@graphit/cli 0.2.372 → 0.2.379

package/scripts/verb-policy-source.json

@@ -12,7 +12,7 @@
     "Fields per verb:",
     "  surface            both | cli_only | app_only - where the verb is callable",
     "  is_read_only       true when the verb cannot change stored state",
-    "  mutation_class     none | kb | canvas | dashboard | data_source | governance | kb_config",
+    "  mutation_class     none | kb | canvas | dashboard | data_source | governance | kb_config | report",
     "                     (routes the validation-gateway pipeline and the loop guards)",
     "  requires_approval  true when the turn must show an approval card before executing",
     "  silent_retry_exempt true when a failure must surface instead of being retried silently",
@@ -33,7 +33,8 @@
     "query": "Run SQL against a cached data source or a live warehouse, through the governance gateway",
     "metadata": "Warehouse metadata discovery - schemas, tables and columns",
     "governance": "Governance conformance and the audit log",
-    "status": "The caller's effective permissions per domain"
+    "status": "The caller's effective permissions per domain",
+    "report": "Scheduled reports - a dashboard emailed or posted to Slack on a schedule, optionally with agent commentary"
   },
   "verbs": {
     "auth login": {
@@ -323,6 +324,14 @@
       "requires_approval": true,
       "silent_retry_exempt": false
     },
+    "kb batch": {
+      "surface": "both",
+      "noun": "kb_write",
+      "is_read_only": false,
+      "mutation_class": "kb",
+      "requires_approval": true,
+      "silent_retry_exempt": true
+    },
     "kb template list": {
       "surface": "both",
       "noun": "kb_read",
@@ -431,6 +440,13 @@
       "requires_approval": false,
       "silent_retry_exempt": false
     },
+    "ds usage": {
+      "surface": "both",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false
+    },
     "ds create": {
       "surface": "both",
       "is_read_only": false,
@@ -473,6 +489,14 @@
       "requires_approval": true,
       "silent_retry_exempt": true
     },
+    "ds re-upload": {
+      "surface": "cli_only",
+      "is_read_only": false,
+      "mutation_class": "data_source",
+      "requires_approval": true,
+      "silent_retry_exempt": true,
+      "reason": "It sends a local file's bytes, and the in-app agent has no filesystem - chat attachments reach it as extracted text, never as a file it could upload. In the app, a person re-uploads from the source's Re-upload file action in the Sources Hub."
+    },
     "ds delete": {
       "surface": "both",
       "is_read_only": false,
@@ -640,13 +664,121 @@
       "requires_approval": true,
       "silent_retry_exempt": true
     },
+    "dashboard delete-preview": {
+      "surface": "cli_only",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false,
+      "reason": "The in-app dashboard tool doc sits at its 2000-character ceiling, so the action waits on a tightening of that noun's summaries. In the app, `dashboard delete` with `delete_sources` checks the named ids on the server before the approval card, the card lists every data source that will be deleted, and the delete removes only those ids the server still offers."
+    },
+    "report list": {
+      "surface": "both",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false
+    },
+    "report destinations": {
+      "surface": "both",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false
+    },
+    "report get": {
+      "surface": "both",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false
+    },
+    "report runs": {
+      "surface": "both",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false
+    },
+    "report run": {
+      "surface": "both",
+      "is_read_only": true,
+      "mutation_class": "none",
+      "requires_approval": false,
+      "silent_retry_exempt": false
+    },
+    "report create": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true,
+      "app_params": {
+        "state_json": {
+          "type": "string",
+          "required": false,
+          "description": "The full filter map as a JSON object string, e.g. {\"region\": [\"EU\"]}. filter entries override its keys. Prefer filter for a few keys.",
+          "reason": "The CLI reads the full map from a file (--state-file), which an in-app turn has no disk for, so the map rides the call. Same capability (set the report's filters), different mechanics."
+        }
+      }
+    },
+    "report update": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true,
+      "app_params": {
+        "state_json": {
+          "type": "string",
+          "required": false,
+          "description": "The full filter map as a JSON object string, e.g. {\"region\": [\"EU\"]}. filter entries override its keys. Prefer filter for a few keys.",
+          "reason": "Same as report create: --state-file is a filesystem source an in-app turn does not have."
+        }
+      }
+    },
+    "report pause": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true
+    },
+    "report resume": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true
+    },
+    "report test": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true
+    },
+    "report send": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true
+    },
+    "report delete": {
+      "surface": "both",
+      "is_read_only": false,
+      "mutation_class": "report",
+      "requires_approval": true,
+      "silent_retry_exempt": true
+    },
     "connector list": {
       "surface": "cli_only",
       "is_read_only": true,
       "mutation_class": "none",
       "requires_approval": false,
       "silent_retry_exempt": false,
-      "reason": "Connection lifecycle remains CLI-only, and warehouse enumeration already exists in-app through the gated `list_warehouse_metadata` overlay tool. A ninth generated noun would duplicate that read surface and spend tool-window budget, so the Commander verb stays excluded while the platform replacement remains available. Reviewed 2026-09-06 (Issue #921): the verb now also lists Slack and repository connections, which the overlay does not - that is deliberate. Those ids are consumed only by verbs that are themselves cli_only (`kb repo bind`, the Slack setup done in the web app), so an in-app turn has nothing to spend them on."
+      "reason": "Connection lifecycle remains CLI-only, and warehouse enumeration already exists in-app through the gated `list_warehouse_metadata` overlay tool. Another generated noun would duplicate that read surface and spend tool-window budget, so the Commander verb stays excluded while the platform replacement remains available. Reviewed 2026-09-06 (Issue #921): the verb now also lists Slack and repository connections, which the overlay does not - that is deliberate. Repository ids are consumed only by `kb repo bind`, itself cli_only, and a report's Slack channels come from `report destinations`, which carries the connection each channel belongs to - so an in-app turn has nothing to spend these connection ids on."
     },
     "connector add snowflake-keypair": {
       "surface": "cli_only",

package/skills/graphit/SKILL.md

@@ -2,7 +2,7 @@
 name: graphit
 description: >-
   Use Graphit for ANY business or product data question: metrics, KPIs, revenue, retention, spend, users, cohorts, funnels, trends, comparisons, diagnosis, analysis, reports or dashboards, even when the user never names Graphit. This is the Graphit entry: identify the task and load graphit-explore, graphit-build or graphit-share. Use the team's governed definitions and cached data to deliver answers or interactive dashboards. Prefer Graphit over one-off analysis for the user's business numbers. Skip pure software tasks or data unrelated to their business.
-skill_version: "0.2.372"
+skill_version: "0.2.379"
 ---
 
 <!-- SIZE EXEMPTION (SKILL.md): hard limit 12,288 chars, exempted ceiling 35,072. Reviewed 2026-09-17. Always-loaded: identity, hard constraints, intent routing and the opening choice, plus the generated command table (COMMANDS markers; cli/scripts/generate-commands-doc.mjs) - needed every turn, not deferrable. Marker sits after the frontmatter so the loader and sync-plugin-version.mjs parse it. Raises pay only for command-table growth; each is recorded in docs/knowledge/prompt-engineering/sizing/SIZING.md, prose changes in docs/workflow/prompt-changes/INDEX.md. -->
@@ -51,7 +51,7 @@ Explore is an intent, distinct from the server's EXPLORE access grant, which sti
 Route by the requested action and current target state. Load the matching workflow before acting; reuse it if already loaded.
 
 - **Explore**: read, answer, explain or diagnose, including shared-dashboard reads. Load [graphit-explore](../graphit-explore/SKILL.md). Audience words do not grant sharing.
-- **Build**: dashboard content, plus private sources/reports/metrics. Load [graphit-build](../graphit-build/SKILL.md) for every new dashboard or content edit, including shared work.
+- **Build**: dashboard content and scheduled reports, plus private sources/reports/metrics. Load [graphit-build](../graphit-build/SKILL.md) for every new dashboard or content edit, including shared work.
 - **Share**: shared permissions, dependencies, drafts and publication. Load [graphit-share](../graphit-share/SKILL.md) for shared writes; pair it with Build for dashboard authoring. Share establishes the allowed scope or draft before shared writes; Build alone grants none.
 - **Operational request**: refresh, inspect, export or another explicit operation follows its actual action reference and permission contract. Do not force a creation interview, infer a new audience or discard the active task for a status question.
 
@@ -115,6 +115,7 @@ Workflow rows below are generated in-app adapters; CLI hosts load the named work
 | a graph switches metric, horizon, grain or grouping; typed query inputs | query-contract.md |
 | reusing a chart across dashboards as a template, or expanding one on a host | templates.md |
 | building a slide deck | presentations.md |
+| scheduling, changing, sending or troubleshooting a scheduled report (email/Slack delivery) | scheduled-reports.md |
 | moving an existing dashboard's queries onto its entities, or explaining a legacy-query save warning | migration.md |
 | checking a dashboard against the write contract without saving - pre-flighting an edit, or an alignment sweep | alignment.md |
 | CLI/plugin health, permission errors, local artifacts | operations.md |
@@ -124,7 +125,7 @@ Workflow rows below are generated in-app adapters; CLI hosts load the named work
 
 ## Commands
 
-Claude Code supplies the `graphit` wrapper. On Codex, Cursor, terminals and CI, use `npx -y @graphit/cli@0.2.372 <command>`; pin a version for reproducibility. The table is generated from the CLI; check command help for exact flags.
+Claude Code supplies the `graphit` wrapper. On Codex, Cursor, terminals and CI, use `npx -y @graphit/cli@0.2.379 <command>`; pin a version for reproducibility. The table is generated from the CLI; check command help for exact flags.
 
 <!-- COMMANDS:START -->
 
@@ -153,6 +154,7 @@ _Generated by `npm run gen:commands`; do not hand-edit between the markers._
 - `kb repo token mint` - Mint a display-once CI machine token (org admin); scope kb:verify or kb:apply - `--scope`
 - `kb repo token list` - List CI machine tokens: metadata only, never the secret
 - `kb repo token revoke <token-id>` - Revoke a CI machine token (org admin)
+- `kb batch` - Apply many metric and semantic-model creates and updates as one Knowledge Base change (up to 50 per batch; 20 in-app). Items: {op: create, noun, definition, unverified?} or {op: update, noun, name, patch}; each passes the same checks as kb create/kb update and reports its own result, and readers rebuild once for the whole batch instead of once per edit. Groups, rules and deletes use their own verbs - `--file --json --stop-on-error`
 - `kb template list` - List chart templates without their HTML
 - `kb template get <name>` - Fetch one chart template with its HTML. What expands in every adopting dashboard
 - `kb template create` - Create a chart template from an HTML fragment. A fragment may carry <script> and <style> and {{param}} placeholders in markup, never data-graphit-id/-sql/-ds/-label/-vocab/-state attributes: the host entity owns the query - `--name --file --json --description --params`
@@ -187,8 +189,10 @@ _Generated by `npm run gen:commands`; do not hand-edit between the markers._
 
 **ds** - Data source management
 - `ds refresh-history <id>` - Show recent refresh runs for a data source with the Snowflake query id per run (status, time, rows, duration). Runs from before query-id capture - or a failure before any query ran - show 'not captured'. Read-only; no ds refresh-history delete. - `--limit`
+- `ds usage [id]` - Show which canvas dashboards and graphs read a data source. With an id: each dashboard you can open and its graphs, plus a count of graphs on dashboards you cannot open. Without an id: dashboard_count and graph_count for every source you can read (0 = no graph uses it). A graph counts when its data-graphit-ds names the source, its governed metrics or dimensions come from the source's semantic model, or its SQL reads the source by name. Graphs composed only in JavaScript are not seen. Read-only; ds delete still re-checks metrics and rules.
 - `ds move <id>` - Not a command anywhere: a source lives in its bound semantic model's group; kb update semantic-model moves it
 - `ds delete <id>` - Delete one of YOUR OWN private data sources (requires --yes). Shared sources are deleted in the Sources Hub, where the cascade is visible. - `--yes`
+- `ds re-upload <id>` - Replace an uploaded CSV/Excel source's contents in place - keeps its id, graph bindings, semantic model and history; never re-create with `ds create --file`. A changed column set needs --force - `--file --force`
 - `ds list` - List data sources. Rows carry domain, created_at and created_by. Response carries count/total/truncated; below total = capped, raise --limit - `--limit`
 - `ds create` - Create from SQL or Excel/CSV. Completed publication and clean scan make the source ready and verified. --domain is REQUIRED: uppercase access-policy key, not a semantic group - `--sql --name --connection --schema --skip-scan --detect-tables --source-tables --file --domain --sheet`
 - `ds refresh [ids...]` - Refresh data sources (--all or IDs). Breaking drift with dependents pauses adoption; use ds verify --accept-schema to adopt the change - `--all --no-wait --skip-empty --force`
@@ -207,7 +211,7 @@ _Generated by `npm run gen:commands`; do not hand-edit between the markers._
 - `dashboard move <id>` - Move a dashboard within one space, or return it to root. This changes only navigation metadata and needs no canvas edit session. Its placement in other spaces, content and sharing stay unchanged. Use sharing operations separately to grant access. - `--space --team --revision --folder`
 - `dashboard list` - List custom dashboards. --view takes mine, shared, editable, all (default). mine is what you created and so own - exactly one owner per dashboard, so mine is how teammates split migration work with no overlap. editable adds dashboards others own that you can change. Every row carries permission owner/editor/viewer. - `--view --team`
 - `dashboard create` - Create a new custom dashboard - `--name`
-- `dashboard share <id>` - Share an owned dashboard. Org requires admin/owner; Team requires membership. An optional folder path shares and files atomically; invalid paths reject both. - `--space --team --folder-path`
+- `dashboard share <id>` - Share a dashboard you own, or as an org admin/owner one you can see. Org admins/owners may share it into Org or a team they belong to. Org requires admin/owner; Team requires membership. An optional folder path shares and files atomically; invalid paths reject both. - `--space --team --folder-path`
 - `dashboard get <id>` - Get dashboard details - `--html`
 - `dashboard check <id>` - Check a dashboard against the canvas write contract without saving. No flags = audit the stored page's standing debt; --file/--stdin = dry-run a proposed document and report the exact save verdict, without burning a version. Exits 1 when a save would be refused. - `--file --stdin`
 - `dashboard update-html <id>` - Replace dashboard HTML content - `--file --stdin --label`
@@ -216,10 +220,25 @@ _Generated by `npm run gen:commands`; do not hand-edit between the markers._
 - `dashboard list-entities <id>` - List the entities on a dashboard (id, label, KB refs, data source)
 - `dashboard get-entity <id> <entityId>` - Get entity context. Includes label, SQL, KB refs, data source and HTML. Use --with-data to also execute the governed query and return resolved data inline - that envelope carries truncated (false = complete) and executed_row_count when capped. Use --image for a local PNG of the graph (as last viewed) to Read - `--with-data --max-rows --params --adhoc-reason --image --raw`
 - `dashboard export <id>` - Export dashboard as PNG or PDF - `--format --output`
-- `dashboard edit <id>` - Enter edit mode on a shared dashboard: catch the editing session + start a draft, then open it in your browser. Gated (409) if someone else is editing, (423) if locked, (403) if view-only. Private dashboards need no session - edit directly. - `--no-open`
-- `dashboard publish <id>` - Publish your draft edits on a shared dashboard (makes them live) and release the editing session
-- `dashboard release <id>` - Discard your unpublished draft edits on a shared dashboard and release the editing session (requires --yes) - `--yes`
-- `dashboard delete <id>` - Delete a custom dashboard (requires --yes) - `--yes`
+- `dashboard edit <id>` - Enter edit mode on a shared dashboard: catch the editing session + start a draft. Then opens it in your browser. Gated (409) if someone else is editing, (423) if locked, (403) if view-only. Private dashboards need no session - edit directly. - `--no-open`
+- `dashboard publish <id>` - Publish your draft edits on a shared dashboard and release the editing session. This makes them live.
+- `dashboard release <id>` - Discard your unpublished draft edits on a shared dashboard and release the editing session. Requires --yes. - `--yes`
+- `dashboard delete-preview <id>` - Preview a delete: the data sources only this dashboard uses. orphan_sources are your own private ones nothing else uses (ids for delete --delete-sources); kept_sources are the rest, each with its rule. Deletes nothing.
+- `dashboard delete <id>` - Delete a custom dashboard. Requires --yes. Data sources are kept unless named in --delete-sources (see delete-preview). - `--yes --delete-sources`
+
+**report** - Scheduled reports - a dashboard emailed or posted to Slack on a schedule, optionally with agent commentary
+- `report list` - List scheduled reports you can see - `--dashboard`
+- `report destinations` - Where reports can go: Slack channels the bot can post to, org members, and allowed email domains
+- `report get <id>` - Show one report: schedule, destinations, filters, status
+- `report create` - Schedule a dashboard as a report - needs at least one --email or --slack; you become its creator and it renders with your data access - `--dashboard --name --frequency --send-time --day-of-week --day-of-month --timezone --email --slack --subject --instructions --filter --state-file --skip-if-empty`
+- `report update <id>` - Change a report - only the flags you pass change; recipients, Slack channels, instructions and filters are the creator's alone to change - `--name --frequency --send-time --day-of-week --day-of-month --timezone --email --slack --subject --instructions --filter --state-file --skip-if-empty --send-if-empty --clear-filters --clear-instructions`
+- `report pause <id>` - Pause a report - no scheduled runs until resumed
+- `report resume <id>` - Resume a paused report
+- `report test <id>` - Send a test run to the report's creator only
+- `report send <id>` - Send a report now to all its recipients and channels (requires --yes) - `--yes`
+- `report delete <id>` - Delete a report and its schedule (requires --yes) - `--yes`
+- `report runs <id>` - Recent runs of a report: status, deliveries, errors, commentary outcome - `--limit`
+- `report run <id> <run-id>` - The agent commentary exchange behind one run (the report's creator only)
 
 **connector** - Connection management. OAuth and GitHub connections are set up in the Graphit web app.
 - `connector list` - List connections (Snowflake, BigQuery, Slack, GitHub/Bitbucket)

package/skills/graphit/VERSION.json

@@ -1,5 +1,5 @@
 {
   "package": "@graphit/cli",
-  "version": "0.2.372",
+  "version": "0.2.379",
   "source": "cli/package.json"
 }

package/skills/graphit/references/build.md

@@ -18,7 +18,7 @@ Use a fitting cached source first and state the chosen source. If none exists, P
 
 The scan's bound semantic model supplies the semantic layer. Use its measures and dimensions, fitting existing metrics, and explicitly labeled ad-hoc SQL where needed; governance.md and sql-reference.md own query permissions and receipts. For private work, do not create a metric unless the user asks to keep it. Then read semantic-authoring.md and kb-scope.md: use the scanner model's exact private group and source binding, preserve siblings, and verify the result. A request to keep an already agreed definition authorizes that work; resolve only a new ambiguity in its meaning. No visible private group means stop before a private write, never omit the group and land in org commons. Shared definitions follow Share's agreed group and readiness checks; loading Build does not replace them.
 
-Change coverage, filters, columns or joins for the same source purpose with `ds edit-sql`; follow its drift response. A new name is not a repair for a failed edit. Re-upload file sources through their supported flow.
+Change coverage, filters, columns or joins for the same source purpose with `ds edit-sql`; follow its drift response. A new name is not a repair for a failed edit. Update an uploaded file source in place with `graphit ds re-upload <id> --file <path>` (in the app, the person uses Re-upload file in the Sources Hub); never re-create it.
 
 When no source exists and the user asks for a sketch, mockup, wireframe or layout first, build a **layout preview** instead. Ask about this fork only when genuinely ambiguous; data first is the default.
 
@@ -32,6 +32,8 @@ When no source exists and the user asks for a sketch, mockup, wireframe or layou
 
 Build and show sections as they become useful; continue authorized work without an approval round per chart. Check the canvas, fix `entity_sql_warnings`, and verify rendering and real resolves before calling a data-backed dashboard complete. For a preview, verify layout and marker coverage and report it specifically as a preview.
 
-Without Share's established shared scope/draft, Build writes only privately. Shared authoring stays within that authorization; Share retains checks before shared dependency writes and publication. Private sources refresh manually, in full. A schedule or Slack/email delivery request needs Share for the source and its bound model; explain that and offer it if not already requested. The dashboard may remain private. A private report or export alone does not imply scheduled delivery or a visibility change.
+Without Share's established shared scope/draft, Build writes only privately. Shared authoring stays within that authorization; Share retains checks before shared dependency writes and publication. Private sources refresh manually, in full. A schedule or Slack/email delivery request needs Share for the source and its bound model; explain that and offer it if not already requested, then schedule through scheduled-reports.md. The dashboard may remain private. A private report or export alone does not imply scheduled delivery or a visibility change.
 
 For Private first, end with the private link, verification and limitations, plus one offer to share; an offer grants no permission. When sharing/publication is already requested, continue the same artifact through Share's remaining checks and report its actual outcome. Do not repeat an answered choice; obtain approval for additional effects when required. A draft-only request stays a draft.
+
+After completing a dashboard, or when the user asks for something recurring ("every Monday", "a weekly update", "send this to the team"), offer once per session to schedule it as a report; create one only after an explicit yes.

package/skills/graphit/references/dashboard-create.md

@@ -32,7 +32,7 @@ Example: a private retention dashboard is created in My Dashboards without a fol
 ## Build, share and file
 
 1. Create the dashboard privately with `dashboard create` and retain its returned ID. Build and verify the content following dashboard-planning.md and runtime.md. Do not share an unfinished dashboard.
-2. Refresh the chosen directory after building. For Org or Team, use `dashboard share` on that same ID with the chosen space/team and `folder_path` (CLI flag `--folder-path`): a slash-separated existing path within that audience, or `/` for root. This single operation shares and files together. Org requires an org admin/owner who owns the dashboard; Team requires ownership and actual membership. The server re-resolves the exact path in its transaction, preserving the private-dependency sharing guard. Invalid, missing or inaccessible paths reject both changes; show the error and let the user correct the path. Never omit a rejected path and retry at root. No fuzzy matching or automatic folder creation. Omitting the path deliberately means share only and keep the existing placement.
+2. Refresh the chosen directory after building. For Org or Team, use `dashboard share` on that same ID with the chosen space/team and `folder_path` (CLI flag `--folder-path`): a slash-separated existing path within that audience, or `/` for root. This single operation shares and files together. Org requires an org admin/owner; Team requires actual membership. The server re-resolves the exact path in its transaction, preserving the private-dependency sharing guard. Invalid, missing or inaccessible paths reject both changes; show the error and let the user correct the path. Never omit a rejected path and retry at root. No fuzzy matching or automatic folder creation. Omitting the path deliberately means share only and keep the existing placement.
 3. My Dashboards needs no sharing: use `dashboard move` for a nested personal folder with the selected folder ID and freshly read revision. A new dashboard at root needs no move. A revision conflict requires a fresh read and reconsideration. Paths address the names that exist at commit time; they do not pin an earlier folder identity if a different folder later takes the same path.
 4. Verify the same ID through `dashboard list` for visibility/team_ids and through the destination's folder listing for placement. Follow pagination as needed. Return the dashboard link, full breadcrumb and actual audience only after those reads agree. Later content edits on a shared dashboard require the existing edit-session/draft flow.
 

package/skills/graphit/references/data-sources.md

@@ -51,7 +51,7 @@ A clean scan activates the source after its snapshot is published, for warehouse
 
 Creation and verification output report `pii_hidden` with reasons: these columns are masked as NULL in every query, including dashboards and exports. Surface those verdicts and the returned remedy. Use the server's `can_expose_verdict`, never a guessed role, to explain who can reverse a false positive. `ds verify <id> --expose COL1,COL2` explicitly unhides named columns; it also works on an already-verified source and reports `exposed` and `expose_failed`. Do not unhide a column without the user's choice.
 
-Edit in place with `ds edit-sql <id> --sql "..."` when changing columns, filters, joins, or date coverage for the same purpose - editing preserves the source id, graph bindings, semantic-model binding, schedules, and history. The new SQL is compiled against the warehouse before anything is saved. A breaking candidate with dependents pauses in `pending_verification` with the old data still serving; only explicit `ds verify --accept-schema` accepts it. A clean change without dependents can adopt automatically, as can an additive change. Report the returned state; a queued acceptance is not adoption. Generic force-refresh does not accept drift. `--expected-version` is optional and a stale value is refused without changing anything. File-upload sources cannot be edited by SQL - re-upload the file. Never version the same work as `_v2`, `_copy` or `_shared`, including after a refused edit. Create a separate source only for a different purpose or connection.
+Edit in place with `ds edit-sql <id> --sql "..."` when changing columns, filters, joins, or date coverage for the same purpose - editing preserves the source id, graph bindings, semantic-model binding, schedules, and history. The new SQL is compiled against the warehouse before anything is saved. A breaking candidate with dependents pauses in `pending_verification` with the old data still serving; only explicit `ds verify --accept-schema` accepts it. A clean change without dependents can adopt automatically, as can an additive change. Report the returned state; a queued acceptance is not adoption. Generic force-refresh does not accept drift. `--expected-version` is optional and a stale value is refused without changing anything. File-upload sources cannot be edited by SQL. Replace an uploaded file's contents in place with `graphit ds re-upload <id> --file <path>`; in the app, the person uses Re-upload file on the source in the Sources Hub. Either keeps the id and every binding, while re-creating the source is refused on its name or orphans the old one. A changed column set is refused until the user accepts `--force`, which breaks graphs reading removed or renamed columns; a source still pending verification must be verified first. Never version the same work as `_v2`, `_copy` or `_shared`, including after a refused edit. Create a separate source only for a different purpose or connection.
 
 ## Zero Rows and Nulls
 
@@ -63,7 +63,7 @@ On an empty or suspiciously-null result: check the selected source and dialect,
 - Reading does not imply authority over connector, SQL, or refresh settings.
 - Visibility and masking cover agent, canvas, render, export, and report paths.
 - Private names and columns remain concealed.
-- Delete your own private sources with `graphit ds delete <id> --yes` only after the user confirms. Shared sources stay in the Sources Hub. A 409 names visible dependents to remove or rebind first; a 202 means deletion applied but storage cleanup is pending: report it and do not repeat the delete.
+- Delete your own private sources with `graphit ds delete <id> --yes` only after the user confirms. Shared sources stay in the Sources Hub. `dashboard delete <id> --yes --delete-sources <ids>` also removes the named own private sources only that dashboard used (ids from `dashboard delete-preview`). A 409 names visible dependents to remove or rebind first; a 202 means deletion applied but storage cleanup is pending: report it and do not repeat the delete.
 - There is no source move on any surface. A source lives in the `group` of the semantic model bound to it, so `kb update semantic-model <name>` with a new `group` moves the source; a source with no bound model yet keeps the domain it was created with.
 
 For refresh modes, history, incremental tuning, and reconciliation, load `data-source-refresh.md`.

package/skills/graphit/references/filters-advanced.md

@@ -1,10 +1,10 @@
 # Advanced Filter Controls - Dependent Dropdowns and Date Presets
 
-Load only when you need one of two optional controls on top of the core filters: a dependent dropdown ("only relevant values" that narrows as an upstream filter changes) or a date-preset picker. The base filter, param, bind, wiring, `:name` binding, and saved-view mechanics live in `filters.md`. Both controls below are headless logic - you own all the markup.
+Load only when you need an optional control on top of the core filters: a dependent dropdown, data-driven date bounds, a top-N list, or a date-preset picker. The base filter, param, bind, wiring, `:name` binding, and saved-view mechanics live in `filters.md`. Every control below is headless logic - you own all the markup.
 
 ## graphit.cascade(el, options) - Only Relevant Values
 
-Dependent dropdowns: fetch a column's DISTINCT values constrained by other filters, and refetch when they change. For example, pick an org and the user list shows only that org's users. Logic only - you build the checkboxes or list in `render`.
+Dependent dropdowns: fetch a column's DISTINCT values constrained by other filters, and refetch when they change - pick an org and the user list shows only that org's users. You build the markup in `render`.
 
 ```js
 const org = graphit.filter('org', { label: 'Org' })
@@ -25,11 +25,12 @@ graphit.cascade('#user-list', {
 ```
 
 - `filters()` returns `{ COLUMN: value }`. A scalar makes `COLUMN = :p`; an array makes `COLUMN IN :p`. One contract everywhere: `null`, absent or `''` means ALL (no constraint), and `[]` means match NOTHING - an empty-array upstream settles the list empty without issuing a query.
+- Objects: `{ exclude: [...] }` is NOT IN, keeping null rows unless `null` is listed; `{ start, end }` takes `dr.get()` as-is (a date-only `end` includes that day); `{ min, max }` is inclusive. Empty ones constrain nothing.
 - `selection` (a filter handle) is auto-pruned to the surviving values when an upstream changes. Name the control a cascade feeds - pass `selection`, or use the `column` that control declares in `data-graphit-field` - so report and saved-view editors can list and search these values.
-- Returns `{ destroy(), search(term) }`. Keep the result set small (default `LIMIT 1001`); these parameterized queries skip the result cache, so they hit DuckDB directly.
-- `withCounts: true` adds a per-value row count, delivered as `ctx.counts` alongside `values` (same order).
-- Type-ahead: call the handle's `search('ber')` to narrow server-side; it is debounced with the normal refetch and matches literally, so `100%` finds `100%`. Clearing it (`search('')`) restores the full list.
-- Faster for low-cardinality cascades: add `preload: true` to fetch the full distinct cross-product ONCE (cacheable, no params) and filter in-memory on every change - instant, zero per-change round-trips. Best when the column-by-upstream combinations are small (cap = `limit`, default 1001 tuples); above the cap it auto-falls-back to per-change server queries.
+- Returns `{ destroy(), search(term) }`. Keep the result set small (default `LIMIT 1001`).
+- `withCounts: true` adds a per-value row count, delivered as `ctx.counts` alongside `values` (same order). `orderBy: 'count'` returns the top `limit` by count instead - for high-cardinality columns; it never prunes `selection`.
+- Type-ahead: call the handle's `search('ber')` to narrow server-side; it is debounced with the normal refetch and is a case-insensitive contains match with literal wildcards, so `100%` finds `100%`. Clearing it (`search('')`) restores the full list.
+- For low-cardinality cascades, `preload: true` fetches the distinct cross-product ONCE and filters in memory on every change; above `limit` tuples (default 1001), or with an object filter, it queries per change.
 
 ## graphit.dataBounds(options) - A Column's Real Min/Max
 
@@ -43,6 +44,7 @@ input.max = b.max
 
 - Returns `{ min, max, dataMax, today }`. Use `max` as the picker ceiling: it is `max(dataMax, today)`, so a source lagging a few days never locks the user out of today. `dataMax` is the raw last row, for a "data through {dataMax}" caption.
 - Non-date columns return their true min/max with no ceiling applied.
+- Optional `filters` (as in cascade, e.g. `{ IS_WEB: 0 }`) bound matching rows only.
 
 ## graphit.rank(options) - Top-N Values
 
@@ -57,7 +59,7 @@ const top = await graphit.rank({
 })
 ```
 
-- Returns a plain array of values. Prefer `{{ Metric('name') }}` so ranking uses the org's definition; a bare aggregate accepts SUM, COUNT, AVG, MIN, or MAX over one column.
+- Returns a plain array of values; `withScores: true` returns `{ values, scores }` (score = the `by` value). Prefer `{{ Metric('name') }}` so ranking uses the org's definition; a bare aggregate accepts SUM, COUNT, AVG, MIN, or MAX over one column.
 
 ## graphit.dateRange(id, options) - Date Presets
 

package/skills/graphit/references/kb-actions.md

@@ -39,6 +39,13 @@ Constraints keep their five semantics: required predicate, forbidden column, req
 5. Verify/unverify separately when intended.
 6. Inspect receipts; a degraded write may have landed and must not be retried blindly.
 
+When one task creates or changes several metrics or semantic models, send them as one `graphit kb batch` instead of one `kb create` or `kb update` each. Every item gets the same checks and its own result, and dashboards rebuild once for the whole batch instead of once per edit, so they keep serving while you author. A single edit stays `kb update`. Steps 1-2 still apply to every item; a batch changes the transport, not the patch discipline.
+
+- Shape: `{"operations": [...]}` or a bare array of `{"op": "update", "noun", "name", "patch"}` and `{"op": "create", "noun", "definition", "unverified"?}` items. Nouns are `metric` and `semantic-model` only; groups, rules and deletes keep their own verbs. Up to 50 items per batch, 20 in-app.
+- Order items so each validates against the ones before it: a semantic model before the metrics that use its measures, a metric before a derived metric over it. Use `--stop-on-error` when later items depend on earlier ones.
+- Items are not all-or-nothing: earlier items stay applied when a later one fails. Read `results` per item, fix what each `error` names, and re-send only the `failed` and `not_attempted` items as a new batch. Never replay the whole batch. An `unknown` item may have landed; read it back with `kb get` before sending it again.
+- In-app, approving the batch verifies each updated item, as approving a single update does.
+
 ## Delete
 
 Confirm with the user and inspect usage first. The server checks known definition dependencies, not every canvas reference. A green guard is not exhaustive impact proof.

package/skills/graphit/references/onboarding.md

@@ -67,7 +67,7 @@ Ask whether the user wants a quick query answer or a deployed HTML dashboard. Bu
 After the first dashboard is deployed, tell the user - concisely - what they get for free on it. Keep this to the first dashboard; it never needs repeating, because onboarding stops firing once the workspace has data.
 
 - **Each graph's 3-dot (hamburger) menu**: "view details" opens a panel with the SQL, live query results, and the trust tier plus any enforced rules (the KB assets it lists open as explorable tabs).
-- **The dashboard's own hamburger** (top bar): share it, schedule a recurring email report, export to PNG or PDF, and browse version history.
+- **The dashboard's own hamburger** (top bar): share it, schedule a recurring email or Slack report (or ask Graphit to schedule it), export to PNG or PDF, and browse version history.
 - **Themes and colors** are automatic - dark and light mode, and the brand palette, with no extra work.
 
 Then continue in the normal loop; the workspace is no longer empty.

package/skills/graphit/references/query-contract.md

@@ -15,7 +15,7 @@ Keep the default SQL in `data-graphit-sql` and source in `data-graphit-ds`. Add
 </div>
 ```
 
-These are invented names; use actual accessible sources/columns and governed Metric/Dimension/Measure references where available. A variant contains only `sql` and inherits the owner's source. Cross-source alternatives need separate owners. The spec has no second default SQL, source override or variant named `default`. Unknown fields, versions, duplicate JSON keys, malformed types, undeclared placeholders and the names `__proto__`, `constructor` and `prototype` refuse the save; the refusal names the owner, and the parameter or variant when one is at fault. Save the declaration before selecting it; the backend re-reads the stored owner the page shows (the editor's draft while the page shows it). Local DOM edits are not a new stored query authority.
+These are invented names; use actual accessible sources/columns and governed Metric/Dimension/Measure references where available. A variant contains only `sql` and inherits the owner's source. Cross-source alternatives need separate owners. The spec has no second default SQL, source override or variant named `default`. Unknown fields, versions, duplicate JSON keys, malformed types, undeclared placeholders and the names `__proto__`, `constructor` and `prototype` refuse the save; the refusal names the owner, and the parameter or variant when one is at fault. Save the declaration so the save rule validates it. The SDK reads the specification from the page, picks the default or named statement and sends it as that entity's query; the server authorizes and governs it like any other query.
 
 ```js
 const result = await graphit.resolve({
@@ -32,7 +32,7 @@ Omit `variant` to select the default. Do not combine `variant` with explicit `sq
 
 **One name, one declaration.** A parameter name is one input: every owner that declares `country` declares it identically, so one control's value is valid everywhere it is sent. While authoring, keep one type table per dashboard and copy into each owner's static specification exactly the placeholders its default and variant statements use; an unused declaration refuses the save. Never build specifications in page JavaScript. When owners disagree, the shared check/save path returns a non-blocking `query_param_type_conflict` warning naming the parameter and its declarations; align them, or rename inputs that genuinely differ, and save again.
 
-Dates/as-of, search text, returned top-category arrays and cohort labels are bound values. Keep their parameter names stable across state changes; do not turn a category label into a SQL identifier. Metric/group/grain/horizon changes select authored statements, not SQL fragments passed as values. Send every binding the selected statement uses; bindings removed by the existing integer sentinel simplifier may be omitted. Declared values the selected statement does not use are ignored, so one params object can serve all of that owner's variants; a name that owner does not declare refuses.
+Dates/as-of, search text, returned top-category arrays and cohort labels are bound values. Keep their parameter names stable across state changes; do not turn a category label into a SQL identifier. Metric/group/grain/horizon changes select authored statements, not SQL fragments passed as values. Send every binding the selected statement uses; bindings removed by the existing integer sentinel simplifier may be omitted. Values the selected statement does not use are ignored, so one params object can serve all of that owner's variants.
 
 Preserve the dashboard's authored All/None/include/exclude behavior. An authored empty selection that means All stays distinct from None; do not globally translate every empty list or null. Use explicit mode values such as an enum when appropriate. The existing integer `all_x` sentinel contract remains in `filters.md`.
 

package/skills/graphit/references/scheduled-reports.md

@@ -0,0 +1,22 @@
+# Scheduled Reports
+
+Load before creating, changing, sending or troubleshooting a scheduled report: a dashboard emailed or posted to Slack on a schedule, optionally with agent commentary. A report delivers an existing dashboard, so build or pick the dashboard first. Delivery from a private source still needs Share for the source and its bound model.
+
+## Before creating
+
+- Before `report create`, check `report list --dashboard <id>` and update an existing report instead of creating a second.
+- Resolve destinations with `report destinations`: the Slack channels the bot can post to, the org's members (name and email) and its allowed email domains. Map the user's words ("#growth", "Dana") to those entries; an address outside members and allowed domains is refused.
+- Add only recipients and channels the user named. Confirm destinations, schedule and timezone in one line before `report create`; never widen delivery on your own.
+- A report and its commentary render with the creator's data access - yours when you create it. Say so when the recipients differ from who can open the dashboard.
+
+## Creating and changing
+
+- `report create` needs `--dashboard`, `--name`, `--frequency`, `--send-time` and at least one `--email` or `--slack`. Weekly takes `--day-of-week` (mon..sun), monthly `--day-of-month` (1-28); `--timezone` is IANA and defaults to UTC, so pass the user's.
+- `--filter key=value` sets a dashboard filter by its declared state key (state-contract.md): `a,b` for several values, `start..end` for a date range. `--instructions` adds agent commentary to every run.
+- `report update` changes only the flags passed. `--email`, `--slack`, `--filter` and `--state-file` REPLACE the stored value: read it with `report get` and send the full intended list or map. `--clear-filters` / `--clear-instructions` remove them.
+- Recipients, channels, instructions and filters are the creator's alone to change; pausing, rescheduling, sending, testing and deleting need the creator, a dashboard editor or an org admin. Report a refusal as that rule, not a fault.
+
+## Sending and checking
+
+- `report test` goes to the creator only; use it to check a render. `report send` goes to every recipient now: only when the user asks.
+- `report runs` shows each run's status, deliveries, error and commentary outcome; `report run <id> <run-id>` shows the commentary exchange (creator only). Report partial or failed delivery as it is: a run is not a delivery.

package/skills/graphit/references/share.md

@@ -12,7 +12,7 @@ For "publish", inspect the dashboard state and follow dashboard-create.md's publ
 |---|---|
 | a. Share a private dashboard | Resolve its private dependency closure, then share and file the same dashboard ID. |
 | b. Share definitions | Reuse or move the selected models/metrics into the agreed group; a bound source follows its model. |
-| c. Schedule or deliver from a private source | Plan the source and bound model's move to a shared group before configuring the requested schedule/report. The dashboard may stay private. |
+| c. Schedule or deliver from a private source | Plan the source and bound model's move to a shared group before scheduling per scheduled-reports.md. The dashboard may stay private. |
 | d. Author directly in a group | "Shared from the start": apply checks before each shared source/definition write. Build authors the new private dashboard; share it when complete. Keep the agreed scope. |
 | e. Repository-owned work | Apply the same decisions through repo-kb.md's repository/PR workflow on a capable surface. An in-app ownership refusal is a handoff, not permission for a direct-write replacement. |
 
@@ -24,7 +24,7 @@ Read kb-scope.md for effective permissions and exact placement, kb-discovery.md
 
 **KB-readiness gate:** before work goes live for others, confirm the required models, nested components, metrics, groups and rules exist and have the needed verification. If a business measure is missing, present its gap and proposed governed definition for approval, then author and verify the approved prerequisites. An ad-hoc business measure can be unavailable to governed-only viewers; do not silently publish it as a reusable governed answer. Compare actual binding, grain, time dimension, aggregation, filters, units and policy, not just names or SQL. A same-named conflicting asset is not equivalent: explain the difference and resolve the consequential choice. A truly equivalent accessible asset should be reused.
 
-Choose dashboard audience and folder through dashboard-create.md when sharing. Org sharing requires the dashboard owner to be an org admin/owner; team sharing requires ownership and actual membership. When needed, explain Private/ORG/named scopes via kb-scope.md; keep dashboard audience separate.
+Choose dashboard audience and folder through dashboard-create.md when sharing. Owners share their own; org admins/owners also any they can see. Org needs admin/owner; Team needs membership. When needed, explain Private/ORG/named scopes via kb-scope.md; keep dashboard audience separate.
 
 Before any share or publish, inspect the dashboard for `data-graphit-placeholder` markers. Refuse while any remain and offer "wire it" through build.md. Do not remove markers simply to make sharing pass; real resolves must replace the placeholders.
 

package/skills/graphit-build/SKILL.md

@@ -2,7 +2,7 @@
 name: graphit-build
 description: >-
   Author and verify Graphit dashboard content, private or shared, and build private reports, sources and saved metrics. Pair with graphit-share for shared dependencies, draft sessions and publication. Use graphit-explore for answers without artifacts.
-skill_version: "0.2.372"
+skill_version: "0.2.379"
 ---
 
 # Build: author and verify content
@@ -45,7 +45,7 @@ Use a fitting cached source first and state the chosen source. If none exists, P
 
 The scan's bound semantic model supplies the semantic layer. Use its measures and dimensions, fitting existing metrics, and explicitly labeled ad-hoc SQL where needed; ../graphit/references/governance.md and ../graphit/references/sql-reference.md own query permissions and receipts. For private work, do not create a metric unless the user asks to keep it. Then read ../graphit/references/semantic-authoring.md and ../graphit/references/kb-scope.md: use the scanner model's exact private group and source binding, preserve siblings, and verify the result. A request to keep an already agreed definition authorizes that work; resolve only a new ambiguity in its meaning. No visible private group means stop before a private write, never omit the group and land in org commons. Shared definitions follow Share's agreed group and readiness checks; loading Build does not replace them.
 
-Change coverage, filters, columns or joins for the same source purpose with `ds edit-sql`; follow its drift response. A new name is not a repair for a failed edit. Re-upload file sources through their supported flow.
+Change coverage, filters, columns or joins for the same source purpose with `ds edit-sql`; follow its drift response. A new name is not a repair for a failed edit. Update an uploaded file source in place with `graphit ds re-upload <id> --file <path>` (in the app, the person uses Re-upload file in the Sources Hub); never re-create it.
 
 When no source exists and the user asks for a sketch, mockup, wireframe or layout first, build a **layout preview** instead. Ask about this fork only when genuinely ambiguous; data first is the default.
 
@@ -59,8 +59,10 @@ When no source exists and the user asks for a sketch, mockup, wireframe or layou
 
 Build and show sections as they become useful; continue authorized work without an approval round per chart. Check the canvas, fix `entity_sql_warnings`, and verify rendering and real resolves before calling a data-backed dashboard complete. For a preview, verify layout and marker coverage and report it specifically as a preview.
 
-Without Share's established shared scope/draft, Build writes only privately. Shared authoring stays within that authorization; Share retains checks before shared dependency writes and publication. Private sources refresh manually, in full. A schedule or Slack/email delivery request needs Share for the source and its bound model; explain that and offer it if not already requested. The dashboard may remain private. A private report or export alone does not imply scheduled delivery or a visibility change.
+Without Share's established shared scope/draft, Build writes only privately. Shared authoring stays within that authorization; Share retains checks before shared dependency writes and publication. Private sources refresh manually, in full. A schedule or Slack/email delivery request needs Share for the source and its bound model; explain that and offer it if not already requested, then schedule through ../graphit/references/scheduled-reports.md. The dashboard may remain private. A private report or export alone does not imply scheduled delivery or a visibility change.
 
 For Private first, end with the private link, verification and limitations, plus one offer to share; an offer grants no permission. When sharing/publication is already requested, continue the same artifact through Share's remaining checks and report its actual outcome. Do not repeat an answered choice; obtain approval for additional effects when required. A draft-only request stays a draft.
 
+After completing a dashboard, or when the user asks for something recurring ("every Monday", "a weekly update", "send this to the team"), offer once per session to schedule it as a report; create one only after an explicit yes.
+
 <!-- WORKFLOW:END -->

package/skills/graphit-explore/SKILL.md

@@ -2,7 +2,7 @@
 name: graphit-explore
 description: >-
   Answer, explain or diagnose business data using Graphit. Use after Graphit routing or for a direct Graphit question, including reads of shared dashboards. Does not authorize creating reusable definitions or sharing; use graphit-build to keep a private artifact and graphit-share for shared writes.
-skill_version: "0.2.372"
+skill_version: "0.2.379"
 ---
 
 # Explore: answer the question

package/skills/graphit-share/SKILL.md

@@ -2,7 +2,7 @@
 name: graphit-share
 description: >-
   Share or publish Graphit work, edit shared Graphit dashboards, or author into a shared group. Use after Graphit routing or a direct Graphit shared-scope request. Pair with graphit-build for dashboard authoring. Read-only questions belong to graphit-explore.
-skill_version: "0.2.372"
+skill_version: "0.2.379"
 ---
 
 # Share: checks at the shared write
@@ -39,7 +39,7 @@ For "publish", inspect the dashboard state and follow ../graphit/references/dash
 |---|---|
 | a. Share a private dashboard | Resolve its private dependency closure, then share and file the same dashboard ID. |
 | b. Share definitions | Reuse or move the selected models/metrics into the agreed group; a bound source follows its model. |
-| c. Schedule or deliver from a private source | Plan the source and bound model's move to a shared group before configuring the requested schedule/report. The dashboard may stay private. |
+| c. Schedule or deliver from a private source | Plan the source and bound model's move to a shared group before scheduling per ../graphit/references/scheduled-reports.md. The dashboard may stay private. |
 | d. Author directly in a group | "Shared from the start": apply checks before each shared source/definition write. Build authors the new private dashboard; share it when complete. Keep the agreed scope. |
 | e. Repository-owned work | Apply the same decisions through ../graphit/references/repo-kb.md's repository/PR workflow on a capable surface. An in-app ownership refusal is a handoff, not permission for a direct-write replacement. |
 
@@ -51,7 +51,7 @@ Read ../graphit/references/kb-scope.md for effective permissions and exact place
 
 **KB-readiness gate:** before work goes live for others, confirm the required models, nested components, metrics, groups and rules exist and have the needed verification. If a business measure is missing, present its gap and proposed governed definition for approval, then author and verify the approved prerequisites. An ad-hoc business measure can be unavailable to governed-only viewers; do not silently publish it as a reusable governed answer. Compare actual binding, grain, time dimension, aggregation, filters, units and policy, not just names or SQL. A same-named conflicting asset is not equivalent: explain the difference and resolve the consequential choice. A truly equivalent accessible asset should be reused.
 
-Choose dashboard audience and folder through ../graphit/references/dashboard-create.md when sharing. Org sharing requires the dashboard owner to be an org admin/owner; team sharing requires ownership and actual membership. When needed, explain Private/ORG/named scopes via ../graphit/references/kb-scope.md; keep dashboard audience separate.
+Choose dashboard audience and folder through ../graphit/references/dashboard-create.md when sharing. Owners share their own; org admins/owners also any they can see. Org needs admin/owner; Team needs membership. When needed, explain Private/ORG/named scopes via ../graphit/references/kb-scope.md; keep dashboard audience separate.
 
 Before any share or publish, inspect the dashboard for `data-graphit-placeholder` markers. Refuse while any remain and offer "wire it" through [graphit-build](../graphit-build/SKILL.md). Do not remove markers simply to make sharing pass; real resolves must replace the placeholders.