@etiquekit/etq 1.0.14 → 1.0.16

package/docs/RELEASE_SURFACE_AUDIT.md

@@ -34,7 +34,6 @@ docs_default:
   - docs/ARCHITECTURE.md
   - docs/CODEX_CLIENT_COMPATIBILITY.md
   - docs/CONCEPTS.md
-  - docs/CONCEPT_STATUS.md
   - docs/CORE_PROFILE.md
   - docs/LANE_PROVISIONING.md
   - docs/SEAT_DISCIPLINE.md
@@ -91,10 +90,10 @@ internal_templates:
   posture: excluded from new-seat onboarding
 
 package_surface:
-  npm_pack_entries: 183
+  npm_pack_entries: 182
   max_budget: 190
   posture: local devkit package plus signed user-local installer
-  distribution_origin: https://etiquekit.com
+  distribution_origin: https://etiquette.example.com
   excludes: workspace package metadata, workspace fixtures, internal, conformance, apps, site, dist, hosted parity docs, portal docs, root kernel manuals
 ```
 
@@ -113,7 +112,7 @@ required:
 ## What Is Not Necessary For All Developers
 
 Runtime seat packs, sample-product rehearsals, v3 workflow helper docs, satellite
-operator docs, advisory-signal experiments, and internal
+operator docs, supervision phase docs, advisory-signal experiments, and internal
 templates may remain in the repo for maintainers. The default onboarding path
 must not require them.
 
@@ -126,7 +125,7 @@ blocked:
   - personal absolute paths
   - local username markers
   - old repo name
-  - shop identity markers in the release rollout package
+  - shop-persona markers in the release rollout package
   - prior-run markers in all-developer docs
   - extra files under docs/
   - unexpected public template directories
@@ -142,7 +141,7 @@ npm run release:scan
 
 ## Package Readiness Check
 
-Use `etiquette release readiness --json` before changing distribution settings. It also binds the canonical package identity, version floor, source-shipping mode, required bins, source ancestry, public distribution repository, and candidate verifier to `release/lineage.v0.json`; the source-of-record and public package home remain separate, explicit lineage fields. `release:candidate` preserves the exact verified tarball and checksum under ignored `dist/` for later signing without rebuilding.
+Use `etiquette release readiness --json` before changing distribution settings. It reports private-package, files allowlist, pack-canary, checksum/signature, shell-installer presence, pinned public-key bootstrap support, Codex compatibility, and wrapper gaps; it cannot publish, flip `private`, update Codex, or create a channel.
 Codex-backed remote-runtime, plugin-MCP, and hook/action-auth canaries require CLI `0.141.0`+ (`docs/CODEX_CLIENT_COMPATIBILITY.md`). GA additionally runs `etiquette release ga-readiness --channel shell-installer,npm --tag-free-confirmed --json`; it requires a non-prerelease version, final tarball checksums, trusted RSA signature, private-compatible channels, and explicit remote-tag uniqueness confirmation, while still unable to publish, sign, tag, or create a channel. Git source archives must exclude maintainer-only `internal/`, `conformance/`, `site/`, `fixtures/`, `apps/`, local state, and `dist/`.
 
 ## Local-Thin Purge (v0.2.1)
@@ -151,6 +150,6 @@ Codex-backed remote-runtime, plugin-MCP, and hook/action-auth canaries require C
 excluded_cli_commands: [remote, agent-plane, mcp, parity, linear, integration]  # guarded stubs explain absence
 excluded_source_dirs: [agent-plane/, integration/, linear/, mcp/]  # parity/ ships (console dependency)
 excluded_templates: [hosted-receiver/]
-removed_from_templates: [etiquette-seat-rebind etiquette-seat-lifecycle etiquette-monitor-pull]  # use CLI-native preflight and `etiquette notify poll`
-doctrine: local feature parity ships in the devkit; remote/hosted/EKS surfaces ship outside this devkit; zero coordination-bus coupling ships
+removed_from_templates: [codex-seat etiquette-monitor-pull]  # use `etiquette notify poll`
+doctrine: local set stays thin and provider-neutral; remote/hosted surfaces are source-only until remote lanes open; zero coordination-bus coupling ships
 ```

package/docs/SEAT_DISCIPLINE.md

@@ -1,19 +1,79 @@
 # Seat Discipline
 
 Seat discipline keeps agent work useful, attributable, and portable across
-runtimes.
+runtimes. Mechanics say what to do; discipline says when to distrust yourself.
+It is organized by moment of need, not by topic.
+
+## On Wake
+
+- Orient before acting: `whereami`, then the task envelope, then the runbook.
+- Read tiered: status line first, then the exact entry, then the full
+  artifact. Never bulk-load directories for "context" — load the specific
+  receipt you were pointed to.
+
+## Before Claiming Anything
+
+- Verify at claim time: re-read the source at the moment you assert it,
+  never from memory of an earlier read. A cited manifest or spec is read in
+  the same act as the claim.
+- Check the live tip, not your notes: logs and board notes lag integrations.
+- When another seat or a human holds the ground truth, ask — do not
+  solo-reconstruct their state.
+
+## Before Writing
+
+- Read the machine fields, not the title: the envelope's mode and allowed
+  writes decide what a task may do; prose is not authority.
+- Search the exact target surface before classifying work as new — most
+  "add X" tasks are "finish the X that half-exists."
+- One writer per canonical mutation. Design in parallel; mutate single-file.
+
+## While Working
+
+- Technical register on the record: schemas, fields, commands, refs.
+  Metaphor and personality stay in chat; the record is for the next reader.
+- No person or vendor names in artifacts. Attribute external material at the
+  moment of incorporation, with license.
+- One meaningful update per note, reader-resolvable without tooling. Write
+  runbook notes, not raw transcript dumps.
+
+## Before Returning
+
+- Receipt first: outcome, changed files, validation command and result,
+  blockers, next owner. No raw logs — cite paths to them.
+- Run validation before returning the receipt. A red validation is reported
+  red; "done" without proof is a defect, not a return.
+- If your change altered a source shape, refresh its recorded evidence in
+  the same commit.
+- Run post-commit hygiene (`git diff --check HEAD~..HEAD`) — pre-commit
+  checks miss freshly added files.
+
+## On Review
+
+- Verify the shipped artifact, not the branch state you remember.
+- Reviews return evidence, never authority: confirm, counter, or advise.
+  A reviewer packet does not mutate the lane it reviews.
+- Accepted review is different from integrated work.
+- Proposals carry their own counter-arguments and open questions — invite
+  the pressure test.
+
+## At Authority Edges
+
+- Stop when authority is unclear, validation cannot run, writes would exceed
+  the envelope, a secret appears, or the session is unbounded.
+- Never claim work was authorized without decision language from the
+  authority holder. Enthusiasm is not routing.
+- Risk-tier your own gates: proceed on cheap-and-reversible; insist on a
+  real decision for irreversible, authority-changing, or spend actions.
+  Gating everything trains the rubber-stamp.
+- Promote only through the policy-resolved gate.
+- Memory proposes. Ledgers authorize. Receipts prove. Audit accounts.
 
-## Operating Rules
+## When Blocked
 
-- Read the repo state before forming a plan.
-- Use a task envelope before product edits.
-- Keep each session bounded.
-- Write useful runbook notes, not raw transcript dumps.
-- Run validation before returning a receipt.
-- Keep receipts compact and cited.
-- Treat accepted review as different from integrated work.
-- Promote only through the policy-resolved gate.
-- Stop when authority, secrets, scope, or validation are unclear.
+- Use the diagnostics verbs before hand-debugging; walk the recovery path
+  from the user's seat before declaring a state recoverable.
+- Escalate with a concrete blocker, not a vibe. Quiet is not a finding.
 
 ## Identity Split
 
@@ -27,54 +87,30 @@ repo_substrate: source, ledger, receipts, validation, commits
 
 ## Work Boundaries
 
-A seat should know:
-
-- allowed writes;
-- forbidden writes;
-- validation commands;
-- stop conditions;
-- expected receipt;
-- next owner.
-
-If any of those are missing, ask for a sharper task.
-
-## Session Hygiene
-
-Sessions are for bounded work. Restoring a session restores context, not
-authority.
-
-Before a resumed, interrupted, role-swapped, runner-swapped, or cwd-swapped
-session picks up work, rebind it to the current ledger and task surface:
-
-- verify the project, workflow, task, seat, branch, and worktree;
-- verify the routing surface and evidence surface;
-- stop or ignore stale watchers from the old workflow;
-- run readiness only after the rebind is clean.
-
-Rebind applies to every runtime. It keeps Codex, Claude Code, Gemini,
-OpenRouter, local shell, and hosted runners from carrying stale context into the
-wrong repo.
-
-## Review Discipline
-
-Review seats should pressure-test hidden authority changes, missing validation,
-oversized write sets, stale assumptions, unbounded sessions, evidence that
-cannot be reproduced, and claims that should be receipts.
-
-Reviewers contribute evidence. The routed owner mutates truth.
+A seat should know: allowed writes; forbidden writes; validation commands;
+stop conditions; expected receipt; next owner. If any are missing, ask for a
+sharper task. Sessions are for bounded work; restoring a session restores
+context, not authority.
 
 ## Tool Discipline
 
-Use chat for conversation, planning tools for intent, code review tools for
-diffs and CI, incident tools for runtime evidence, and identity providers for
-authentication.
-
-Do not let any of them become acceptance.
+Chat is conversation, planning tools are intent, code review tools are diffs
+and CI, incident tools are runtime evidence, identity providers are
+authentication. None of them are acceptance.
 
 ## Failure Signals
 
 Open a follow-up or stop the run when a seat edits outside allowed writes,
-validation repeatedly fails, the runbook grows without a receipt, a task spans
-unrelated repos, a runtime claims success without evidence, a projection
-disagrees with git, a grant owner is unclear, or an integration tries to close
-or promote work.
+validation repeatedly fails, the runbook grows without a receipt, a task
+spans unrelated repos, a runtime claims success without evidence, a
+projection disagrees with git, a grant owner is unclear, or an integration
+tries to close or promote work.
+
+## Growing Local Discipline
+
+This document ships the judgment that is true everywhere. Your team's own
+calibration — which seats are strong where, which tools misbehave, which
+routes need a second look — is grown locally: when a correction lands, record
+it as one small note with why and how-to-apply, index it, and re-read it at
+the moment you would otherwise repeat the mistake. Corrections that are never
+recorded are corrections you will pay for twice.

package/docs/SEAT_PROVISIONING.md

@@ -1,6 +1,6 @@
 # Seat Provisioning
 
-Start with one project owner. Add review, QA, or runtime-specific seats only when a concrete task needs them. Use [LANE_PROVISIONING.md](LANE_PROVISIONING.md) when a manager needs to route active work, park future work, or give a new agent a complete pickup bulletin.
+Start with one project owner and one review seat. Add runtime-specific seats only when a concrete task needs them. Use [LANE_PROVISIONING.md](LANE_PROVISIONING.md) when a manager needs to route active work, park future work, or give a new agent a complete pickup bulletin.
 
 ## Minimal Flow
 
@@ -8,22 +8,21 @@ Start with one project owner. Add review, QA, or runtime-specific seats only whe
 2. Initialize the project with `bootstrap local`.
 3. Read `AGENTS.md`, `BOARD.md`, `SESSION_PICKUP.md`, and `SEAT_OPERATING_MANUAL.md`.
 4. Run `whereami`, `doctor`, and `status`.
-5. Confirm the lead seat.
-6. After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor swaps, rerun `whereami`, `doctor`, and `notify poll`.
-7. Treat lifecycle/readiness checks as evidence only; they do not authorize work.
-8. Have the lead seat `join` and `pickup` the first generated task.
-9. Add extra sessions only when starter sessions are not enough.
-10. Give each seat its allowed writes and validation.
-11. Record a receipt before asking for promotion.
+5. Confirm the lead and review seats.
+6. Use `$etiquette-seat-lifecycle` before pickup after stale context, resume, runner/model/profile swaps, or workflow migration.
+7. Have the lead seat `join` and `pickup` the first generated task.
+8. Add extra sessions only when starter sessions are not enough.
+9. Give each seat its allowed writes and validation.
+10. Record a receipt before asking for promotion.
 
 ```sh
 etiquette setup --target codex --project "$PWD"
-etiquette bootstrap local --project "$PWD" --task-prefix APP
-etiquette whereami --project "$PWD" --seat impl-seat --task APP-001
+etiquette bootstrap local --project "$PWD" --profile codex-cc-gemini --task-prefix APP
+etiquette whereami --project "$PWD" --seat codex-seat --task APP-001
 etiquette doctor --project "$PWD"
 etiquette status --project "$PWD"
-etiquette join --project "$PWD" --seat impl-seat
-etiquette pickup --project "$PWD" --seat impl-seat --task APP-001 --text
+etiquette join --project "$PWD" --seat codex-seat
+etiquette pickup --project "$PWD" --seat codex-seat --task APP-001 --text
 etiquette console board --project "$PWD" --text
 ```
 
@@ -34,8 +33,8 @@ Use `control_seat` for local workflow ownership, `execution_seat` for bounded im
 ## Greenfield Setup
 
 ```sh
-etiquette bootstrap local --project "$PWD" --task-prefix FOOD \
-  --lead-seat impl-seat --lead-principal developer-1
+etiquette bootstrap local --project "$PWD" --profile codex-cc-gemini --task-prefix FOOD \
+  --lead-seat impl-seat --lead-principal developer-1 --review-seat review-seat --review-principal reviewer-1
 ```
 
 ```sh
@@ -44,7 +43,11 @@ etiquette join --project "$PWD" --seat impl-seat
 etiquette pickup --project "$PWD" --seat impl-seat --task FOOD-001 --text
 ```
 
-The starter runbook is enough for normal pickup. Use `session create` only when an extra ad hoc session needs a different scope. The lead seat coordinates and implements. Add a review seat with `--profile lead-review` only when someone will actually pressure-test. Neither gets merge or promotion authority unless policy grants it. Hooks, readiness, rebind, and lifecycle preflight are evidence only; the task envelope and allowed writes remain the active work authority.
+The starter runbook is enough for normal pickup. Use `session create` only when an extra ad hoc session needs a different scope.
+
+The lead seat coordinates. The review seat pressure-tests. Neither gets merge or promotion authority unless policy grants it.
+
+Hooks, readiness, and lifecycle preflight are evidence only. The task envelope and allowed writes remain the active work authority.
 
 ## Child Runners
 
@@ -74,7 +77,7 @@ For bounded, cursor-based wake checks on any seat, use the portable core command
 ```sh
 etiquette seat readiness \
   --project "$PWD" \
-  --seat impl-seat \
+  --seat codex-seat \
   --seat-type execution_seat \
   --execution-surface codex \
   --capability-source local_validation \

package/docs/TEAM_HANDOFF.md

@@ -17,10 +17,10 @@ package. The CLI lives in the developer's user-local install root.
 
 The manager provides release version, installer URL or path, release base URL
 or local release directory, release public key, project repo or greenfield
-name, lead seat, and first task prefix. Provide review or QA seats only when
-the first assignment needs them.
+name, lead seat, review seat, and first task prefix.
 
-Default starter profile: solo lead `impl-seat`, task prefix `APP`.
+Default starter profile: lead `codex-seat`, review `cc-seat`, bootstrap
+`manager-seat`, task prefix `APP`.
 
 ## Install CLI
 
@@ -100,8 +100,8 @@ git commit -m "chore: baseline empty workspace"
 ## Bootstrap Local Etiquette
 
 ```sh
-etiquette handoff --project "$PWD" --task-prefix APP
-etiquette bootstrap local --project "$PWD" --task-prefix APP
+etiquette handoff --project "$PWD" --profile codex-cc-gemini --task-prefix APP
+etiquette bootstrap local --project "$PWD" --profile codex-cc-gemini --task-prefix APP
 etiquette doctor --project "$PWD"
 etiquette console board --project "$PWD" --text
 ```
@@ -123,38 +123,38 @@ git commit -m "chore: bootstrap etiquette workspace"
 Lead seat:
 
 ```sh
-etiquette whereami --project "$PWD" --seat impl-seat --task APP-001
-etiquette join --project "$PWD" --seat impl-seat
-etiquette pickup --project "$PWD" --seat impl-seat --task APP-001 --text
+etiquette whereami --project "$PWD" --seat codex-seat --task APP-001
+etiquette join --project "$PWD" --seat codex-seat
+etiquette pickup --project "$PWD" --seat codex-seat --task APP-001 --text
 ```
 
-Optional review seat after bootstrapping with `--profile lead-review`:
+Review seat:
 
 ```sh
-etiquette whereami --project "$PWD" --seat review-seat --task APP-002
-etiquette join --project "$PWD" --seat review-seat
-etiquette pickup --project "$PWD" --seat review-seat --task APP-002 --text
+etiquette whereami --project "$PWD" --seat cc-seat --task APP-002
+etiquette join --project "$PWD" --seat cc-seat
+etiquette pickup --project "$PWD" --seat cc-seat --task APP-002 --text
 ```
 
-If your runtime has an Etiquette pickup skill installed, it should do the same
-read-only sequence as the CLI. The portable form is:
+Inside Codex sessions that have the pickup skill installed:
 
 ```sh
-etiquette whereami --project "$PWD" --seat impl-seat --task APP-001
-etiquette doctor --project "$PWD"
-etiquette notify poll --project "$PWD" --seat impl-seat --text
-etiquette pickup --project "$PWD" --seat impl-seat --task APP-001 --text
+~/.codex/skills/etiquette-seat-pickup/scripts/seat-pickup.sh \
+  --project "$PWD" \
+  --seat codex-seat \
+  --task APP-001 \
+  --etq "$(command -v etiquette)"
 ```
 
-These are readers, not authority. Interrupted or swapped seats should rerun the
-preflight before pickup; see `docs/WORKTREE_QOL.md`.
+The wrapper prints board, feed, inbox, task envelope, and session runbook. It is
+a convenience reader, not authority.
 
 ## Local Wake
 
 Seats can refresh their repo-local queue before pickup or review:
 
 ```sh
-etiquette notify poll --project "$PWD" --seat impl-seat --text
+etiquette notify poll --project "$PWD" --seat codex-seat --text
 ```
 
 The queue is a local pointer cache over `.etiquette/events/local.ndjson`. It is

package/docs/WORKTREE_QOL.md

@@ -43,13 +43,6 @@ current directory, choose the current directory only when it is the intended
 project worktree for the task. Do not resume a repo-local task inside a global
 coordination repo or unrelated workspace.
 
-## Seat Rebind
-
-After TUI/cmux cutoff, cold restart, role/task change, runner/model/vendor swap,
-or directory ambiguity, verify `whereami --json`, `doctor`, `bus status 8`,
-branch, and worktree before pickup. Then run lifecycle readiness. Rebind grants
-no authority; stale memory is context only.
-
 ## If A Worktree Is Gone
 
 Do not reconstruct from chat. Recreate from Git:

package/docs/contracts/ledger-entry/README.md

@@ -1,7 +1,7 @@
 # Ledger Entry Contracts
 
-This contract keeps the ledger-query-mode work narrow. It hardens the spine first:
-typed ledger entries that later reflex queries can read without guessing.
+This contract keeps the ledger-query-mode work narrow. It hardens the journal first:
+typed ledger entries that later working-loop queries can read without guessing.
 
 It does not ship a ledger query engine, sabbatical dossier engine, capsule
 promotion loop, or remote ledger authority.
@@ -10,7 +10,7 @@ promotion loop, or remote ledger authority.
 
 ```text
 raw local ledger entry
-  -> typed spine-eligible metadata
+  -> typed `spine_eligible` metadata
     -> optional compact projection
       -> later sabbatical capsule only after operator promotion
 ```
@@ -18,12 +18,12 @@ raw local ledger entry
 ## Core Rule
 
 ```text
-Reflex routes the present.
+The working loop routes the present.
 Sabbatical understands the arc.
-Capsules compress the arc back into reflex context.
+Capsules compress the arc back into working-loop context.
 ```
 
-The brain may recommend. The spine may route. Grants authorize. Execution
+The planner may recommend. The journal may route. Grants authorize. Execution
 mutates. Receipts prove. Audit accounts.
 
 ## Contracts
@@ -65,18 +65,18 @@ These names are reserved vocabulary, not V0 machinery:
   search adapters; SQLite FTS5 is the only V0.1 retrieval accelerator.
 - `ledger-topic-dossier.v0` — unlock only when an operator asks for a durable
   long-horizon dossier over a real topic.
-- `sabbatical-ledger-query` — reserved as the deliberate brain posture; it
-  cannot write the reflex spine directly.
-- `capsule-to-spine-feedback` — unlock only when reviewed capsules have a human
+- `sabbatical-ledger-query` — reserved as the deliberate planner posture; it
+  cannot write the working journal directly.
+- `capsule-to-journal-feedback` — unlock only when reviewed capsules have a human
   promotion surface.
 
 Deferred surfaces must name an operational consumer before implementation.
 
 ## Boundary
 
-- The brain cannot write the spine directly. It may produce a capsule or
+- The planner cannot write the journal directly. It may produce a capsule or
   dossier that an operator later promotes.
-- `spine_eligible: true` is explicit; reflex indexes do not infer eligibility
+- `spine_eligible: true` is explicit; working-loop indexes do not infer eligibility
   from entry type.
 - Existing ledger lines remain readable as `pre_v0: true` legacy entries.
 - Ledger entries do not authorize work unless a valid grant path says so.

package/docs/contracts/ledger-entry/ledger-entry.v0.2.md

@@ -9,7 +9,7 @@ does not authorize work, attach grants, close tasks, or replace receipts.
 
 ```text
 The leading timestamp (created_at) is the RECORDING time. It is never
-backdated. If work was done off the spine, it is reconciled with a late
+backdated. If work was done off the journal, it is reconciled with a late
 entry recorded at its true time, pointing at contemporaneous evidence.
 Synthesizing entries with past recording times is corruption, not repair:
 one plausible fake timestamp devalues every real one.
@@ -51,7 +51,7 @@ valid_time_end:
 ## Added Entry Type
 
 `entry_type: retroactive_import` — a late reconciliation entry covering work
-that was executed without contemporaneous spine entries. Rules, enforced by
+that was executed without contemporaneous journal entries. Rules, enforced by
 the validator:
 
 - requires schema `ledger-entry.v0.2` (rejected on v0/v0.1);

package/docs/contracts/ledger-entry/ledger-entry.v0.md

@@ -1,6 +1,6 @@
 # ledger-entry.v0
 
-`ledger-entry.v0` is the typed local ledger record used by the reflex spine.
+`ledger-entry.v0` is the typed local ledger record used by the working journal.
 It makes compact ledger lines structurally queryable without promoting the
 ledger into an authority source.
 
@@ -58,7 +58,7 @@ legacy:
 `authority.class: grant` may set it to `true`, and only when the entry carries
 the durable grant reference required by the local workflow.
 
-`spine_eligible` is explicit. A reflex index must not infer it from
+`spine_eligible` is explicit. A working-loop index must not infer it from
 `entry_type`. Entries that are useful for current-state routing should set it to
 `true`; archival, noisy, or unreviewed entries should set it to `false`.
 
@@ -92,17 +92,17 @@ legacy:
 spine_eligible: false
 ```
 
-## Spine And Brain Boundary
+## Journal And Planner Boundary
 
 ```text
-Reflex routes the present.
+The working loop routes the present.
 Sabbatical understands the arc.
-Capsules compress the arc back into reflex context.
+Capsules compress the arc back into working-loop context.
 ```
 
-The reflex spine reads typed ledger entries. The sabbatical brain may produce a
-capsule or dossier, but it cannot write back into the spine directly. Promotion
-from capsule to spine requires an explicit operator gate.
+The working journal reads typed ledger entries. The sabbatical planner may produce a
+capsule or dossier, but it cannot write back into the journal directly. Promotion
+from capsule to journal requires an explicit operator gate.
 
 ## Authority Boundary