@gitroll/tacitt-cli 0.6.13 → 0.6.14

package/dist/web/index.html

@@ -6,7 +6,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="referrer" content="no-referrer" />
     <title>tacitt · Local session collection</title>
-    <script type="module" crossorigin src="./assets/index-BgDdPL1c.js"></script>
+    <script type="module" crossorigin src="./assets/index-XdWDOC5H.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-DzOozqms.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitroll/tacitt-cli",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "description": "Private local session review and export for coding agents",
   "license": "UNLICENSED",
   "repository": {

package/skills/tacitt/INDEX.md

@@ -6,7 +6,7 @@
 <!-- index-entries
 ./ | Shipped skill | Workspace-scoped instructions for direct CLI and optional Web collaboration.
 INDEX.md | Documentation | Directory navigation.
-SKILL.md | Agent instructions | Supplies the managed release template, explicit fast/low worker policy and phase routing into classification, paired CLI scan reruns, consent gates, account-seeded access, person-only Public choices, privacy review and approved export.
+SKILL.md | Agent instructions | Supplies the managed release template, explicit fast/low worker policy and phase routing into classification, paired CLI scan reruns, consent gates, Retry-only formation account stop, account-seeded access, person-only Public choices, privacy review and approved export.
 -->
 
 The entry table is not committed: run `pnpm run write:indexes`, then open `INDEX.local.md` in this directory.

package/skills/tacitt/SKILL.md

@@ -22,6 +22,8 @@ The agent invoking this Skill is its Main coordinator, including when another ag
 
 ## Required order
 
+Before first Work formation, `journey.prepare` reads the account inventory once, across all pages, with `include=title,removedFromWork,unitAccess` and the shared 30-second bound. A failed or partial read stops before classification and forms no Work. On `ACCOUNT_WORKS_UNAVAILABLE`, say "Tacitt could not read your profile, so it cannot tell which Works are already Private there." On `ACCOUNT_SIGNED_OUT`, ask the person to sign in. The helper's `accountReadRecovery` offers Retry only: get the current journey revision and submit `{kind:"account-read"}` once, then wait if the read still fails. For the first formation of a journey, never continue classification without a successful read or offer to group without the profile. A journey that already has a formed snapshot from an earlier build continues under its existing rules with no formation read. Consent without a subject keeps the existing signed-out exception. A successful read stores account facts for the later rebuild slice; it does not yet change Work ids, titles, grouping, access or Send.
+
 For scan starts and reruns after scope confirmation, follow the [paired CLI background preparation, restart budget and prepare-outcome rules](references/commands.md#scan-results).
 
 The person decides in the panel; you keep the journey moving. Never ask the person to return to chat to confirm or continue, except for the explicit [remote-worker host consent](references/remote-workers.md) before classification freezes. Until Ready to send, while the next step is theirs, [wait inside this turn](references/journey.md#waiting-for-the-person); at Ready to send your turn ends.

package/skills/tacitt/references/INDEX.md

@@ -9,8 +9,8 @@ INDEX.md | Directory index | Locates the shipped native journey references.
 b-method.md | Method reference | Defines the dictionary method: analysed scope, the child answer, the ten term types and how the hidden set is applied.
 bootstrap.md | Skill reference | Verifies the exact paired CLI release and preserves installation boundaries.
 classification.md | Skill reference | Owns priority dispatch of unresolved/evidence tasks, authoritative task-pointer prompts, semantic evidence safeguards, bounded reconciliation, final metadata and full-coverage publication and unconfirmed Public suggestions.
-commands.md | Command reference | Supplies classification assignment and answer-publication, session review, decision-card, final-resolution, phase-helper, batched reader lifecycle events, explicit paired-CLI scan reruns, account inheritance, person-only Public choices and Send contracts.
-journey.md | Skill reference | Guides explicit consent, row-assigned classification, CLI-owned answer publication and same-child recovery, account-seeded scan scope, explicit Public choices, contextual cards, final resolution, preview and approved packaging.
+commands.md | Command reference | Supplies classification assignment and answer-publication, session review, decision-card, final-resolution, phase-helper, batched reader lifecycle events, explicit paired-CLI scan reruns, Retry-only formation reads, account inheritance, person-only Public choices and Send contracts.
+journey.md | Skill reference | Guides explicit consent, row-assigned classification, CLI-owned answer publication and same-child recovery, Retry-only formation reads, account-seeded scan scope, explicit Public choices, contextual cards, final resolution, preview and approved packaging.
 parallel-review.md | Review protocol | Runs the review helper loop: bounded current-provider analysis agents, CLI-published drafts, same-child repair, batched launches and exits, busy slots, durable replay and recovery.
 remote-workers.md | Collection protocol | Owns per-Send host consent, bounded remote worker import before freeze and disclosure of unreadable dispatch lines or collection failures.
 send.md | Send reference | Owns browser Send, owner login, scope confirmation, incremental session intent, concurrent transfers with serialized commits, narrow pre-upload access blocking, upload-bound completion, background assessment, fresh review recovery and deliberate upgrades.

package/skills/tacitt/references/commands.md

@@ -25,6 +25,7 @@ Consent arrives from the panel's Continue button (or, after an explicit chat agr
 - `journey.classificationSubmit`: `{journeyId,expectedRevision,idempotencyKey,items}`. Each item is `{projectName,description,projectType,rootSessionIds,recommendation:{access,reason}}`. Types are `work`, `side`, `coursework`, `personal`, `scratch`, `other`; access is `public`, `private`, `drop`. Cover every root exactly once, preserve families and merge matching project identities; matching names alone are not identity. Recommendations do not change access by themselves.
 - Apply explicit visibility using `{kind:"work-access",workId,access}` or `{kind:"works-access",workIds,access}`. Browser choices are already committed; never overwrite them with an older recommendation.
 - Before `scope-confirm`, an unchosen Work may store a placeholder `access`; the panel shows its recommendation. Scope confirmation preserves confirmed person choices and a delegate's Private choice. It seeds account access while signed in (`accessOrigin:"account"`): all Private confirms, every root held Public confirms with account proof, partial Public history stays a suggestion, and mixed starts Private with a visible conflict. No account history uses the model path. Model Public also stays `accessConfirmed:false`; model Private may confirm. The panel asks the person for every suggested-Public Work. A suggested Public Work requires that person's explicit visibility choice, including choosing the same displayed Public value. Never use delegation to confirm Public.
+- Before first formation, `journey.prepare` performs the all-or-nothing account read. `ACCOUNT_WORKS_UNAVAILABLE` or `ACCOUNT_SIGNED_OUT` stops before classification with no Work formed. Get the current revision and submit `{kind:"account-read"}` once as Retry; the helper returns this sole choice in `accountReadRecovery`. If Retry still fails, wait for the profile read (or sign-in) to recover; never continue without the profile. A successful formation read changes no Work grouping or visibility in slice A.
 - As soon as the known Works (an `ingest` result with `partial: true`) or the complete proposal is ingested, record `{kind:"scope-confirm"}` for scan scope. This does not confirm suggested Public (a Work whose every root session is already Public on the account is confirmed by that account history and needs no question); name each suggested-Public Work and ask the person to choose Public or Private, in the panel or conversation. `scope-confirm` reads the account inventory first (30 s bound). A failed read refuses it with `ACCOUNT_ACCESS_UNAVAILABLE`, and a signed-out read with `ACCOUNT_SIGNED_OUT`; each records `accountRead` and changes no Work, and only a later `scope-confirm` that reads the account confirms the scope (Retry; it decides nothing, so run it once without asking). A signed-out `scope-confirm` continues on the model path only when this journey has recorded consent without an account subject. That covers consent given before sign-in was required or in a build with no sign-in client. A calling process with no sign-in client cannot exempt consent that records a subject. After confirmation, `{kind:"account-read"}` reads the account again from the panel or chat: on a read it re-applies account access to Public Works while preserving confirmed person choices, every Private Work and every left-out Work; on a failure it records the status only. The view's `accountReadCurrent` is true only for a `read` under the account signed in now; while it is false and an included Work is suggested Public or Public by account proof, the panel shows a stop with Retry or Sign in in place of the Send button. Then `journey.prepare` runs selected Work static scans and, while grouping continues, waits for and prepares the Works the complete proposal publishes or extends. `journey.classificationSubmit` takes optional `pendingRootSessionIds` (roots still being grouped, kept in one unread Work) and, after confirmation, `expectedClassificationRevision` (the classification it completes) instead of a current `expectedRevision`. Visibility stays open until Send: Drop stops that Work's scan, and a Work moved out of Drop needs `journey.prepare` again.
 
 ## Remote worker collection
@@ -57,6 +58,18 @@ Ingest and `next-packs` list `blockedWorks[]` only while one exists.
 Phase-helper `status` and `await` also print `leftOutSessions`, the number of root sessions in
 those Works, only when it is above zero; say it in chat before the review is complete, Ready
 to send or nothing is left to send.
+They also print `accountFormation: {leftOutSessions, heldBackSessions}` when formation kept
+sessions out of every Work because of the person's profile (ADR 0276). Say each nonzero count
+once in the journey, never a session or Work name: "N sessions are left out because you
+removed their Work on your profile." and "N sessions stay in their Works on your profile and
+are not sent this time." (singular: "1 session is left out because you removed its Work on
+your profile.", "1 session stays in its Work on your profile and is not sent this time.").
+When every session is already on the profile, left out or held back, `journey.prepare` fails with
+`ACCOUNT_NOTHING_TO_SEND` and the helper phase is `nothing-to-send` with `accountFormation`: say
+the counts once and that nothing is left to send this time, then end the turn. Running `/tacitt`
+again reads the profile again.
+Works with `accountWork: true` are the person's profile Works rebuilt with their profile title;
+classification never groups or describes them.
 When no selected Work is left (every one skipped or Dropped), the helper phase is
 `nothing-to-send`: there is no Send, and `await` waits for a Retry or a move out of Drop.
 When the person asks to retry, respond

package/skills/tacitt/references/journey.md

@@ -1,5 +1,7 @@
 # Classification-first native journey
 
+Before first Work formation, `journey.prepare` reads the account inventory once, across all pages, with `include=title,removedFromWork,unitAccess` and the shared 30-second bound. A failed or partial read stops before classification and forms no Work. On `ACCOUNT_WORKS_UNAVAILABLE`, say "Tacitt could not read your profile, so it cannot tell which Works are already Private there." On `ACCOUNT_SIGNED_OUT`, ask the person to sign in. The helper's `accountReadRecovery` offers Retry only: get the current journey revision and submit `{kind:"account-read"}` once, then wait if the read still fails. For the first formation of a journey, never continue classification without a successful read or offer to group without the profile. A journey that already has a formed snapshot from an earlier build continues under its existing rules with no formation read. Consent without a subject keeps the existing signed-out exception. A successful read stores account facts for the later rebuild slice; it does not yet change Work ids, titles, grouping, access or Send.
+
 > Audience: native Codex and Claude Code agents
 > Ownership: Tacitt CLI maintainers
 

package/skills/tacitt/scripts/INDEX.md

@@ -32,7 +32,7 @@ journey-state.mjs | Runtime state | Pending-Public-choice, confirmed-answer and
 journey-tasks.d.mts | Declaration | Types task creation, rendered-token sizing, canonical answer metadata and batch answer reads.
 journey-tasks.mjs | Task builder | Exact rendered-token budgets, private drafts, a 200-value cap (ADR 0234), compact existing policies with bounded overhead (ADR 0251), and one-term-per-line card/resolution payloads with complete bounded read ranges.
 journey.d.mts | Declaration | Phase helper contract for integration tests.
-journey.mjs | Runtime | Phase tasks with compact existing-card identity snapshots, durable exact batch writes, the person-decision `await` that hands off at Ready to send, the late placed-Work check before the classification commit (its stderr names only item indexes and Work ids) and shared CLI transport.
+journey.mjs | Runtime | Retry-only formation failure/status projection and phase tasks with compact existing-card identity snapshots, durable exact batch writes, the person-decision `await` that hands off at Ready to send, the late placed-Work check before the classification commit (its stderr names only item indexes and Work ids) and shared CLI transport.
 local-cli.d.mts | Type declarations | Defines the shared installed-package binding used by the CLI and standalone verifier.
 local-cli.mjs | Read-only package verifier | Validates an explicit installed CLI identity and aggregate artifact digest without network or application-state access.
 review-stream-client.d.mts | Type declarations | Types the fixed request/shutdown limits, private lifecycle callbacks and review-stream client methods.

package/skills/tacitt/scripts/journey-classification-tasks.mjs

@@ -21,6 +21,8 @@ const projectInstruction =
 const rootUniverse = (view) => {
   const result = []
   for (const work of view.works) {
+    // Rebuilt account Works are not classified (ADR 0276 D1).
+    if (work.accountWork) continue
     for (const rootSessionId of work.rootSessionIds) {
       result.push({ rootSessionId, workId: work.id })
     }

package/skills/tacitt/scripts/journey-state.d.mts

@@ -44,6 +44,9 @@ export function isSkipped(
   work: Pick<SkipRuleWork, 'status' | 'blockedCodes' | 'inputRevision' | 'reviewInterruptions'>,
 ): boolean
 export function isIncluded(work: SkipRuleWork): boolean
+export function accountFormationField(view: {
+  accountWorks?: { status: string; leftOut?: number; heldBack?: number }
+}): { accountFormation?: { leftOutSessions: number; heldBackSessions: number } }
 export function leftOutField(view: { works: readonly SkipRuleWork[] }): {
   leftOutSessions?: number
 }

package/skills/tacitt/scripts/journey-state.mjs

@@ -69,6 +69,13 @@ export const isSkipped = (work) =>
  * Issue #59: the sessions (roots) of every skipped, not Dropped Work, which the agent says in chat
  * before Ready to send. One number, printed only when above zero (issue #55).
  */
+/** ADR 0276 D1 formation counts, as `accountFormationLines` of the panel; tell the person once. */
+export const accountFormationField = (view) => {
+  const read = view.accountWorks?.status === 'read' ? view.accountWorks : null
+  return read && (read.leftOut || read.heldBack)
+    ? { accountFormation: { leftOutSessions: read.leftOut, heldBackSessions: read.heldBack } }
+    : {}
+}
 export const leftOutField = (view) => {
   const sessions = view.works
     .filter((work) => work.access !== 'drop' && isSkipped(work))
@@ -120,7 +127,7 @@ export function phaseOf(view, drainedRevision) {
   if (view.phase === 'paused') return 'paused'
   if (view.phase === 'completed') return 'completed'
   if (view.phase === 'sending') return 'sending'
-  if (!view.snapshotId) return 'freeze'
+  if (!view.snapshotId) return view.accountWorks?.nothingToSend ? 'nothing-to-send' : 'freeze'
   if (view.classificationRevision === null) return 'classification'
   if (view.scope.status !== 'confirmed') return 'classification-confirmation'
   // A pending Hide needs journey.prepare to recover it before anything else (ADR 0236).

package/skills/tacitt/scripts/journey.mjs

@@ -12,6 +12,7 @@ import {
   interruptedReviews,
   isIncluded,
   leftOutField,
+  accountFormationField,
   activeTerms,
   stageFingerprint,
   procedureFor,
@@ -87,6 +88,27 @@ async function prepareInitialFreeze(run, journeyId, call, view) {
   } catch (error) {
     // A large first freeze can outlast one helper command; captured roots persist for the rerun.
     if (error?.code === 'CLI_UNAVAILABLE') return { stage: 'freeze', status: 'running', startedAt }
+    // Every session is already on the profile or left out (ADR 0276): there is no Send.
+    if (error?.code === 'ACCOUNT_NOTHING_TO_SEND') {
+      const stopped = await call('journey.get', { journeyId })
+      return {
+        stage: 'freeze',
+        status: 'nothing-to-send',
+        startedAt,
+        ...accountFormationField(stopped),
+      }
+    }
+    if (['ACCOUNT_WORKS_UNAVAILABLE', 'ACCOUNT_SIGNED_OUT'].includes(error?.code)) {
+      const stopped = await call('journey.get', { journeyId })
+      if (stopped.accountReadRecovery)
+        return {
+          stage: 'freeze',
+          status: 'blocked',
+          startedAt,
+          accountReadRecovery: stopped.accountReadRecovery,
+          next: 'journey.prepare',
+        }
+    }
     throw error
   }
   const completed = await call('journey.get', { journeyId })
@@ -194,12 +216,16 @@ async function awaitDecision(run, journeyId, waitMs, call, sleep, ensureHost) {
         command: 'await',
         from,
         phase,
+        ...(view.accountReadRecovery
+          ? { accountReadRecovery: view.accountReadRecovery, next: 'journey.prepare' }
+          : {}),
         changed,
         waitedMs: Date.now() - started,
         revision: view.revision,
         blockedWorks: blocked,
         ...(held.length ? { interruptedReviews: held } : {}),
         ...leftOutField(view),
+        ...accountFormationField(view),
         ...(retried.length ? { retriedWorks: retried, next: 'journey.prepare' } : {}),
         ...(handoff ? { handoff: { panel: await ensureHost(), next: 'end-turn' } } : {}),
       }
@@ -264,12 +290,16 @@ async function runPhaseCore(
         ? { classification: await classificationProgress(manifest) }
         : {}),
       phase: await currentPhase(run, view),
+      ...(view.accountReadRecovery
+        ? { accountReadRecovery: view.accountReadRecovery, next: 'journey.prepare' }
+        : {}),
       revision: view.revision,
       readingComplete: view.readingComplete,
       pending: activeTerms(view).filter((term) => term.disposition === 'pending').length,
       blockedWorks: blockedWorks(view),
       ...(interruptions.length ? { interruptedReviews: interruptions } : {}),
       ...leftOutField(view),
+      ...accountFormationField(view),
       answersRevision: view.privacy.answersRevision,
       ...packagingProgress(view),
       coldElapsedMs,

package/skills/tacitt/scripts/privacy-validator.mjs

@@ -5112,6 +5112,14 @@ function object(shape, params) {
 	};
 	return new ZodObject(def);
 }
+function strictObject(shape, params) {
+	return new ZodObject({
+		type: "object",
+		shape,
+		catchall: never(),
+		...normalizeParams(params)
+	});
+}
 function looseObject(shape, params) {
 	return new ZodObject({
 		type: "object",
@@ -5400,7 +5408,7 @@ const range = object({
 	start: number().int().nonnegative(),
 	end: number().int().nonnegative()
 }).strict();
-const digest$3 = string().regex(/^[a-f0-9]{64}$/u);
+const digest$4 = string().regex(/^[a-f0-9]{64}$/u);
 /** Original static title mask provenance for keyword-only preview/packaging. */
 const classificationTitleMaskSchema = object({
 	inputRange: range,
@@ -5417,14 +5425,66 @@ const classificationTitleMaskSchema = object({
 	originalPointer: string().nullable(),
 	outputPointer: string().nullable(),
 	sourceRange: range.nullable(),
-	inputSha256: digest$3,
-	outputSha256: digest$3,
+	inputSha256: digest$4,
+	outputSha256: digest$4,
 	context: object({
 		start: number().int().nonnegative(),
 		text: string()
 	}).strict()
 }).strict();
 //#endregion
+//#region packages/application/src/journey/account-works.ts
+const digest$3 = string().regex(/^[0-9a-f]{64}$/u);
+const stored = object({
+	/** Wire field from issue #131; a formation reply without it is read as no stored metadata. */
+	metadataSha256: digest$3.nullish().transform((value) => value ?? null),
+	key: digest$3,
+	sessionKey: string().regex(/^sess-pilot\/[^/]+\/[^/]+\/[^/]+$/u).nullable(),
+	sha256: digest$3,
+	byteLength: number().int().positive(),
+	lastAt: datetime()
+});
+const access = _enum([
+	"public",
+	"private",
+	"removed"
+]);
+const accountWorksInventorySchema = object({
+	works: array(object({
+		logicalWorkId: uuid(),
+		title: string().min(1).max(300),
+		access,
+		unitAccess: access,
+		sessions: array(stored)
+	})),
+	unassigned: array(stored.extend({ removedFromWork: uuid().nullish().transform((value) => value ?? null) }))
+});
+const accountWorksSchema = discriminatedUnion("status", [
+	strictObject({
+		status: literal("read"),
+		subject: string().min(1).max(128),
+		at: datetime(),
+		inventory: accountWorksInventorySchema,
+		/** Families with a key unassigned after its Work's removal: no Work, not sent (D4). */
+		leftOut: array(strictObject({
+			rootSessionId: string().min(1).max(128),
+			removedWorkId: uuid()
+		})).default([]),
+		/** Families with a held key that are not cleanly placed: no Work, not sent (D9). */
+		heldBack: array(string().min(1).max(128)).default([]),
+		/** Every family was left out or held back: no Work and no snapshot (#129 review). */
+		nothingToSend: literal(true).optional()
+	}),
+	strictObject({
+		status: literal("signed-out"),
+		at: datetime()
+	}),
+	strictObject({
+		status: literal("unavailable"),
+		at: datetime()
+	})
+]);
+//#endregion
 //#region packages/application/src/journey/profile.ts
 /**
 * Passport's own rules (talent-platform `profile-settings.ts`): 1 to 39 letters and digits with
@@ -10167,7 +10227,8 @@ const reviewInterruptionSchema = object({
 }).strict();
 const journeyWorkSchema = object({
 	id: journeyIdSchema,
-	title: label,
+	/** 240 characters; an `account` title holds the server's 300 (ADR 0276 D2). */
+	title: string().trim().min(1).max(300),
 	/** Statically processed repository or folder name; the original stays in the private plan. */
 	projectName: label,
 	projectType: journeyWorkTypeSchema.nullable(),
@@ -10183,7 +10244,11 @@ const journeyWorkSchema = object({
 		description: string(),
 		reason: string()
 	}).strict().optional(),
-	titleOrigin: _enum(["model", "explicit"]),
+	titleOrigin: _enum([
+		"model",
+		"explicit",
+		"account"
+	]),
 	explicitTitleId: journeyIdSchema.nullable(),
 	accessOrigin: _enum([
 		"default",
@@ -10221,6 +10286,8 @@ const journeyWorkSchema = object({
 	inputRevision: count$1.min(1),
 	/** Placement created this Work (create-work or a sorting "new" decision): its name is generic. */
 	createdByPlacement: literal(true).optional(),
+	/** Rebuilt at formation from the account Work with this id (ADR 0276 D1); never classified. */
+	accountWork: literal(true).optional(),
 	/** Host-owned eligibility after removal-only regrouping; never authorizes output by itself. */
 	reviewReuseFrom: object({
 		inputRevision: count$1.min(1),
@@ -10276,7 +10343,7 @@ const journeyWorkSchema = object({
 		sentBundleId: journeyIdSchema.optional(),
 		sentAccess: _enum(["public", "private"]).optional()
 	}).strict().nullable()
-}).strict();
+}).strict().refine((work) => work.titleOrigin === "account" || work.title.length <= 240, { path: ["title"] });
 const journeyConsentSchema = object({
 	provider: label,
 	allowedAt: datetime(),
@@ -10298,7 +10365,7 @@ const journeyExceptionSchema = object({
 	value: string().min(1).max(1024)
 }).strict();
 object({
-	formatVersion: literal(10),
+	formatVersion: literal([10, 11]),
 	outputVersion: number().int().positive().optional(),
 	classificationRevision: count$1.nullable(),
 	privacy: journeyPrivacySchema,
@@ -10368,6 +10435,8 @@ object({
 	* confirmation and Retry set `read`; late classification records only a failure. Absent in a
 	* journey of an earlier version, which reads as not `read`.
 	*/
+	/** Formation read only; never establishes access proof. */
+	accountWorks: accountWorksSchema.optional(),
 	accountRead: object({
 		status: _enum([
 			"read",