@etiquekit/etq 1.0.12 → 1.0.13

package/docs/RELEASE_SURFACE_AUDIT.md

@@ -34,6 +34,7 @@ docs_default:
   - docs/ARCHITECTURE.md
   - docs/CODEX_CLIENT_COMPATIBILITY.md
   - docs/CONCEPTS.md
+  - docs/CONCEPT_STATUS.md
   - docs/CORE_PROFILE.md
   - docs/LANE_PROVISIONING.md
   - docs/SEAT_DISCIPLINE.md
@@ -90,7 +91,7 @@ internal_templates:
   posture: excluded from new-seat onboarding
 
 package_surface:
-  npm_pack_entries: 182
+  npm_pack_entries: 183
   max_budget: 190
   posture: local devkit package plus signed user-local installer
   distribution_origin: https://etiquette.example.com
@@ -112,7 +113,7 @@ required:
 ## What Is Not Necessary For All Developers
 
 Runtime seat packs, sample-product rehearsals, v3 workflow helper docs, satellite
-operator docs, supervision phase docs, advisory-signal experiments, and internal
+operator docs, advisory-signal experiments, and internal
 templates may remain in the repo for maintainers. The default onboarding path
 must not require them.
 
@@ -125,7 +126,7 @@ blocked:
   - personal absolute paths
   - local username markers
   - old repo name
-  - shop-persona markers in the release rollout package
+  - shop identity markers in the release rollout package
   - prior-run markers in all-developer docs
   - extra files under docs/
   - unexpected public template directories
@@ -141,7 +142,7 @@ npm run release:scan
 
 ## Package Readiness Check
 
-Use `etiquette release readiness --json` before changing distribution settings. It reports private-package, files allowlist, pack-canary, checksum/signature, shell-installer presence, pinned public-key bootstrap support, Codex compatibility, and wrapper gaps; it cannot publish, flip `private`, update Codex, or create a channel.
+Use `etiquette release readiness --json` before changing distribution settings. It also binds the canonical package identity, version floor, source-shipping mode, required bins, source ancestry, and candidate verifier to `release/lineage.v0.json`; `release:candidate` preserves the exact verified tarball and checksum under ignored `dist/` for later signing without rebuilding.
 Codex-backed remote-runtime, plugin-MCP, and hook/action-auth canaries require CLI `0.141.0`+ (`docs/CODEX_CLIENT_COMPATIBILITY.md`). GA additionally runs `etiquette release ga-readiness --channel shell-installer,npm --tag-free-confirmed --json`; it requires a non-prerelease version, final tarball checksums, trusted RSA signature, private-compatible channels, and explicit remote-tag uniqueness confirmation, while still unable to publish, sign, tag, or create a channel. Git source archives must exclude maintainer-only `internal/`, `conformance/`, `site/`, `fixtures/`, `apps/`, local state, and `dist/`.
 
 ## Local-Thin Purge (v0.2.1)
@@ -150,6 +151,6 @@ Codex-backed remote-runtime, plugin-MCP, and hook/action-auth canaries require C
 excluded_cli_commands: [remote, agent-plane, mcp, parity, linear, integration]  # guarded stubs explain absence
 excluded_source_dirs: [agent-plane/, integration/, linear/, mcp/]  # parity/ ships (console dependency)
 excluded_templates: [hosted-receiver/]
-removed_from_templates: [codex-seat etiquette-monitor-pull]  # use `etiquette notify poll`
-doctrine: local set stays thin and provider-neutral; remote/hosted surfaces are source-only until remote lanes open; zero coordination-bus coupling ships
+removed_from_templates: [etiquette-seat-rebind etiquette-seat-lifecycle etiquette-monitor-pull]  # use CLI-native preflight and `etiquette notify poll`
+doctrine: local feature parity ships in the devkit; remote/hosted/EKS surfaces ship outside this devkit; zero coordination-bus coupling ships
 ```

package/docs/SEAT_DISCIPLINE.md

@@ -1,79 +1,19 @@
 # Seat Discipline
 
 Seat discipline keeps agent work useful, attributable, and portable across
-runtimes. Mechanics say what to do; discipline says when to distrust yourself.
-It is organized by moment of need, not by topic.
-
-## On Wake
-
-- Orient before acting: `whereami`, then the task envelope, then the runbook.
-- Read tiered: status line first, then the exact entry, then the full
-  artifact. Never bulk-load directories for "context" — load the specific
-  receipt you were pointed to.
-
-## Before Claiming Anything
-
-- Verify at claim time: re-read the source at the moment you assert it,
-  never from memory of an earlier read. A cited manifest or spec is read in
-  the same act as the claim.
-- Check the live tip, not your notes: logs and board notes lag integrations.
-- When another seat or a human holds the ground truth, ask — do not
-  solo-reconstruct their state.
-
-## Before Writing
-
-- Read the machine fields, not the title: the envelope's mode and allowed
-  writes decide what a task may do; prose is not authority.
-- Search the exact target surface before classifying work as new — most
-  "add X" tasks are "finish the X that half-exists."
-- One writer per canonical mutation. Design in parallel; mutate single-file.
-
-## While Working
-
-- Technical register on the record: schemas, fields, commands, refs.
-  Metaphor and personality stay in chat; the record is for the next reader.
-- No person or vendor names in artifacts. Attribute external material at the
-  moment of incorporation, with license.
-- One meaningful update per note, reader-resolvable without tooling. Write
-  runbook notes, not raw transcript dumps.
-
-## Before Returning
-
-- Receipt first: outcome, changed files, validation command and result,
-  blockers, next owner. No raw logs — cite paths to them.
-- Run validation before returning the receipt. A red validation is reported
-  red; "done" without proof is a defect, not a return.
-- If your change altered a source shape, refresh its recorded evidence in
-  the same commit.
-- Run post-commit hygiene (`git diff --check HEAD~..HEAD`) — pre-commit
-  checks miss freshly added files.
-
-## On Review
-
-- Verify the shipped artifact, not the branch state you remember.
-- Reviews return evidence, never authority: confirm, counter, or advise.
-  A reviewer packet does not mutate the lane it reviews.
-- Accepted review is different from integrated work.
-- Proposals carry their own counter-arguments and open questions — invite
-  the pressure test.
-
-## At Authority Edges
-
-- Stop when authority is unclear, validation cannot run, writes would exceed
-  the envelope, a secret appears, or the session is unbounded.
-- Never claim work was authorized without decision language from the
-  authority holder. Enthusiasm is not routing.
-- Risk-tier your own gates: proceed on cheap-and-reversible; insist on a
-  real decision for irreversible, authority-changing, or spend actions.
-  Gating everything trains the rubber-stamp.
-- Promote only through the policy-resolved gate.
-- Memory proposes. Ledgers authorize. Receipts prove. Audit accounts.
+runtimes.
 
-## When Blocked
+## Operating Rules
 
-- Use the diagnostics verbs before hand-debugging; walk the recovery path
-  from the user's seat before declaring a state recoverable.
-- Escalate with a concrete blocker, not a vibe. Quiet is not a finding.
+- Read the repo state before forming a plan.
+- Use a task envelope before product edits.
+- Keep each session bounded.
+- Write useful runbook notes, not raw transcript dumps.
+- Run validation before returning a receipt.
+- Keep receipts compact and cited.
+- Treat accepted review as different from integrated work.
+- Promote only through the policy-resolved gate.
+- Stop when authority, secrets, scope, or validation are unclear.
 
 ## Identity Split
 
@@ -87,30 +27,54 @@ repo_substrate: source, ledger, receipts, validation, commits
 
 ## Work Boundaries
 
-A seat should know: allowed writes; forbidden writes; validation commands;
-stop conditions; expected receipt; next owner. If any are missing, ask for a
-sharper task. Sessions are for bounded work; restoring a session restores
-context, not authority.
+A seat should know:
+
+- allowed writes;
+- forbidden writes;
+- validation commands;
+- stop conditions;
+- expected receipt;
+- next owner.
+
+If any of those are missing, ask for a sharper task.
+
+## Session Hygiene
+
+Sessions are for bounded work. Restoring a session restores context, not
+authority.
+
+Before a resumed, interrupted, role-swapped, runner-swapped, or cwd-swapped
+session picks up work, rebind it to the current ledger and task surface:
+
+- verify the project, workflow, task, seat, branch, and worktree;
+- verify the routing surface and evidence surface;
+- stop or ignore stale watchers from the old workflow;
+- run readiness only after the rebind is clean.
+
+Rebind applies to every runtime. It keeps Codex, Claude Code, Gemini,
+OpenRouter, local shell, and hosted runners from carrying stale context into the
+wrong repo.
+
+## Review Discipline
+
+Review seats should pressure-test hidden authority changes, missing validation,
+oversized write sets, stale assumptions, unbounded sessions, evidence that
+cannot be reproduced, and claims that should be receipts.
+
+Reviewers contribute evidence. The routed owner mutates truth.
 
 ## Tool Discipline
 
-Chat is conversation, planning tools are intent, code review tools are diffs
-and CI, incident tools are runtime evidence, identity providers are
-authentication. None of them are acceptance.
+Use chat for conversation, planning tools for intent, code review tools for
+diffs and CI, incident tools for runtime evidence, and identity providers for
+authentication.
+
+Do not let any of them become acceptance.
 
 ## Failure Signals
 
 Open a follow-up or stop the run when a seat edits outside allowed writes,
-validation repeatedly fails, the runbook grows without a receipt, a task
-spans unrelated repos, a runtime claims success without evidence, a
-projection disagrees with git, a grant owner is unclear, or an integration
-tries to close or promote work.
-
-## Growing Local Discipline
-
-This document ships the judgment that is true everywhere. Your team's own
-calibration — which seats are strong where, which tools misbehave, which
-routes need a second look — is grown locally: when a correction lands, record
-it as one small note with why and how-to-apply, index it, and re-read it at
-the moment you would otherwise repeat the mistake. Corrections that are never
-recorded are corrections you will pay for twice.
+validation repeatedly fails, the runbook grows without a receipt, a task spans
+unrelated repos, a runtime claims success without evidence, a projection
+disagrees with git, a grant owner is unclear, or an integration tries to close
+or promote work.

package/docs/SEAT_PROVISIONING.md

@@ -1,29 +1,29 @@
 # Seat Provisioning
 
-Start with one project owner and one review seat. Add runtime-specific seats only when a concrete task needs them. Use [LANE_PROVISIONING.md](LANE_PROVISIONING.md) when a manager needs to route active work, park future work, or give a new agent a complete pickup bulletin.
+Start with one project owner. Add review, QA, or runtime-specific seats only when a concrete task needs them. Use [LANE_PROVISIONING.md](LANE_PROVISIONING.md) when a manager needs to route active work, park future work, or give a new agent a complete pickup bulletin.
 
 ## Minimal Flow
 
 1. Install project-local agent guidance with `setup`.
 2. Initialize the project with `bootstrap local`.
 3. Read `AGENTS.md`, `BOARD.md`, `SESSION_PICKUP.md`, and `SEAT_OPERATING_MANUAL.md`.
-4. After resume or runner/model swaps, run `resume check`; otherwise run `whereami`, `doctor`, and `status`.
-5. Confirm the lead and review seats.
-6. Use `$etiquette-seat-lifecycle` before pickup after stale context, resume, runner/model/profile swaps, or workflow migration.
-7. Have the lead seat `join` and `pickup` the first generated task.
-8. Add extra sessions only when starter sessions are not enough.
-9. Give each seat its allowed writes and validation.
-10. Record a receipt before asking for promotion.
+4. Run `whereami`, `doctor`, and `status`.
+5. Confirm the lead seat.
+6. After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor swaps, rerun `whereami`, `doctor`, and `notify poll`.
+7. Treat lifecycle/readiness checks as evidence only; they do not authorize work.
+8. Have the lead seat `join` and `pickup` the first generated task.
+9. Add extra sessions only when starter sessions are not enough.
+10. Give each seat its allowed writes and validation.
+11. Record a receipt before asking for promotion.
 
 ```sh
 etiquette setup --target codex --project "$PWD"
-etiquette bootstrap local --project "$PWD" --profile codex-cc-gemini --task-prefix APP
-etiquette resume check --project "$PWD" --seat codex-seat --task APP-001 --json
-etiquette whereami --project "$PWD" --seat codex-seat --task APP-001
+etiquette bootstrap local --project "$PWD" --task-prefix APP
+etiquette whereami --project "$PWD" --seat impl-seat --task APP-001
 etiquette doctor --project "$PWD"
 etiquette status --project "$PWD"
-etiquette join --project "$PWD" --seat codex-seat
-etiquette pickup --project "$PWD" --seat codex-seat --task APP-001 --text
+etiquette join --project "$PWD" --seat impl-seat
+etiquette pickup --project "$PWD" --seat impl-seat --task APP-001 --text
 etiquette console board --project "$PWD" --text
 ```
 
@@ -34,8 +34,8 @@ Use `control_seat` for local workflow ownership, `execution_seat` for bounded im
 ## Greenfield Setup
 
 ```sh
-etiquette bootstrap local --project "$PWD" --profile codex-cc-gemini --task-prefix FOOD \
-  --lead-seat impl-seat --lead-principal developer-1 --review-seat review-seat --review-principal reviewer-1
+etiquette bootstrap local --project "$PWD" --task-prefix FOOD \
+  --lead-seat impl-seat --lead-principal developer-1
 ```
 
 ```sh
@@ -44,11 +44,7 @@ etiquette join --project "$PWD" --seat impl-seat
 etiquette pickup --project "$PWD" --seat impl-seat --task FOOD-001 --text
 ```
 
-The starter runbook is enough for normal pickup. Use `session create` only when an extra ad hoc session needs a different scope.
-
-The lead seat coordinates. The review seat pressure-tests. Neither gets merge or promotion authority unless policy grants it.
-
-Hooks, readiness, and lifecycle preflight are evidence only. The task envelope and allowed writes remain the active work authority.
+The starter runbook is enough for normal pickup. Use `session create` only when an extra ad hoc session needs a different scope. The lead seat coordinates and implements. Add a review seat with `--profile lead-review` only when someone will actually pressure-test. Neither gets merge or promotion authority unless policy grants it. Hooks, readiness, rebind, and lifecycle preflight are evidence only; the task envelope and allowed writes remain the active work authority.
 
 ## Child Runners
 
@@ -78,7 +74,7 @@ For bounded, cursor-based wake checks on any seat, use the portable core command
 ```sh
 etiquette seat readiness \
   --project "$PWD" \
-  --seat codex-seat \
+  --seat impl-seat \
   --seat-type execution_seat \
   --execution-surface codex \
   --capability-source local_validation \
@@ -97,4 +93,5 @@ Remote execution is a later layer. Plane provisioning is infra-admin scoped. Wor
 - Start with the smallest useful topology.
 - Add seats because work requires them.
 - Product-write authority requires a task, allowed writes, validation, and the right promotion gate.
-- Chat is not canonical record; runtime packs are adapters, not doctrine.
+- Chat is not canonical record.
+- Runtime packs are adapters, not doctrine.

package/docs/TEAM_HANDOFF.md

@@ -17,10 +17,10 @@ package. The CLI lives in the developer's user-local install root.
 
 The manager provides release version, installer URL or path, release base URL
 or local release directory, release public key, project repo or greenfield
-name, lead seat, review seat, and first task prefix.
+name, lead seat, and first task prefix. Provide review or QA seats only when
+the first assignment needs them.
 
-Default starter profile: lead `codex-seat`, review `cc-seat`, bootstrap
-`manager-seat`, task prefix `APP`.
+Default starter profile: solo lead `impl-seat`, task prefix `APP`.
 
 ## Install CLI
 
@@ -100,8 +100,8 @@ git commit -m "chore: baseline empty workspace"
 ## Bootstrap Local Etiquette
 
 ```sh
-etiquette handoff --project "$PWD" --profile codex-cc-gemini --task-prefix APP
-etiquette bootstrap local --project "$PWD" --profile codex-cc-gemini --task-prefix APP
+etiquette handoff --project "$PWD" --task-prefix APP
+etiquette bootstrap local --project "$PWD" --task-prefix APP
 etiquette doctor --project "$PWD"
 etiquette console board --project "$PWD" --text
 ```
@@ -123,38 +123,38 @@ git commit -m "chore: bootstrap etiquette workspace"
 Lead seat:
 
 ```sh
-etiquette whereami --project "$PWD" --seat codex-seat --task APP-001
-etiquette join --project "$PWD" --seat codex-seat
-etiquette pickup --project "$PWD" --seat codex-seat --task APP-001 --text
+etiquette whereami --project "$PWD" --seat impl-seat --task APP-001
+etiquette join --project "$PWD" --seat impl-seat
+etiquette pickup --project "$PWD" --seat impl-seat --task APP-001 --text
 ```
 
-Review seat:
+Optional review seat after bootstrapping with `--profile lead-review`:
 
 ```sh
-etiquette whereami --project "$PWD" --seat cc-seat --task APP-002
-etiquette join --project "$PWD" --seat cc-seat
-etiquette pickup --project "$PWD" --seat cc-seat --task APP-002 --text
+etiquette whereami --project "$PWD" --seat review-seat --task APP-002
+etiquette join --project "$PWD" --seat review-seat
+etiquette pickup --project "$PWD" --seat review-seat --task APP-002 --text
 ```
 
-Inside Codex sessions that have the pickup skill installed:
+If your runtime has an Etiquette pickup skill installed, it should do the same
+read-only sequence as the CLI. The portable form is:
 
 ```sh
-~/.codex/skills/etiquette-seat-pickup/scripts/seat-pickup.sh \
-  --project "$PWD" \
-  --seat codex-seat \
-  --task APP-001 \
-  --etq "$(command -v etiquette)"
+etiquette whereami --project "$PWD" --seat impl-seat --task APP-001
+etiquette doctor --project "$PWD"
+etiquette notify poll --project "$PWD" --seat impl-seat --text
+etiquette pickup --project "$PWD" --seat impl-seat --task APP-001 --text
 ```
 
-The wrapper prints board, feed, inbox, task envelope, and session runbook. It is
-a convenience reader, not authority.
+These are readers, not authority. Interrupted or swapped seats should rerun the
+preflight before pickup; see `docs/WORKTREE_QOL.md`.
 
 ## Local Wake
 
 Seats can refresh their repo-local queue before pickup or review:
 
 ```sh
-etiquette notify poll --project "$PWD" --seat codex-seat --text
+etiquette notify poll --project "$PWD" --seat impl-seat --text
 ```
 
 The queue is a local pointer cache over `.etiquette/events/local.ndjson`. It is

package/docs/WORKTREE_QOL.md

@@ -33,22 +33,23 @@ Agent resume restores conversation context. It does not prove repo context.
 After any resume, run:
 
 ```sh
-etiquette resume check --project "$PWD" --seat <seat> --task <task> --json
 etiquette whereami --project "$PWD" --seat <seat> --task <task>
 git status -sb
 git branch --show-current
 ```
 
-`resume check` is read-only and fail-closed. It treats the runner resume hash as
-conversation context only, then verifies project, seat, task, lifecycle, and
-session bindings before pickup. If it reports `rebind_required`, use the seat
-rebind and lifecycle skills before reading old session runbooks as assignment.
-
 If the runner asks whether to resume in the old session directory or the
 current directory, choose the current directory only when it is the intended
 project worktree for the task. Do not resume a repo-local task inside a global
 coordination repo or unrelated workspace.
 
+## Seat Rebind
+
+After TUI/cmux cutoff, cold restart, role/task change, runner/model/vendor swap,
+or directory ambiguity, verify `whereami --json`, `doctor`, `bus status 8`,
+branch, and worktree before pickup. Then run lifecycle readiness. Rebind grants
+no authority; stale memory is context only.
+
 ## If A Worktree Is Gone
 
 Do not reconstruct from chat. Recreate from Git:

package/docs/contracts/ledger-entry/README.md

@@ -1,7 +1,7 @@
 # Ledger Entry Contracts
 
-This contract keeps the ledger-query-mode work narrow. It hardens the journal first:
-typed ledger entries that later working-loop queries can read without guessing.
+This contract keeps the ledger-query-mode work narrow. It hardens the spine first:
+typed ledger entries that later reflex queries can read without guessing.
 
 It does not ship a ledger query engine, sabbatical dossier engine, capsule
 promotion loop, or remote ledger authority.
@@ -10,7 +10,7 @@ promotion loop, or remote ledger authority.
 
 ```text
 raw local ledger entry
-  -> typed `spine_eligible` metadata
+  -> typed spine-eligible metadata
     -> optional compact projection
       -> later sabbatical capsule only after operator promotion
 ```
@@ -18,12 +18,12 @@ raw local ledger entry
 ## Core Rule
 
 ```text
-The working loop routes the present.
+Reflex routes the present.
 Sabbatical understands the arc.
-Capsules compress the arc back into working-loop context.
+Capsules compress the arc back into reflex context.
 ```
 
-The planner may recommend. The journal may route. Grants authorize. Execution
+The brain may recommend. The spine may route. Grants authorize. Execution
 mutates. Receipts prove. Audit accounts.
 
 ## Contracts
@@ -65,18 +65,18 @@ These names are reserved vocabulary, not V0 machinery:
   search adapters; SQLite FTS5 is the only V0.1 retrieval accelerator.
 - `ledger-topic-dossier.v0` — unlock only when an operator asks for a durable
   long-horizon dossier over a real topic.
-- `sabbatical-ledger-query` — reserved as the deliberate planner posture; it
-  cannot write the working journal directly.
-- `capsule-to-journal-feedback` — unlock only when reviewed capsules have a human
+- `sabbatical-ledger-query` — reserved as the deliberate brain posture; it
+  cannot write the reflex spine directly.
+- `capsule-to-spine-feedback` — unlock only when reviewed capsules have a human
   promotion surface.
 
 Deferred surfaces must name an operational consumer before implementation.
 
 ## Boundary
 
-- The planner cannot write the journal directly. It may produce a capsule or
+- The brain cannot write the spine directly. It may produce a capsule or
   dossier that an operator later promotes.
-- `spine_eligible: true` is explicit; working-loop indexes do not infer eligibility
+- `spine_eligible: true` is explicit; reflex indexes do not infer eligibility
   from entry type.
 - Existing ledger lines remain readable as `pre_v0: true` legacy entries.
 - Ledger entries do not authorize work unless a valid grant path says so.

package/docs/contracts/ledger-entry/ledger-entry.v0.2.md

@@ -9,7 +9,7 @@ does not authorize work, attach grants, close tasks, or replace receipts.
 
 ```text
 The leading timestamp (created_at) is the RECORDING time. It is never
-backdated. If work was done off the journal, it is reconciled with a late
+backdated. If work was done off the spine, it is reconciled with a late
 entry recorded at its true time, pointing at contemporaneous evidence.
 Synthesizing entries with past recording times is corruption, not repair:
 one plausible fake timestamp devalues every real one.
@@ -51,7 +51,7 @@ valid_time_end:
 ## Added Entry Type
 
 `entry_type: retroactive_import` — a late reconciliation entry covering work
-that was executed without contemporaneous journal entries. Rules, enforced by
+that was executed without contemporaneous spine entries. Rules, enforced by
 the validator:
 
 - requires schema `ledger-entry.v0.2` (rejected on v0/v0.1);
@@ -59,7 +59,7 @@ the validator:
 - must carry at least one contemporaneous evidence ref among
   `refs.commits`, `refs.receipts`, or `refs.artifacts` — evidence that
   carries its own independent timestamps (git commits are the canonical
-  evidence anchor);
+  witness);
 - authority class must be `advisory` or `audit` — a late entry never mints
   grants or execution authority;
 - one reconciliation entry covering a span with an index artifact is

package/docs/contracts/ledger-entry/ledger-entry.v0.md

@@ -1,6 +1,6 @@
 # ledger-entry.v0
 
-`ledger-entry.v0` is the typed local ledger record used by the working journal.
+`ledger-entry.v0` is the typed local ledger record used by the reflex spine.
 It makes compact ledger lines structurally queryable without promoting the
 ledger into an authority source.
 
@@ -58,7 +58,7 @@ legacy:
 `authority.class: grant` may set it to `true`, and only when the entry carries
 the durable grant reference required by the local workflow.
 
-`spine_eligible` is explicit. A working-loop index must not infer it from
+`spine_eligible` is explicit. A reflex index must not infer it from
 `entry_type`. Entries that are useful for current-state routing should set it to
 `true`; archival, noisy, or unreviewed entries should set it to `false`.
 
@@ -92,17 +92,17 @@ legacy:
 spine_eligible: false
 ```
 
-## Journal And Planner Boundary
+## Spine And Brain Boundary
 
 ```text
-The working loop routes the present.
+Reflex routes the present.
 Sabbatical understands the arc.
-Capsules compress the arc back into working-loop context.
+Capsules compress the arc back into reflex context.
 ```
 
-The working journal reads typed ledger entries. The sabbatical planner may produce a
-capsule or dossier, but it cannot write back into the journal directly. Promotion
-from capsule to journal requires an explicit operator gate.
+The reflex spine reads typed ledger entries. The sabbatical brain may produce a
+capsule or dossier, but it cannot write back into the spine directly. Promotion
+from capsule to spine requires an explicit operator gate.
 
 ## Authority Boundary
 

package/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@etiquekit/etq",
-  "version": "1.0.12",
-  "license": "Apache-2.0",
+  "version": "1.0.13",
   "description": "Governance and evidence CLI for AI-assisted engineering seats.",
   "private": false,
   "type": "module",
@@ -16,15 +15,16 @@
   },
   "files": [
     "LICENSE",
-    "NOTICE",
     "AGENTS.md",
+    "NOTICE",
     "QuickStart.md",
     "README.md",
     "bin/",
-    "lib/",
     "docs/",
-    "scripts/install.sh",
-    "scripts/uninstall.sh",
+    "packages/control/src/",
+    "packages/protocol/src/",
+    "release/lineage.v0.json",
+    "scripts/",
     "templates/",
     "!docs/work/"
   ],
@@ -35,10 +35,9 @@
     "core:cli": "bun packages/control/src/core-cli.ts",
     "release:scan": "sh scripts/release-scan.sh",
     "release:pack": "sh scripts/release-pack-canary.sh",
+    "release:candidate": "sh scripts/release-candidate-verify.sh",
     "release:checksum": "sh scripts/release-checksum.sh",
-    "release:sign": "sh scripts/release-sign.sh",
-    "release:build": "sh scripts/release-build.sh",
-    "prepack": "sh scripts/release-build.sh"
+    "release:sign": "sh scripts/release-sign.sh"
   },
   "devDependencies": {
     "@types/bun": "^1.2.17",
@@ -48,12 +47,13 @@
     "yaml": "2.8.3",
     "zod": "4.3.6"
   },
+  "license": "Apache-2.0",
   "homepage": "https://etiquekit.com",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/leepickdev/etq.git"
+    "url": "git+https://github.com/leepickdev/etq-devkit.git"
   },
   "bugs": {
-    "url": "https://github.com/leepickdev/etq/issues"
+    "url": "https://github.com/leepickdev/etq-devkit/issues"
   }
 }