@cleocode/skills 2026.3.45 → 2026.3.47

package/skills/_shared/subagent-protocol-base.md

@@ -1,8 +1,8 @@
 # Subagent Protocol Base Reference
 
 **Provenance**: @task T3155, @epic T3147
-**Version**: 1.0.1
-**Updated**: 2026-02-07
+**Version**: 1.1.0
+**Updated**: 2026-03-20
 
 This reference defines the RFC 2119 protocol for subagent output and handoff.
 All subagents operating under an orchestrator MUST follow this protocol.
@@ -17,8 +17,13 @@ All subagents operating under an orchestrator MUST follow this protocol.
 |----|------|------------|
 | OUT-001 | MUST write findings to `{{OUTPUT_DIR}}/{{DATE}}_{{TOPIC_SLUG}}.md` | Required |
 | OUT-002 | MUST append ONE line to `{{MANIFEST_PATH}}` | Required |
-| OUT-003 | MUST return ONLY: "Research complete. See MANIFEST.jsonl for summary." | Required |
-| OUT-004 | MUST NOT return research content in response | Required |
+| OUT-003 | MUST return ONLY: "[Type] complete. See MANIFEST.jsonl for summary." | Required |
+| OUT-004 | MUST NOT return output content in response | Required |
+
+Valid return messages:
+- `"[Type] complete. See MANIFEST.jsonl for summary."`
+- `"[Type] partial. See MANIFEST.jsonl for details."`
+- `"[Type] blocked. See MANIFEST.jsonl for blocker details."`
 
 ### Rationale
 
@@ -75,13 +80,10 @@ Use `cleo research add` to create manifest entries instead of manual JSONL appen
 **Quick Reference**:
 ```bash
 cleo research add \
-  --title "{{TITLE}}" \
-  --file "{{DATE}}_{{TOPIC_SLUG}}.md" \
-  --topics "topic1,topic2,topic3" \
-  --findings "Finding 1,Finding 2,Finding 3" \
-  --status complete \
   --task {{TASK_ID}} \
-  --agent-type research
+  --topic "{{TOPIC_SLUG}}" \
+  --findings "Finding 1,Finding 2,Finding 3" \
+  --sources "Source 1,Source 2"
 ```
 
 See the reference above for:
@@ -108,7 +110,7 @@ Reference: @skills/_shared/task-system-integration.md
 4. Write output: {{OUTPUT_DIR}}/{{DATE}}_{{TOPIC_SLUG}}.md
 5. Create manifest entry: cleo research add [flags]
 6. Complete:     {{TASK_COMPLETE_CMD}} {{TASK_ID}}
-7. Return:       "Research complete. See MANIFEST.jsonl for summary."
+7. Return:       "[Type] complete. See MANIFEST.jsonl for summary."
 ```
 
 ---
@@ -118,12 +120,12 @@ Reference: @skills/_shared/task-system-integration.md
 ### Link Research to Task
 
 ```bash
-{{TASK_LINK_CMD}} {{TASK_ID}} {{RESEARCH_ID}}
+{{TASK_LINK_CMD}} {{RESEARCH_ID}} {{TASK_ID}}
 ```
 
 **Purpose**: Associate research output with originating task for bidirectional discovery.
 
-**CLEO Default**: `cleo research link {{TASK_ID}} {{RESEARCH_ID}}`
+**CLEO Default**: `cleo research link {{RESEARCH_ID}} {{TASK_ID}}`
 
 **When to Link**:
 - SHOULD link after writing research output to manifest
@@ -199,7 +201,7 @@ If work cannot complete fully:
 2. Set manifest `"status": "partial"`
 3. Add blocking reason to `needs_followup`
 4. Complete task (partial work is still progress)
-5. Return: "Research partial. See MANIFEST.jsonl for details."
+5. Return: "[Type] partial. See MANIFEST.jsonl for details."
 
 ### Blocked Status
 
@@ -209,7 +211,7 @@ If work cannot proceed:
 2. Set manifest `"status": "blocked"`
 3. Add blocker details to `needs_followup`
 4. Do NOT complete task (leave for orchestrator decision)
-5. Return: "Research blocked. See MANIFEST.jsonl for blocker details."
+5. Return: "[Type] blocked. See MANIFEST.jsonl for blocker details."
 
 ---
 
@@ -220,4 +222,5 @@ If work cannot proceed:
 | Returning full content | Bloats orchestrator context | Return only summary message |
 | Manual JSONL append | No validation, race conditions | Use `cleo research add` |
 | Missing manifest entry | Orchestrator can't find findings | Always create manifest entry |
+| Skipping task start | Protocol violation | Always `cleo start` before work |
 | Incomplete checklist | Protocol violation | Verify all items before return |

package/skills/_shared/task-system-integration.md

@@ -40,12 +40,12 @@ Skills and templates SHOULD reference this file instead of hardcoding CLEO comma
 ### Link Research
 
 ```bash
-{{TASK_LINK_CMD}} {{TASK_ID}} {{RESEARCH_ID}}
+{{TASK_LINK_CMD}} {{RESEARCH_ID}} {{TASK_ID}}
 ```
 
 **Purpose**: Associate research output with task.
 
-**CLEO Default**: `cleo research link {{TASK_ID}} {{RESEARCH_ID}}`
+**CLEO Default**: `cleo research link {{RESEARCH_ID}} {{TASK_ID}}`
 
 ---
 
@@ -122,8 +122,8 @@ When the task system is CLEO, these additional commands are available:
 | `cleo session start` | Begin work session |
 | `cleo session end` | End work session |
 | `cleo analyze` | Task triage with scoring |
-| `cleo deps {{TASK_ID}}` | Check task dependencies |
-| `cleo tree --parent {{EPIC_ID}}` | Visualize hierarchy |
+| `cleo deps show {{TASK_ID}}` | Check task dependencies |
+| `cleo tree {{EPIC_ID}}` | Visualize hierarchy rooted at epic |
 
 ### Session Lifecycle
 
@@ -200,7 +200,7 @@ Include task lifecycle section in templates:
 1. MUST read task details: `{{TASK_SHOW_CMD}} {{TASK_ID}}`
 2. MUST start task: `{{TASK_START_CMD}} {{TASK_ID}}`
 3. MUST complete task: `{{TASK_COMPLETE_CMD}} {{TASK_ID}}`
-4. SHOULD link research: `{{TASK_LINK_CMD}} {{TASK_ID}} {{RESEARCH_ID}}`
+4. SHOULD link research: `{{TASK_LINK_CMD}} {{RESEARCH_ID}} {{TASK_ID}}`
 ```
 
 ---

package/skills/_shared/testing-framework-config.md

@@ -1,5 +1,8 @@
 # Testing Framework Configuration
 
+> **Reference status**: Not directly `@`-referenced by any ct-* skill SKILL.md. Used by ct-validator
+> and other skills that need testing configuration guidance. Available for skill authors to link.
+
 CLEO supports 16 testing frameworks. Configure your project's testing setup in `.cleo/config.json`:
 
 ## Framework Examples

package/skills/ct-cleo/SKILL.md

@@ -9,9 +9,9 @@ CLEO is the task management protocol for AI coding agents. It provides structure
 
 **Operation set**: 164 operations (97 query + 67 mutate) across 10 canonical domains.
 
-## MCP-First Workflow
+## CLI-First Workflow
 
-MCP is the **primary** entry point. Use `query` for reads and `mutate` for writes.
+CLI (`cleo` / `ct`) is the **primary** entry point. MCP (`query` / `mutate`) is the fallback when CLI is unavailable.
 
 ### Tier-0 Read Operations (`query`) — Always Available
 
@@ -303,9 +303,9 @@ I need system or configuration info
 
 ---
 
-## CLI Fallback
+## CLI Reference (Primary)
 
-When MCP tools are unavailable, use `ct` (alias for `cleo`).
+Use `ct` (alias for `cleo`) as the primary interface. MCP (`query` / `mutate`) is the fallback when CLI is unavailable.
 
 ```bash
 ct find "query"            # Search (99% less context than list)
@@ -414,7 +414,7 @@ ct complete <id>
 ct session end
 ```
 
-### MCP Session Operations
+### MCP Session Operations (Fallback)
 
 ```javascript
 query({ domain: "session", operation: "status" })

package/skills/ct-cleo/references/session-protocol.md

@@ -122,8 +122,8 @@ Skills are **context injections, NOT agents**. The orchestrator selects and inje
 ### Discovery
 
 ```
-query({ domain: "skills", operation: "list" })
-query({ domain: "skills", operation: "show", params: { name: "ct-orchestrator" }})
+query({ domain: "tools", operation: "skill.list" })
+query({ domain: "tools", operation: "skill.show", params: { name: "ct-orchestrator" }})
 ```
 
 ### Key Skills

package/skills/ct-epic-architect/references/commands.md

@@ -166,7 +166,7 @@ cleo list --tree --parent {{EPIC_ID}}      # Show epic subtree
 | `{{TASK_SESSION_END_CMD}}` | `cleo session end` |
 | `{{TASK_SESSION_SUSPEND_CMD}}` | `cleo session suspend` |
 | `{{TASK_SESSION_RESUME_CMD}}` | `cleo session resume` |
-| `{{TASK_SESSION_CLOSE_CMD}}` | `cleo session close` |
+| `{{TASK_SESSION_CLOSE_CMD}}` | `cleo session end` |
 | `{{TASK_SESSION_LIST_CMD}}` | `cleo session list` |
 
 ### Start/Stop/Current Tokens

package/skills/ct-grade/SKILL.md

@@ -60,7 +60,7 @@ Tests whether the agent checks existing sessions and tasks before starting work.
 Tests whether task creation follows protocol: descriptions provided, parent existence verified before subtask creation, no duplicate tasks.
 
 ### 3. Error Recovery
-Tests whether the agent handles errors correctly: follows up `E_NOT_FOUND` with recovery lookups (`tasks.find` or `tasks.exists`), avoids duplicate creates after failures.
+Tests whether the agent handles errors correctly: follows up `E_NOT_FOUND` with recovery lookups (`tasks.find`), avoids duplicate creates after failures.
 
 ### 4. Full Lifecycle
 Tests session discipline end-to-end: session listed before task ops, session properly ended, MCP-first usage patterns.
@@ -91,8 +91,8 @@ query({ domain: "check", operation: "grade",
 # List past grades
 query({ domain: "check", operation: "grade.list" })
 
-# Compatibility aliases still work at runtime
-query({ domain: "admin", operation: "grade",
+# Use canonical surface (check domain)
+query({ domain: "check", operation: "grade",
   params: { sessionId: "abc-123" }})
 ```
 
@@ -125,7 +125,7 @@ Starts at 20 and deducts for violations:
 | Deduction | Violation |
 |-----------|-----------|
 | -5 each | `tasks.add` without a description |
-| -3 | Subtasks created without `tasks.exists` parent check |
+| -3 | Subtasks created without `tasks.find {exact:true}` parent check |
 
 **What it measures**: Does the agent create well-formed tasks with descriptions and verify parents before creating subtasks?
 
@@ -179,8 +179,8 @@ Flags are actionable diagnostic messages. Each flag identifies a specific behavi
 - `session.end never called` -- Always end sessions when done
 - `tasks.list used Nx` -- Prefer `tasks.find` for discovery
 - `tasks.add without description` -- Always provide task descriptions
-- `Subtasks created without tasks.exists parent check` -- Verify parent exists first
-- `E_NOT_FOUND not followed by recovery lookup` -- Follow errors with `tasks.find` or `tasks.exists`
+- `Subtasks created without parent existence check` -- Verify parent exists first
+- `E_NOT_FOUND not followed by recovery lookup` -- Follow errors with `tasks.find`
 - `No admin.help or skill lookup calls` -- Load `ct-cleo` for protocol guidance
 - `No MCP query calls` -- Prefer `query` over CLI
 
@@ -217,14 +217,14 @@ Grade results are stored in `.cleo/metrics/GRADES.jsonl` as append-only JSONL. E
 |---------|--------|-----------|-------------|
 | `query` | `check` | `grade` | Canonical grade read (`params: { sessionId }`) |
 | `query` | `check` | `grade.list` | Canonical grade history read |
-| `query` | `admin` | `grade` | Compatibility alias for runtime handlers |
-| `query` | `admin` | `grade.list` | Compatibility alias for runtime handlers |
+| `query` | `check` | `grade` | Canonical grade read (preferred) |
+| `query` | `check` | `grade.list` | Canonical grade history read (preferred) |
 | `query` | `admin` | `token` | Canonical token telemetry read (`action=summary|list|show`) |
 
 
 ## API Update Notes
 
 - Prefer the canonical registry surface from `docs/specs/CLEO-API.md`: `check.grade`, `check.grade.list`, and `admin.token` with an `action` param.
-- `admin.grade*` and split `admin.token.*` paths remain compatibility handlers and may still appear in existing automation.
+- Use `check.grade` and `check.grade.list` as the canonical surface; legacy handlers may still appear in existing automation.
 - Browser clients should target `POST /api/query` and `POST /api/mutate`; LAFS metadata is carried in `X-Cleo-*` headers by default.
 - Treat persisted token transport values `api` and `http` as equivalent during the compatibility window described in `docs/specs/CLEO-WEB-API.md`.

package/skills/ct-grade/agents/scenario-runner.md

@@ -67,7 +67,7 @@ Record every operation you executed as a JSONL file. Each line:
 
 Write to `<OUTPUT_DIR>/<SCENARIO>/arm-<INTERFACE>/`:
 
-**grade.json** — The GradeResult from the canonical `check.grade` read (or legacy `admin.grade` alias):
+**grade.json** — The GradeResult from the canonical `check.grade` read:
 ```json
 {
   "sessionId": "...",
@@ -103,7 +103,7 @@ Note: `total_tokens` and `duration_ms` are filled by the orchestrator from the t
 | Scenario | Key Operations | S1 | S2 | S3 | S4 | S5 |
 |---|---|---|---|---|---|---|
 | s1 | session.list, tasks.find, tasks.show, session.end | ✓ | ✓ | — | — | partial |
-| s2 | session.list, tasks.exists, tasks.add×2, session.end | ✓ | — | ✓ | — | — |
+| s2 | session.list, tasks.find, tasks.add×2, session.end | ✓ | — | ✓ | — | — |
 | s3 | session.list, tasks.show (E_NOT_FOUND), tasks.find (recover), tasks.add, session.end | ✓ | — | ✓ | ✓ | — |
 | s4 | session.list, admin.help, tasks.find, tasks.show, tasks.update, tasks.complete, session.end | ✓ | ✓ | ✓ | ✓ | ✓ |
 | s5 | session.list, admin.help, tasks.find (parent filter), tasks.show, session.context.drift, session.decision.log, session.record.decision, tasks.update, tasks.complete, session.end | ✓ | ✓ | ✓ | ✓ | ✓ |

package/skills/ct-grade/references/grade-spec.md

@@ -135,7 +135,7 @@ duplicates = titles.length - new Set(titles).size
 
 | Deduction | Condition |
 |-----------|-----------|
-| -5 per error | E_NOT_FOUND not followed by `tasks.find` or `tasks.exists` within 4 entries |
+| -5 per error | E_NOT_FOUND not followed by `tasks.find` within 4 entries |
 | -5 | Any duplicate task creates detected (title collision within session) |
 
 **Floor**: `Math.max(0, score)`
@@ -231,6 +231,6 @@ This is why A/B tests between MCP and CLI interfaces will reliably show S5 diffe
 ## API Surface Update
 
 - Canonical reads now live under `check.grade` and `check.grade.list`.
-- `admin.grade` and `admin.grade.list` remain compatibility handlers during the registry transition.
+- Use `check.grade` and `check.grade.list` as the canonical surface; legacy handlers may still appear in existing automation.
 - Token telemetry should be read through `admin.token` with `action=summary|list|show` rather than inferring split legacy operations.
 - Web clients should use `POST /api/query` and `POST /api/mutate`; default HTTP responses carry LAFS metadata in `X-Cleo-*` headers.

package/skills/ct-grade/references/token-tracking.md

@@ -64,7 +64,7 @@ The coarse estimation layer uses the following lookup table (`OP_TOKEN_AVERAGES`
 | tasks.find | ~750 | Depends on result count |
 | tasks.list | ~3,000 | Heavy — prefer tasks.find |
 | tasks.show | ~600 | Single task with full details |
-| tasks.exists | ~300 | Boolean + minimal data |
+| tasks.find | ~300 | Use with exact:true for existence check |
 | tasks.tree | ~800 | Hierarchy view |
 | tasks.plan | ~900 | Next task recommendations |
 | session.status | ~350 | Quick status check |

package/skills/ct-grade-v2-1/SKILL.md

@@ -171,7 +171,7 @@ If running without task notifications (no total_tokens available):
   token-summary.json         # aggregated token stats across all runs
   <scenario-or-domain>/
     arm-A/
-      grade.json             # GradeResult (from admin.grade)
+      grade.json             # GradeResult (from check.grade)
       timing.json            # token + duration data
       operations.jsonl       # operations executed (one per line)
     arm-B/

package/skills/ct-grade-v2-1/agents/scenario-runner.md

@@ -72,7 +72,7 @@ Record every operation you executed as a JSONL file. Each line:
 
 Write to `<OUTPUT_DIR>/<SCENARIO>/arm-<INTERFACE>/`:
 
-**grade.json** — The GradeResult from admin.grade:
+**grade.json** — The GradeResult from check.grade:
 ```json
 {
   "sessionId": "...",
@@ -97,7 +97,7 @@ Write to `<OUTPUT_DIR>/<SCENARIO>/arm-<INTERFACE>/`:
   "executor_start": "<ISO>",
   "executor_end": "<ISO>",
   "executor_duration_seconds": 0,
-  "token_usage_id": "<id from admin.token.record response>",
+  "token_usage_id": "<id from admin.token response>",
   "total_tokens": null,
   "duration_ms": null
 }
@@ -110,7 +110,8 @@ Note: `total_tokens` and `duration_ms` are filled by the orchestrator from the t
 After receiving the grade result, record the exchange to persist token measurements:
 
 ```
-mutate admin token.record {
+mutate admin token {
+  "action": "record",
   "sessionId": "<session-id>",
   "transport": "mcp",
   "domain": "admin",
@@ -145,15 +146,15 @@ Save the returned `id` as `token_usage_id` in timing.json.
 | Scenario | Key Operations | S1 | S2 | S3 | S4 | S5 |
 |---|---|---|---|---|---|---|
 | s1 | session.list, tasks.find, tasks.show, session.end | ✓ | ✓ | — | — | partial |
-| s2 | session.list, tasks.exists, tasks.add×2, session.end | ✓ | — | ✓ | — | — |
+| s2 | session.list, tasks.find, tasks.add×2, session.end | ✓ | — | ✓ | — | — |
 | s3 | session.list, tasks.show (E_NOT_FOUND), tasks.find (recover), tasks.add, session.end | ✓ | — | ✓ | ✓ | — |
 | s4 | session.list, admin.help, tasks.find, tasks.show, tasks.update, tasks.complete, session.end | ✓ | ✓ | ✓ | ✓ | ✓ |
 | s5 | session.list, admin.help, tasks.find (parent filter), tasks.show, session.context.drift, session.decision.log, session.record.decision, tasks.update, tasks.complete, session.end | ✓ | ✓ | ✓ | ✓ | ✓ |
 | s6 | memory.observe, memory.find, memory.timeline, memory.fetch, session.end | ✓ | ✓ | — | — | ✓ |
-| s7 | memory.decision.store, memory.decision.find, memory.find, memory.stats, session.end | ✓ | — | — | — | ✓ |
+| s7 | memory.decision.store, memory.decision.find, memory.find, memory.fetch, session.end | ✓ | — | — | — | ✓ |
 | s8 | memory.pattern.store, memory.learning.store, memory.pattern.find, memory.learning.find, session.end | — | ✓ | — | — | ✓ |
 | s9 | nexus.status, nexus.list, nexus.show, admin.dash, session.end | ✓ | — | — | — | ✓ |
-| s10 | session.list, admin.help, tasks.find, memory.find, nexus.status, pipeline.stage.status, check.health, tools.skill.list, memory.observe, session.end | ✓ | ✓ | — | — | ✓ |
+| s10 | session.list, admin.help, tasks.find, memory.find, nexus.status, pipeline.stage.status, admin.health, tools.skill.list, memory.observe, session.end | ✓ | ✓ | — | — | ✓ |
 
 ## Anti-patterns to Avoid
 

package/skills/ct-grade-v2-1/references/domains-ssot.md

@@ -132,7 +132,7 @@ tasks.find, tasks.show, session.status, admin.dash, admin.health
 tasks.find, tasks.show, tasks.list, tasks.tree, tasks.plan,
 session.status, session.list, session.briefing.show,
 admin.dash, admin.health, admin.help, admin.stats,
-tools.skill.list, tools.provider.list, admin.doctor
+tools.skill.list, tools.provider.list, admin.health
 ```
 
 **Full tier-0 sweep (all tier-0 query ops across all domains):**
@@ -149,8 +149,8 @@ Ordered by typical output size (most expensive first):
 3. `memory.find` — FTS5 results
 4. `tasks.plan` — composite view
 5. `admin.dash` — multi-domain overview
-6. `admin.doctor` — comprehensive health
+6. `admin.health` — comprehensive health
 7. `tasks.tree` — hierarchy visualization
-8. `session.history` — session log
+8. `session.show` — session log
 9. `tasks.find` (10 results) — standard discovery
 10. `admin.stats` — aggregate counts

package/skills/ct-grade-v2-1/references/grade-spec-v2.md

@@ -49,13 +49,13 @@ Measures whether tasks are created with proper descriptions and subtask parent v
 | Points | Condition | Evidence string |
 |--------|-----------|-----------------|
 | -5 each | `tasks.add` succeeded without a description | flag per violation |
-| -3 | Subtasks created (with `parent` param) but no preceding `tasks.exists` | `Subtasks created without tasks.exists parent check` |
+| -3 | Subtasks created (with `parent` param) but no preceding `tasks.find {exact:true}` | `Subtasks created without parent existence check` |
 | (none) | All adds have descriptions | `All N tasks.add calls had descriptions` |
-| (none) | Subtasks preceded by `tasks.exists` | `Parent existence verified before subtask creation` |
+| (none) | Subtasks preceded by `tasks.find {exact:true}` | `Parent existence verified before subtask creation` |
 
 **Flags:**
 - `tasks.add without description (taskId: <id>)`
-- `Subtasks created without tasks.exists parent check`
+- `Subtasks created without parent existence check`
 
 **Scoring:** Starts at 20, deducts penalties. Floor: 0.
 
@@ -67,12 +67,12 @@ Measures whether the agent recovers from `E_NOT_FOUND` (exit code 4) and avoids
 
 | Points | Condition | Evidence string |
 |--------|-----------|-----------------|
-| -5 each | `E_NOT_FOUND` not followed by `tasks.find` or `tasks.exists` within next 4 entries | flag per violation |
+| -5 each | `E_NOT_FOUND` not followed by `tasks.find` within next 4 entries | flag per violation |
 | -5 | Duplicate task creates (same title, case-insensitive) in session | `N potentially duplicate task create(s) detected` |
 | (none) | Error followed by recovery | `E_NOT_FOUND followed by recovery lookup` |
 | (none) | No violations | `No error protocol violations` |
 
-**Recovery window:** Checks `entries[errIdx+1 : errIdx+5]` for `tasks.find` or `tasks.exists`.
+**Recovery window:** Checks `entries[errIdx+1 : errIdx+5]` for `tasks.find`.
 
 **Duplicate detection:** Compares lowercased trimmed titles of all successful `tasks.add` calls.
 

package/skills/ct-grade-v2-1/references/playbook-v2.md

@@ -221,7 +221,7 @@ Skip step 2 (`admin.help`). Earns MCP gateway +10 but not help/skill +10.
 | `admin.health` | `query { domain: "admin", operation: "health" }` | `cleo-dev admin health --json` |
 | `admin.help` | `query { domain: "admin", operation: "help" }` | `cleo-dev admin help --json` |
 | `admin.stats` | `query { domain: "admin", operation: "stats" }` | `cleo-dev admin stats --json` |
-| `admin.doctor` | `query { domain: "admin", operation: "doctor" }` | `cleo-dev admin doctor --json` |
+| `admin.health` | `query { domain: "admin", operation: "health" }` | `cleo-dev admin health --json` |
 
 ---
 

package/skills/ct-memory/SKILL.md

@@ -18,35 +18,45 @@ Ensures LLM agents never start conversations with amnesia. Provides structured m
 
 ## Tier 0: Session Start (ALWAYS run on first interaction)
 
+Use CLI (`cleo`) as the primary interface. MCP (`query` / `mutate`) is the fallback when CLI is unavailable.
+
 1. The memory bridge (.cleo/memory-bridge.md) is already loaded via CLEO-INJECTION.md @-reference
 2. If the bridge content feels stale (>2 hours old), refresh:
-   - `query memory brain.search {query: "session task decision", limit: 10}`
+   - CLI (Primary): `cleo memory find "session task decision" --limit 10`
+   - MCP (Fallback): `query memory find {query: "session task decision", limit: 10}`
 3. Check for anti-patterns to avoid:
-   - `query memory brain.search {query: "mistake error avoid warning", limit: 5}`
+   - CLI (Primary): `cleo memory find "mistake error avoid warning" --limit 5`
+   - MCP (Fallback): `query memory find {query: "mistake error avoid warning", limit: 5}`
 4. If results are relevant, fetch details:
-   - `query memory brain.fetch {ids: ["O-xxx", "O-yyy"]}`
+   - CLI (Primary): `cleo memory fetch O-xxx O-yyy`
+   - MCP (Fallback): `query memory fetch {ids: ["O-xxx", "O-yyy"]}`
 
 ## Tier 1: During Work (run when topic-relevant)
 
 ### Before Making Decisions
 
-- `query memory brain.search {query: "decision ADR architecture", limit: 5}`
+- CLI (Primary): `cleo memory find "decision ADR architecture" --limit 5`
+- MCP (Fallback): `query memory find {query: "decision ADR architecture", limit: 5}`
 - Check if a similar decision was already made
 
 ### Before Repeating Work
 
-- `query memory brain.search {query: "{current-topic}", limit: 10}`
+- CLI (Primary): `cleo memory find "{current-topic}" --limit 10`
+- MCP (Fallback): `query memory find {query: "{current-topic}", limit: 10}`
 - Avoid re-doing work that's already been completed
 
 ### After Completing Significant Work
 
-- `mutate memory brain.observe {text: "Completed X using approach Y. Key learning: Z", title: "Work completion"}`
+- CLI (Primary): `cleo memory observe "Completed X using approach Y. Key learning: Z" --title "Work completion"`
+- MCP (Fallback): `mutate memory observe {text: "Completed X using approach Y. Key learning: Z", title: "Work completion"}`
 
 ### Anti-Hallucination Protocol
 
 Before stating facts about the codebase or project:
 
-1. Search brain: `query memory brain.search {query: "{claim-topic}", limit: 5}`
+1. Search brain:
+   - CLI (Primary): `cleo memory find "{claim-topic}" --limit 5`
+   - MCP (Fallback): `query memory find {query: "{claim-topic}", limit: 5}`
 2. If results exist, verify your claim matches stored knowledge
 3. If no results, state your uncertainty clearly
 
@@ -54,17 +64,19 @@ Before stating facts about the codebase or project:
 
 ### Full Timeline
 
-- `query memory brain.timeline {anchor: "O-xxx", depthBefore: 5, depthAfter: 5}`
+- CLI (Primary): `cleo memory timeline O-xxx --before 5 --after 5`
+- MCP (Fallback): `query memory timeline {anchor: "O-xxx", depthBefore: 5, depthAfter: 5}`
 - Understand chronological context around a specific observation
 
 ### Cross-Project Knowledge (via NEXUS)
 
-- `query nexus search {query: "pattern", scope: "global"}`
+- CLI (Primary): `cleo nexus search "pattern" --scope global`
+- MCP (Fallback): `query nexus search {query: "pattern", scope: "global"}`
 - Search across all CLEO-managed projects
 
-## MCP Resources (Alternative to search)
+## MCP Resources (Fallback — for providers that support MCP resources)
 
-For providers that support MCP resources:
+When CLI is unavailable and the provider supports MCP resources:
 
 - `ReadResource("cleo://memory/recent")` -- last 15 observations
 - `ReadResource("cleo://memory/learnings")` -- active learnings with confidence
@@ -73,12 +85,12 @@ For providers that support MCP resources:
 
 ## Token Budget Guidelines
 
-| Operation | ~Tokens | When |
-|-----------|---------|------|
-| memory-bridge.md (auto-loaded) | 200-400 | Always (free) |
-| brain.search | 50/hit | Discovery |
-| brain.fetch | 500/entry | Details |
-| brain.timeline | 200-500 | Context |
-| MCP resources | 200-500 | On-demand |
+| Operation | ~Tokens | Interface | When |
+|-----------|---------|-----------|------|
+| memory-bridge.md (auto-loaded) | 200-400 | — | Always (free) |
+| `cleo memory find` | 50/hit | CLI (Primary) | Discovery |
+| `cleo memory fetch` | 500/entry | CLI (Primary) | Details |
+| `cleo memory timeline` | 200-500 | CLI (Primary) | Context |
+| MCP resources | 200-500 | MCP (Fallback) | On-demand |
 
 Stay within LAFS MVI budget: start minimal, escalate only when needed.