@etiquekit/etq 1.0.13 → 1.0.15

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@etiquekit/etq",
-  "version": "1.0.13",
-  "description": "Governance and evidence CLI for AI-assisted engineering seats.",
+  "version": "1.0.15",
+  "license": "Apache-2.0",
+  "description": "Thin local execution plane for Etiquette Core governance contracts.",
   "private": false,
   "type": "module",
   "bin": {
@@ -15,16 +16,15 @@
   },
   "files": [
     "LICENSE",
-    "AGENTS.md",
     "NOTICE",
+    "AGENTS.md",
     "QuickStart.md",
     "README.md",
     "bin/",
+    "lib/",
     "docs/",
-    "packages/control/src/",
-    "packages/protocol/src/",
-    "release/lineage.v0.json",
-    "scripts/",
+    "scripts/install.sh",
+    "scripts/uninstall.sh",
     "templates/",
     "!docs/work/"
   ],
@@ -35,25 +35,26 @@
     "core:cli": "bun packages/control/src/core-cli.ts",
     "release:scan": "sh scripts/release-scan.sh",
     "release:pack": "sh scripts/release-pack-canary.sh",
-    "release:candidate": "sh scripts/release-candidate-verify.sh",
     "release:checksum": "sh scripts/release-checksum.sh",
-    "release:sign": "sh scripts/release-sign.sh"
+    "release:sign": "sh scripts/release-sign.sh",
+    "release:build": "sh scripts/release-build.sh",
+    "prepack": "sh scripts/release-build.sh"
   },
   "devDependencies": {
     "@types/bun": "^1.2.17",
     "typescript": "^5.7.3"
   },
   "dependencies": {
+    "@etiquekit/core": "0.1.0",
     "yaml": "2.8.3",
     "zod": "4.3.6"
   },
-  "license": "Apache-2.0",
   "homepage": "https://etiquekit.com",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/leepickdev/etq-devkit.git"
+    "url": "git+https://github.com/leepickdev/etq.git"
   },
   "bugs": {
-    "url": "https://github.com/leepickdev/etq-devkit/issues"
+    "url": "https://github.com/leepickdev/etq/issues"
   }
 }

package/templates/etiquette-vanilla-v0/README.md

@@ -11,7 +11,7 @@ default_surface:
 ```
 
 It does not create runtime seats, product repos, backplanes, hosted services, dashboards, or sample products.
-It starts local and unauthenticated. Seat identity, readiness, and task authority stay in the local workflow records.
+It starts unauthenticated: `workspace-secure-profile.v0` is `open`, with upgrade paths for `screening-warn`, `screening-enforced`, and `enterprise-reactor`.
 
 ## Quick Start
 
@@ -23,6 +23,7 @@ sh /tmp/etiquette-start/validate-vanilla.sh
 ```
 
 The first person who claims the stamped `control-seat` reports readiness before assigning work.
+For restricted seats, change the secure profile, add provider-derived policy/claims, then run `sh source/control-seat/bin/access-assurance-check`.
 
 ## Local Receipt Proof
 
@@ -54,7 +55,7 @@ cannot:
   - clone product repos before assignment
   - bypass validation
   - treat chat as evidence
-  - grant authority from local profile metadata
+  - grant access from the secure profile or reactor
 ```
 
 Provision these later only after the control seat grants them:

package/templates/etiquette-vanilla-v0/source/control-seat/README.md

@@ -8,3 +8,9 @@ For local-only proof, append events with `bin/local-event` and compact them with
 
 Inside a live runtime session, run `bin/session-init` after `bin/seat-init`
 to prepare the local ledger, receipts, tasks, outbox, and session state.
+
+Access assurance is explicit and optional. The default profile is
+`docs/work/access/workspace-secure-profile.v0.json` with `mode: open`. Run
+`bin/access-assurance-check` before routing restricted seats, and switch to
+`screening-warn`, `screening-enforced`, or `enterprise-reactor` only when the
+workspace actually needs provider-backed screening.

package/templates/etiquette-vanilla-v0/source/control-seat/bin/access-assurance-check

@@ -0,0 +1,55 @@
+#!/bin/sh
+set -eu
+
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+PROFILE="$ROOT/docs/work/access/workspace-secure-profile.v0.json"
+POLICY="$ROOT/docs/work/access/seat-access-policy.v0.json"
+CLAIMS="$ROOT/docs/work/access/access-assurance-claims.v0.json"
+
+json_string_field() {
+  sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p" "$1" | head -n 1
+}
+
+json_bool_field() {
+  sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\\(true\\|false\\).*/\\1/p" "$1" | head -n 1
+}
+
+if [ ! -f "$PROFILE" ]; then
+  echo "access-assurance: fail missing docs/work/access/workspace-secure-profile.v0.json" >&2
+  exit 1
+fi
+
+mode=$(json_string_field "$PROFILE" mode)
+case "$mode" in
+  open|screening-warn|screening-enforced|enterprise-reactor) ;;
+  *)
+    echo "access-assurance: fail invalid mode=${mode:-missing}" >&2
+    exit 1
+    ;;
+esac
+
+if [ "$mode" = "open" ]; then
+  echo "access-assurance: pass mode=open policy=not-required"
+  exit 0
+fi
+
+if [ ! -f "$POLICY" ] || [ ! -f "$CLAIMS" ]; then
+  message="access-assurance: missing policy or claims for mode=$mode"
+  if [ "$mode" = "screening-warn" ]; then
+    echo "$message"
+    exit 0
+  fi
+  echo "$message" >&2
+  exit 1
+fi
+
+if [ "$mode" = "enterprise-reactor" ]; then
+  tighten_only=$(json_bool_field "$PROFILE" tighten_only)
+  reactor_can_grant=$(json_bool_field "$PROFILE" reactor_can_grant_or_loosen_access)
+  if [ "$tighten_only" != "true" ] || [ "$reactor_can_grant" != "false" ]; then
+    echo "access-assurance: fail enterprise-reactor requires tighten_only=true and reactor_can_grant_or_loosen_access=false" >&2
+    exit 1
+  fi
+fi
+
+echo "access-assurance: pass mode=$mode"

package/templates/etiquette-vanilla-v0/source/control-seat/bin/seat-doctor

@@ -5,11 +5,16 @@ ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 
 test -f "$ROOT/.llm-substrate/HANDOFF.md"
 test -f "$ROOT/docs/work/ledger/LEDGER.md"
+test -f "$ROOT/docs/work/access/workspace-secure-profile.v0.json"
+test -f "$ROOT/docs/work/access/ACCESS-ASSURANCE.md"
 test -f "$ROOT/docs/work/playbacks/PLAYBACK_TEMPLATE.md"
 test -f "$ROOT/docs/work/tasks/CONTROL-001.yaml"
 test -d "$ROOT/docs/work/receipts"
+test -f "$ROOT/bin/access-assurance-check"
 test -f "$ROOT/bin/session-init"
 test -f "$ROOT/bin/local-event"
 test -f "$ROOT/bin/compact-local-events"
 
+sh "$ROOT/bin/access-assurance-check" >/dev/null
+
 echo "control-seat: ok"

package/templates/etiquette-vanilla-v0/source/control-seat/docs/work/access/ACCESS-ASSURANCE.md

@@ -0,0 +1,39 @@
+# Access Assurance
+
+The vanilla control seat starts in `open` mode. That keeps Etiquette usable as a
+local-first workflow kit without authentication, screening, hosted services, or
+a daemon.
+
+The workspace mode lives in `workspace-secure-profile.v0.json`.
+
+Modes:
+
+- `open`: no access-assurance gate is required.
+- `screening-warn`: restricted-seat policy and claims are checked, but failures
+  warn instead of blocking.
+- `screening-enforced`: restricted seats fail closed when policy or claims are
+  missing, expired, revoked, or not provider-backed.
+- `enterprise-reactor`: `screening-enforced` plus an optional tighten-only
+  daemon for revocation sync, badge refresh, kill-switch writes, and outbox
+  drain.
+
+The reactor may tighten access only. It must not grant access, authorize
+actions, close work, merge, or rewrite the ledger.
+
+Provider-backed secure deployments should keep raw identity material outside the
+repo:
+
+```text
+Persona / Scandit / SSO -> Supabase derived claims -> local access check
+```
+
+Repo-safe fields are provider refs, status, policy eligibility class, evidence
+hash, expiry, and audit timestamps. Passport images, document photos, full
+document numbers, ethnicity, provider secrets, and raw webhook payloads do not
+belong in Git.
+
+Check the mode:
+
+```sh
+sh bin/access-assurance-check
+```

package/templates/etiquette-vanilla-v0/source/control-seat/docs/work/access/workspace-secure-profile.v0.json

@@ -0,0 +1,53 @@
+{
+  "schema": "workspace-secure-profile.v0",
+  "workspace_id": "vanilla-control-seat",
+  "mode": "open",
+  "allowed_modes": [
+    "open",
+    "screening-warn",
+    "screening-enforced",
+    "enterprise-reactor"
+  ],
+  "mode_meanings": {
+    "open": "No access-assurance gate is required. Etiquette core remains local and unauthenticated.",
+    "screening-warn": "Restricted-seat claims are checked and reported, but missing or failed claims do not block local entry.",
+    "screening-enforced": "Restricted-seat claims are required before routing or entering restricted seats.",
+    "enterprise-reactor": "screening-enforced plus an optional tighten-only reactor for revocation sync, badge refresh, kill-switch writes, and outbox drain."
+  },
+  "identity_model": {
+    "authenticate": "operator_principals",
+    "assign_to": "seat_ids",
+    "authorize": "per_action_grants",
+    "workspace_role": "policy_scope",
+    "linear_role": "external_backlog_projection_only"
+  },
+  "claim_source": {
+    "kind": "none-required-for-open-mode",
+    "live_replacement": "Supabase Auth plus derived Persona and Scandit claim export",
+    "raw_pii_allowed_in_repo": false
+  },
+  "reactor": {
+    "required_for_mode": "enterprise-reactor",
+    "default_enabled": false,
+    "tighten_only": true,
+    "may_write": [
+      "kill_switch_entries",
+      "expired_assurance_markers",
+      "badge_refresh_cache",
+      "sync_outbox"
+    ],
+    "must_not": [
+      "grant_access",
+      "close_work",
+      "merge",
+      "rewrite_ledger",
+      "authorize_actions"
+    ]
+  },
+  "authority_boundary": {
+    "profile_can_authorize_work": false,
+    "profile_can_grant_seat": false,
+    "profile_can_merge_or_close": false,
+    "reactor_can_grant_or_loosen_access": false
+  }
+}

package/templates/etiquette-vanilla-v0/validate-vanilla.sh

@@ -7,17 +7,22 @@ test -f "$ROOT/README.md"
 test -d "$ROOT/source/etiquette-kernel"
 test -d "$ROOT/source/control-seat"
 grep -Fq ".etiquette/events/*.ndjson" "$ROOT/source/control-seat/.gitignore"
+grep -q '"schema": "workspace-secure-profile.v0"' "$ROOT/source/control-seat/docs/work/access/workspace-secure-profile.v0.json"
+grep -q '"mode": "open"' "$ROOT/source/control-seat/docs/work/access/workspace-secure-profile.v0.json"
+grep -q "enterprise-reactor" "$ROOT/source/control-seat/docs/work/access/ACCESS-ASSURANCE.md"
 grep -q "Controlled drills require one operator approval per drill" "$ROOT/source/etiquette-kernel/contracts/playback.v0.md"
 grep -q "batch_approval_allowed: false" "$ROOT/source/control-seat/docs/work/playbacks/PLAYBACK_TEMPLATE.md"
 
 sh "$ROOT/source/etiquette-kernel/bin/kernel-doctor"
 sh "$ROOT/source/control-seat/bin/seat-doctor"
+sh "$ROOT/source/control-seat/bin/access-assurance-check" | grep -q "mode=open"
 
 tmp_root=$(mktemp -d "${TMPDIR:-/tmp}/etiquette-vanilla-compact.XXXXXX")
 trap 'rm -rf "$tmp_root"' EXIT
 
 cp -R "$ROOT/source/control-seat/." "$tmp_root/control-seat/"
 sh "$tmp_root/control-seat/bin/seat-init" --execution-seat control-seat >/dev/null
+sh "$tmp_root/control-seat/bin/access-assurance-check" | grep -q "mode=open"
 sh "$tmp_root/control-seat/bin/session-init" --task-id SESSION-INIT --operator local-operator >/tmp/session-init.out
 test -f "$tmp_root/control-seat/.etiquette/state/session.json"
 grep -q "session_opened" "$tmp_root/control-seat/docs/work/ledger/LEDGER.md"

package/templates/hosted-receiver/README.md

@@ -0,0 +1,41 @@
+# Hosted Receiver Templates
+
+Opt-in templates for teams that want to expose Etiquette's W1 GitHub webhook
+receiver behind their own hosting layer.
+
+## W1 GitHub Receiver
+
+`w1-github-webhook-receiver.mjs` is a small Node HTTP server:
+
+- `GET /health` returns a readiness probe.
+- `POST /github` accepts GitHub `ping` and `push` webhook deliveries.
+- `ping` returns `200` only after the delivery is signature-verified.
+- `push` delegates to `etiquette notify webhook github`.
+- raw payloads are written only to a temporary file for the CLI call, then
+  removed.
+- emitted records stay pointer-only and authority-false.
+
+Run it with:
+
+```sh
+export ETIQUETTE_GITHUB_WEBHOOK_SECRET='<webhook-secret>'
+export ETIQUETTE_CLI='etiquette'
+node w1-github-webhook-receiver.mjs
+```
+
+Optional:
+
+```sh
+export PORT=8080
+export ETIQUETTE_WAKE_OUT_DIR=/var/lib/etiquette/wake
+```
+
+`ETIQUETTE_WAKE_OUT_DIR` stores only the verified pointer output, never the raw
+webhook body.
+
+## Boundary
+
+This template does not create a public endpoint, register repository webhooks,
+provision cloud infrastructure, start remote execution, or grant authority. Host
+selection, webhook registration, secret rotation, and retention policy remain
+operator decisions.

package/templates/hosted-receiver/w1-github-webhook-receiver.mjs

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+import { createServer } from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const port = Number(process.env.PORT || '8080');
+const etiquetteCli = process.env.ETIQUETTE_CLI || 'etiquette';
+const secret = process.env.ETIQUETTE_GITHUB_WEBHOOK_SECRET;
+const outDir = process.env.ETIQUETTE_WAKE_OUT_DIR || '';
+
+if (!secret) throw new Error('ETIQUETTE_GITHUB_WEBHOOK_SECRET is required');
+
+function readRaw(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', reject);
+  });
+}
+
+function writeJson(res, status, value) {
+  res.writeHead(status, {
+    'content-type': 'application/json',
+    'cache-control': 'no-store',
+  });
+  res.end(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function publicRecord(record) {
+  return {
+    ok: true,
+    schema: record.schema,
+    event: record.event,
+    delivery_id: record.delivery_id,
+    repository: record.repository.full_name,
+    ref: record.ref || null,
+    after: record.after || null,
+    signature_verified: record.transport.signature_verified,
+    pointers_only: record.payload_boundary.pointers_only,
+    notification_is_authority: record.authority_boundary.notification_is_authority,
+    next_action: record.next_action,
+  };
+}
+
+async function verifyDelivery(req, event, delivery, signature) {
+  const raw = await readRaw(req);
+  const payloadPath = join(tmpdir(), `etiquette-webhook-${delivery}-${randomUUID()}.json`);
+  writeFileSync(payloadPath, raw);
+  try {
+    const result = spawnSync(etiquetteCli, [
+      'notify',
+      'webhook',
+      'github',
+      '--payload',
+      payloadPath,
+      '--delivery',
+      delivery,
+      '--event',
+      event,
+      '--signature-256',
+      signature,
+      '--json',
+    ], {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        ETIQUETTE_GITHUB_WEBHOOK_SECRET: secret,
+      },
+    });
+    if (result.status !== 0) {
+      return {
+        ok: false,
+        status: 401,
+        body: {
+          ok: false,
+          error: 'signature_or_payload_rejected',
+          detail: result.stderr.trim().slice(0, 200),
+        },
+      };
+    }
+    const record = JSON.parse(result.stdout);
+    if (outDir) {
+      mkdirSync(outDir, { recursive: true });
+      writeFileSync(join(outDir, 'latest.json'), `${JSON.stringify(record, null, 2)}\n`);
+      writeFileSync(join(outDir, `${delivery}.json`), `${JSON.stringify(record, null, 2)}\n`);
+    }
+    return { ok: true, status: 200, body: publicRecord(record) };
+  } finally {
+    rmSync(payloadPath, { force: true });
+  }
+}
+
+const server = createServer(async (req, res) => {
+  try {
+    if (req.method === 'GET' && req.url === '/health') {
+      writeJson(res, 200, { ok: true, authority: false });
+      return;
+    }
+    if (req.method !== 'POST' || req.url !== '/github') {
+      writeJson(res, 404, { ok: false, error: 'not_found' });
+      return;
+    }
+
+    const event = String(req.headers['x-github-event'] || '');
+    const delivery = String(req.headers['x-github-delivery'] || randomUUID());
+    const signature = String(req.headers['x-hub-signature-256'] || '');
+    if (event !== 'push' && event !== 'ping') {
+      writeJson(res, 400, { ok: false, error: 'unsupported_event', event });
+      return;
+    }
+    if (!signature.startsWith('sha256=')) {
+      writeJson(res, 401, { ok: false, error: 'missing_signature' });
+      return;
+    }
+
+    const result = await verifyDelivery(req, event, delivery, signature);
+    writeJson(res, result.status, result.body);
+  } catch (error) {
+    writeJson(res, 500, { ok: false, error: String(error?.message || error) });
+  }
+});
+
+server.listen(port, '0.0.0.0', () => {
+  console.log(`etiquette_w1_receiver: listening on ${port}`);
+});

package/templates/seat-packs-v0/README.md

@@ -62,9 +62,8 @@ project head-start surfaces before pickup:
 - `docs/work/manuals/SEAT_OPERATING_MANUAL.md`
 - `docs/work/cookbooks/ADD_A_LANE.md` when routing work
 
-After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor
-swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup.
-Lifecycle/readiness checks are evidence only; they do not authorize work.
+Re-orient with `etiquette whereami` before pickup after stale context, resume,
+runner/model/profile swaps, or workflow migration.
 
 ## Validate Catalog
 

package/templates/seat-packs-v0/source/claude-code-seat/README.md

@@ -14,6 +14,6 @@ Before pickup in the target project, read:
 4. `docs/work/manuals/SEAT_OPERATING_MANUAL.md`
 5. `docs/work/cookbooks/ADD_A_LANE.md` when routing new work
 
-After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor
-swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup. Hooks and
-readiness are evidence only; the task envelope is the work authority.
+Re-orient with `etiquette whereami` before pickup after stale context, resume,
+runner/model/profile swaps, or workflow migration. Hooks and readiness are
+evidence only; the task envelope is the work authority.

package/templates/seat-packs-v0/source/codex-seat/README.md

@@ -14,9 +14,9 @@ Before pickup in the target project, read:
 4. `docs/work/manuals/SEAT_OPERATING_MANUAL.md`
 5. `docs/work/cookbooks/ADD_A_LANE.md` when routing new work
 
-After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor
-swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup. Hooks and
-readiness are evidence only; the task envelope is the work authority.
+Re-orient with `etiquette whereami` before pickup after stale context, resume,
+runner/model/profile swaps, or workflow migration. Hooks and readiness are
+evidence only; the task envelope is the work authority.
 
 For bounded, cursor-based wake checks use the portable core command
 `etiquette notify poll --seat <id> --after-seq <n>` instead of raw `tail -F` monitors.

package/templates/seat-packs-v0/source/gemini-seat/README.md

@@ -14,6 +14,6 @@ Before pickup in the target project, read:
 4. `docs/work/manuals/SEAT_OPERATING_MANUAL.md`
 5. `docs/work/cookbooks/ADD_A_LANE.md` when routing new work
 
-After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor
-swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup. Hooks and
-readiness are evidence only; the task envelope is the work authority.
+Re-orient with `etiquette whereami` before pickup after stale context, resume,
+runner/model/profile swaps, or workflow migration. Hooks and readiness are
+evidence only; the task envelope is the work authority.

package/templates/seat-packs-v0/source/ollama-seat/README.md

@@ -14,6 +14,6 @@ Before pickup in the target project, read:
 4. `docs/work/manuals/SEAT_OPERATING_MANUAL.md`
 5. `docs/work/cookbooks/ADD_A_LANE.md` when routing new work
 
-After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor
-swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup. Hooks and
-readiness are evidence only; the task envelope is the work authority.
+Re-orient with `etiquette whereami` before pickup after stale context, resume,
+runner/model/profile swaps, or workflow migration. Hooks and readiness are
+evidence only; the task envelope is the work authority.

package/templates/seat-packs-v0/source/openrouter-seat/README.md

@@ -14,6 +14,6 @@ Before pickup in the target project, read:
 4. `docs/work/manuals/SEAT_OPERATING_MANUAL.md`
 5. `docs/work/cookbooks/ADD_A_LANE.md` when routing new work
 
-After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor
-swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup. Hooks and
-readiness are evidence only; the task envelope is the work authority.
+Re-orient with `etiquette whereami` before pickup after stale context, resume,
+runner/model/profile swaps, or workflow migration. Hooks and readiness are
+evidence only; the task envelope is the work authority.

package/docs/CONCEPT_STATUS.md

@@ -1,66 +0,0 @@
-# Concept Status Matrix
-
-Etiquette uses a few strong workflow concepts. Some are core behavior today,
-some belong to the optional secure plane, and some are still operating patterns
-that need a concrete consumer before they become default workflow.
-
-Use this page when writing portal copy, onboarding material, release notes, or
-manager runbooks. Do not promote a concept beyond the status shown here.
-
-## Edition Boundary
-
-| Surface | Purpose | Authority Posture |
-| --- | --- | --- |
-| Etiquette Core | Repo-local coordination, task envelopes, receipts, allowed writes, read models, manuals, and canaries. | Transparent by default; authority comes from tracked task/grant records and receipts. |
-| Etiquette Secure | Restricted-seat admission, external assurance claims, revocation, policy state, and optional tightening reactor. | Tightens standing and eligibility; it must not grant workflow authority by itself. |
-| Hosted/portal plane | Setup passes, workspace visibility, onboarding, board/read-model display, and operational observability. | Portal RBAC authorizes portal operations only. Workflow authority stays local and grant-backed. |
-
-## Concept Matrix
-
-| Concept | Core Status | Secure Status | Portal Surface | Caveat |
-| --- | --- | --- | --- | --- |
-| Ledger | Shipped. Repo-local task records, events, and receipts carry durable workflow truth. | May receive signed or protected replication later. | Board and console render ledger-derived read models. | Git-backed truth is durable and auditable; call it cryptographic only when signing/protected append-only is actually configured. |
-| Receipts | Shipped. Work returns must cite changed files, validation, blockers, and next owner. | May include action authorization stamps and external verifier receipts. | Evidence drawers and manager views point to receipts. | A receipt proves evidence; it does not grant, merge, close, or promote by itself. |
-| Seats and agents | Shipped. A seat is a stable responsibility; an occupant/runtime can change. Owner cards derive accountability, diet, boundaries, review cadence, and failure modes from source contracts plus live readiness. | Secure posture is parked; seats use local readiness and explicit task routing. | Roster and owner cards show lifecycle, readiness, ownership, and posture. | Model cards, owner cards, and roster posture help routing but do not authorize work or transfer ownership. |
-| Task envelopes | Shipped. Tasks declare owner, mode, allowed writes, forbidden writes, validation, stop conditions, and receipt expectations. | Secure admission is parked; task routing remains explicit. | Manager manuals and pickup surfaces show the envelope. | Allowed writes are a cooperative boundary unless paired with OS/container enforcement or audit gates. |
-| Rubrics and validation | Shipped as acceptance criteria and conformance gates. | Can be bound to restricted workflows and verifier receipts. | Manager/operator docs list required validation and stop conditions. | Do not claim every runtime is hard-blocked from returning unless the specific flow enforces that gate. |
-| Authorization | Shipped as grant-backed workflow discipline: authentication seats an actor; authorization gates consequential action. | Secure posture is parked; grant leases, kill-switch state, and action stamps remain the admission-time authority model. | Hosted pass docs and workspace authority contracts describe the boundary. | A verified occupant has standing, not blanket authority. Grants are effective only while standing is current. |
-| Portal / management console | Core read model, docs site, screenshots, and read-only `console serve` are shipped. | Secure portal may manage policy state and revocation signals. | Console and board are read-only by default. | Portal RBAC is not workflow authority. Browser actions remain out of scope in Core. |
-| Distribution and plugins | Core CLI, docs, templates, MCP resources/prompts, and outbox-backed proposal staging are portable. | Secure can ship as an optional add-on. | Codex and Claude Code plugins may launch workflows and portal views. | Plugins are convenience packaging, not authority. MCP proposal tools must not mutate the ledger directly. |
-| Remote execution | Supported as evidence-first design. | Secure runtimes may require admission, revocation, and verifier identity before execution. Org-remote workspaces use session outboxes, sharded drains, candidate imports, and authority promotion gates. | Manager docs should treat remote receipts as evidence. | Start remote as witness, not worker. Remote receipts and drain imports do not authorize promotion. |
-| Managed-agent parity | Parity map exists for agents, environments, sessions, events, tools, MCP, memory, outcomes, and scheduling. | Secure runtime admission is parked. | Docs site and portal docs may expose the map. | Compatibility is not dependency. The runner executes; Etiquette governs and records. |
-| Architecture boundary | Core, runtime, harness, adapter, and reactor roles are documented and import-boundary tested. | Secure adds admission policy without forking doctrine. | Hosted consumes projected views without becoming authority. | New reverse imports are architectural changes, not convenience edits. |
-| Memory | Shipped as cited context, filesystem-shaped candidate stores, SQLite FTS recall, and `memory status` capability reporting. Evidence consolidation/rollup is the memory compaction lifecycle; it is not doctrine marination. | Secure deployments may restrict what crosses org/workspace boundaries. | Docs may surface references, summaries, archive pointers, and shipped/reserved memory status. | Memory proposes; ledger authorizes. Do not claim full semantic/vector memory parity until the adapter ships. Do not rewrite shared truth through background consolidation. |
-| Marination | Operating pattern. Use for doctrine sabbaticals: scheduled fresh-attention review of rules, errata, and proposed revisions. | Can be run under Secure as an advisory process with cited evidence. | Not yet a default portal workflow. | Deltas only. It produces proposals, not silent lane mutations. |
-| Sabbaticals / parking | Partially reflected as `park`, `held`, and deferred dispositions. | Secure deployments may freeze standing or grants while work is parked. | Manager cadence can show parked/held work. | Do not promise automatic stash/cleanup unless the workspace implements that runbook. |
-| Tightening reactor | Not part of default Core. | Optional off-by-default listener that writes only fail-closed signals such as revocation or kill-switch state. | Secure operations may show reactor health. | It may tighten, never loosen. If it stops, local admission still fails or proceeds from last known policy according to the configured gate. |
-
-## Primitive Loop
-
-Core records, validates, gates, and dispatches. Full remembers, consolidates,
-marinates, and projects. Execution is not the gate: Core execution is the local
-shell/worktree, Full execution is a runtime cell or managed runner, and both
-remain authority-false until the promotion gate accepts evidence.
-
-| Layer | Core | Full |
-| --- | --- | --- |
-| Record | identity, seats, task envelopes, session runbooks, ledger, receipts | memory stores, recall capsules, org/workspace projections |
-| Reflect | rubrics, local validation, reconciliation by review | consolidation rollups, marination, drift and failure trend review |
-| Gate | human/Git promotion gate over receipts and grants | same gate, enriched by secure admission and policy checks |
-| Execute | local shell, local worktree, local runner | runtime cells, EKS/kind sandboxes, managed runners |
-| Act | dispatch, receipt return, next-owner routing | hosted portal views, observability, adapter projections |
-
-## Writing Rule
-
-Use shipped language for shipped behavior, design language for parked behavior,
-and edition language for Secure behavior:
-
-```text
-Core records, validates, gates, and dispatches.
-Full remembers, consolidates, marinates, and projects.
-Secure admits and revokes restricted standing.
-Portals display and coordinate.
-Grants authorize consequential actions.
-Receipts prove what happened.
-Execution returns evidence; it never mints authority.
-```