet (Step 1)
+and ask which one — do not guess.
+
+Every fleet rule lives in `${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py`; this command only calls it.
+Run each step in order. A step that says "stop" ends the command: print why, and nothing else.
+
+## Step 1 — find the newest restart sheet that holds the role
+
+```
+ls -d .caddis/relay/fleet/*/restart-sheet.md
+```
+
+The folders are named `<MMDD>-<HH>` (the coordinator's local time). Go from the newest folder to the
+oldest and take the first `restart-sheet.md` with a section `### <n>. <role>`. Read the
+`roster.md` beside it too: its row for the role gives the relay, the tasks file, the folder and the
+mode.
+
+- No sheet holds the role → say `No restart sheet holds <role>.` and **stop**.
+- The sheet row says `no new session` (mode `keeps-running`, `nothing` or `no ack`) → say so, quote
+  the row's section, and **stop**. A `no ack` row needs `/caddis:handoff` run by hand in the old
+  session first.
+
+## Step 2 — check this session's name before loading anything
+
+Run `ListAgents`. Its header line says `This session is <name>`; that is your name. The sheet row's
+Start line already names the session: `claude --name <expected> "/caddis:fleet-open <role>"`, where
+`<expected>` is `new_name` of the role at the sheet's hour.
+
+- `<name>` equals `<expected>` → go on.
+- Otherwise it must at least be a name of this role:
+  ```
+  python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" role-of <name>
+  ```
+  prints `<role>` (the name is `<role>-<MMDD>-<HH>`) → go on, and note the name differs from the sheet.
+- Anything else → tell the owner to run `/rename <expected>` and then `/caddis:fleet-open <role>`
+  again, and **stop**. A session cannot rename itself, and a role loaded under the wrong name is a
+  role its peers never reach.
+
+Nothing is read into this session (no relay, no tasks, no watcher) until this step passes.
+
+## Step 3 — read the relay and run its resume prompt
+
+Read the role's relay (the roster's Relay column, `.caddis/relay/<old name>.md`), then follow the
+resume prompt in the sheet section — the fenced block under `### <n>. <role>`. It is the same prompt
+the old session wrote; do what it says, in order.
+
+Load the open tasks: every row of the tasks file (roster Tasks file column,
+`.caddis/relay/<old name>.tasks.md`, table `| Old # | Status | Subject |`) becomes one `TaskCreate`
+with the Subject as its subject. A row with Status `in_progress` then gets
+`TaskUpdate` to `in_progress`. A remote role's rows are inline on the sheet under
+`Tasks (inline, remote session):` — load those the same way. Tasks file `none` → 0 tasks.
+Count the tasks you created; Step 6 reports it.
+
+## Step 4 — greet the live local peers
+
+From the `ListAgents` output of Step 2 (run it again if more than a few minutes passed), take each
+live local session whose role is in the roster (`caddis_fleet.py role-of <their name>`), other than
+your own role. When a role has several names, address the newest:
+
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" newest <their role> --names-file <file with one name per line>
+```
+
+Send each one message, exactly: `<role> is now <name>` (your role, your name). Skip offline sessions
+and cloud sessions. Keep the list of names you greeted for Step 6.
+
+## Step 5 — restart the watchers
+
+Read the relay's `## Watchers` section. For each entry:
+
+1. Print the entry as written (script path, start command, stop condition, after-action).
+2. Check the script path exists (handoff copied it to `.caddis/relay/<old name>-files/watchers/`)
+   and that the stop condition and the after-action are both in the relay. If either is missing,
+   do not start it: report it as `watcher not started: <reason>` in Step 6.
+3. Start it with its exact start command through Bash with `run_in_background`. Never a foreground
+   `sleep` or loop.
+
+No `## Watchers` section → 0 watchers.
+
+## Step 6 — record the name and report
+
+Record this session's presence (your session id is printed at session start as
+`[caddis] this session's id: <id>`; never guess one):
+
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_fleet.py" whoami --session-id <id> --name <name> --root .
+```
+
+Then print one line, and any `watcher not started:` lines under it:
+
+```
+[FLEET-OPEN] <role> restored: <n> tasks, <k> watchers, peers greeted: <names>
+```
+
+## Rules
+
+- One role per session. To restore another role, start another session from the sheet.
+- Never `claude --resume` the old session: the sheet exists so every role starts fresh.
+- Never edit the restart sheet or the roster; they are the record of the close.

package/bundles/antigravity-plugin/skills/gh-cli/SKILL.md

@@ -167,7 +167,8 @@ gh alias set review 'pr list --search "review-requested:@me"'
 
 ```bash
 gh issue develop 42 --branch fix/issue-42
-git add . && git commit -m "fix: resolve login bug" && git push -u origin HEAD
+git add src/auth/login.py tests/test_login.py   # named files only, never `git add .`
+git commit -m "fix: resolve login bug" && git push -u origin HEAD
 gh pr create --title "fix: resolve login bug" --body "Closes #42"
 gh pr checks --watch
 gh pr merge --squash --delete-branch

package/bundles/antigravity-plugin/skills/handoff/SKILL.md

@@ -8,6 +8,9 @@ description: End-of-session handoff — capture exact state so the next session
 You are ending a work session. Produce/refresh this workstream's resume doc (`.caddis/relay/<name>.md`) so the next session
 (you, a future you, or another agent on any tool) can resume immediately. This is the anti-context-rot checkpoint.
 
+Several sessions to close together? Run `/caddis:fleet-close` in one of them instead; it asks each session to run this
+command and collects one restart sheet.
+
 ## Step 0 — is this a shared checkout?
 Another session may have uncommitted edits in this checkout. A handoff that commits here can carry
 them into its commit, so check first, before Step 1.
@@ -33,9 +36,12 @@ them into its commit, so check first, before Step 1.
    - Step 3, point 4: run `caddis_rows.py set --file <worktree>/.caddis/open-work.md ...`, and make the
      plan's Tracker edit in `<worktree>/.caddis/plans/<feature>.md`, not in this checkout.
    - Step 4: skip `caddis_tidy.py --apply` (report `skipped: shared checkout`).
+   - Step 6: skip `caddis_todo.py reconcile` (report `skipped: shared checkout`; it writes tracked
+     `.caddis/todo-list/` files and has no worktree option).
    - Step 6b: skip `session_state.py prune` (report `skipped: shared checkout`).
+   - Step 6c: run `--reindex` in the worktree (it edits the tracked `DOC-MAP.md`).
    - The relay stays in this checkout: `.caddis/relay/` is local and gitignored.
-   After Step 6b, run:
+   After Step 6c, run:
    ```
    python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_docs_pr.py" finish --worktree <path> --title "docs(handoff): <name> session notes" --body "Handoff doc edits from a shared checkout."
    ```
@@ -44,6 +50,30 @@ them into its commit, so check first, before Step 1.
    it never merges. On a failure it prints `PATCH: <path>` with the edits; report that path. Put the
    `PR:` line and the file list in your final report, under `Docs PR needed:`.
 
+## Checklist
+The handoff is a fixed checklist. Every row ends as `done`, `skipped: <reason>` or `failed: <error>`, and
+Step 8 prints all 13 in this order. Never drop a row from the report, even when its step did not apply.
+
+| # | Row | What it is | Shared checkout (Step 0) |
+|---|---|---|---|
+| 1 | `knowledge-transfer` | Step 1 | edits only in the Step 0 worktree |
+| 2 | `plan-tracker` | the plan's Tracker row (Rules) | edit in the Step 0 worktree |
+| 3 | `open-work-row` | Step 3, point 4: `caddis_rows.py set` | `--file <worktree>/...` |
+| 4 | `relay` | Step 3: the relay, written from scratch with current state only | the relay is local; runs |
+| 5 | `tasks-file` | Step 3c | runs |
+| 6 | `kb-index` | Step 6c: refresh the KB index | in the Step 0 worktree |
+| 7 | `violations-report` | Step 6c: report standing violations, each with a one-line fix command | runs (report only) |
+| 8 | `todo-reconcile` | Step 6: `caddis_todo.py reconcile` | `skipped: shared checkout` |
+| 9 | `usage-record` | Step 6b: `session_state.py usage` | runs |
+| 10 | `tidy-apply` | Step 4: `caddis_tidy.py --apply` | `skipped: shared checkout` |
+| 11 | `state-prune` | Step 6b: `session_state.py prune` | `skipped: shared checkout` |
+| 12 | `prune-list` | Step 6b: `caddis_tidy.py --prune`, list only | runs (lists, never applies) |
+| 13 | `handover-check` | Step 5 | runs |
+
+`tidy-apply`, `state-prune` and `todo-reconcile` run only on `SHARED: no`. Handoff never runs
+`caddis_tidy.py --prune --apply` on its own, in any checkout; only the user can ask for it (Step 6b). In a
+shared checkout the report also lists every tracked file Step 1 changed, under `Docs PR needed:`.
+
 ## Step 1 — capture learnings FIRST (knowledge-transfer)
 **Before** gathering git signals or writing relay.md, decide on `knowledge-transfer` — and the default
 is to run it.
@@ -107,6 +137,9 @@ Nothing to say is the normal answer. Say nothing and move on — this must not b
 <!-- /shared:harness-friction-question -->
 
 ## Step 3 — write the resume doc (overwrite) with exactly these sections
+Write the relay from scratch with the current state only. Never append to the old text: git keeps the
+history, and the relay has a 4,000-character budget (`caddis_budget.py`).
+
 > **Where to write:** this session's own workstream relay, `.caddis/relay/<name>.md`, through the
 > locked script — never with a plain file edit, which would skip the conflict check. `.caddis/relay.md`
 > is a generated index of all workstreams; do not write it by hand.
@@ -184,7 +217,9 @@ knowledge-transfer: <✓ ran → files written | ✗ skipped → reason>
 ## Resume prompt
 \`\`\`
 Read .caddis/relay/<name>.md, then the plan it points to. Continue from <phase/step>. Next action: <exact>.
+Load every row of .caddis/relay/<name>.tasks.md with TaskCreate.
 \`\`\`
+(Keep the `Load every row` sentence only when Step 3c wrote `.caddis/relay/<name>.tasks.md`.)
 
 STATUS: <CONTINUE | OWNER-GATE <P>-OG<n> | BLOCKED <owner> | FAILED <reason>>
 ```
@@ -195,6 +230,20 @@ Small work that does not meet a trigger skips its block.
 
 **Trigger: Always.** The relay ends with a status line, the last non-empty line, and it is exactly one of `STATUS: CONTINUE`, `STATUS: OWNER-GATE <P>-OG<n>`, `STATUS: BLOCKED <owner>` or `STATUS: FAILED <reason>`. In Step 3, point 5, write the relay with `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_workstreams.py" put <name> <temp-file> --require-status --expected-hash <hash>` instead of `write` (in short: put --require-status), with the same hash Step 3 read, so a peer's newer relay is never overwritten. It rejects a relay with no valid status line, and renders the index. When the repo has `.caddis/open-work.md` with `type: open-work` in its frontmatter, also set each open-work row's status with `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_rows.py" set --file <open-work.md> --id <row id> --col Status=<status>` (in a shared checkout, the copy in the Step 0 worktree). When the status is `done`, also pass `--col Evidence=<commit, PR or test>`: caddis_rows.py refuses `done` with no Evidence.
 
+## Step 3c - Save the open tasks
+The task list dies with the session unless it is saved. Write this session's open tasks beside
+the relay:
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/session_state.py" tasks-file --session-id <session-id> --relay <name> --root .
+```
+It reads the `## Tasks` table of `.caddis/session-state/<session-id>.md`, keeps the rows that are
+not `done` or `deleted`, and prints `[TASKS] <n> open task(s) -> <path>` or `[TASKS] none open`
+(with no open task it deletes an old `.caddis/relay/<name>.tasks.md`). When it wrote a file, the
+relay's resume prompt must hold the sentence
+`Load every row of .caddis/relay/<name>.tasks.md with TaskCreate.`: Step 5 blocks a relay whose
+tasks file exists and is not named. If you wrote the relay before running this, rewrite it with
+Step 3, point 5.
+
 ## Step 4 — tidy finished artifacts
 Flip any plan/prompt's frontmatter `status:` to `done` (or `superseded`) if this session actually
 finished it — that is your judgment call; the script below never makes it and never auto-flips
@@ -260,6 +309,34 @@ It only lists: session-state files older than 7 days, logs over 5 MB to rotate,
 only, never deleted) orphan `.lock` files and lane worktrees older than 7 days. Include its report. **Never
 add `--apply` yourself**; deleting is the user's choice. If they ask, run `--prune --apply`.
 
+## Step 6c — KB index and standing violations
+Both scripts fall back to `claude-harness/scripts/check_doc_coverage.py` and `scripts/caddis_tidy.py` in a
+source checkout; a script that is missing is `skipped: <script> not installed`.
+
+Checklist row 6, `kb-index` (in a shared checkout, run it in the Step 0 worktree, before the Step 0
+`finish`; it edits `DOC-MAP.md`):
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/check_doc_coverage.py" --reindex
+```
+Checklist row 7, `violations-report` (all three only report; never fix files here):
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_tidy.py" --check
+python "${CLAUDE_PLUGIN_ROOT}/scripts/check_doc_coverage.py"
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_budget.py" check --root . --report
+```
+`caddis_budget.py` lists each handoff-grown file over its size budget (`OVER <path>: ...; fix: <rule>`); the
+`fix:` text is the one-line fix for that row.
+List each violation they print with a one-line command that fixes it (for example `/caddis:kb` for an
+un-indexed note, or `caddis_tidy.py --apply` for a finished artifact in the wrong folder). A violation is
+not a failure of the handoff: the row is `done` when all three ran. If a script is missing, the row is
+`skipped: <script> not installed`.
+
+Then, when the repo has a roadmap (`.caddis/roadmaps/`), re-render its page so phases built by hand show too
+(best effort, not a checklist row; it writes only under `~/.caddis/roadmap-pages/`, never in this checkout):
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_roadmap.py" render --all
+```
+
 ## Step 7 — push prompt (interactive only)
 If this is an interactive session, ask the user every time — never reuse an earlier answer:
 `Push this note for another machine? (y/N)`
@@ -272,6 +349,29 @@ index or staged files — after the secret filter passes. Report its one-line re
 `y` means do nothing. Headless runs never ask and never push (the script also refuses headless).
 On the other machine, `/catchup <name>` fetches it.
 
+## Step 8 — the checklist report
+End the handoff with this block, every row filled with `done`, `skipped: <reason>` or `failed: <error>`:
+
+```
+=== HANDOFF CHECKLIST ===
+1 knowledge-transfer   done | skipped: <reason> | failed: <error>
+2 plan-tracker         <same three forms>
+3 open-work-row        <same three forms>
+4 relay                <same three forms>
+5 tasks-file           <same three forms>
+6 kb-index             <same three forms>
+7 violations-report    <same three forms>
+8 todo-reconcile       <same three forms>
+9 usage-record         <same three forms>
+10 tidy-apply          <same three forms>
+11 state-prune         <same three forms>
+12 prune-list          <same three forms>
+13 handover-check      <same three forms>
+Shared checkout: yes|no <reason>
+```
+
+Then, in a shared checkout, `Docs PR needed:` with the `PR:` line and the file list from Step 0.
+
 ## Rules
 - **One next action, by priority ladder.** `## Next step` names exactly ONE action — not a menu. Pick it in
   order: (1) interrupted mid-phase work → finish + commit it; else (2) the active plan's next not-started

package/bundles/antigravity-plugin/skills/migrate-dir/SKILL.md

@@ -24,8 +24,9 @@ It ships with the harness. Try, in order:
 git -C <target> status --short
 ```
 The migration **refuses a dirty tree** (a rename mixed into unrelated edits is unreviewable, and
-these working trees are shared with parallel sessions). If it's dirty: commit or stash first. Never
-pass `--allow-dirty` on a tree whose changes you didn't make.
+these working trees are shared with parallel sessions). If it's dirty with your own changes: commit
+them first. If it holds changes you did not make, stop and ask the owner: never commit, stash or reset
+them, and never pass `--allow-dirty` on such a tree.
 
 ## Step 3 — dry run
 ```