@indigoai-us/hq-cli 5.189.0 → 5.191.0

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [5.191.0] — 2026-09-25
+
+### Fixed
+
+- `hq agents provision` now rejects an invalid `--slug` before sending the agent create request.
+
+## [5.190.0] — 2026-09-25
+
+### Added
+
+- `hq lanes` validates story references against project `prd.json` files and records
+  explicit `--no-story` reasons. When `lanes.story-ledger` is enabled, lane state,
+  blockers, questions, and PR links sync back to project stories. Terminal history
+  writes are atomic and retry-safe. Stale-lock cleanup reclaims abandoned ownerless
+  locks after their directory ages while preserving fresh replacements.
+  `hq lanes status --project` summarizes workers, PRs, blockers, questions, and story
+  counts.
+
+### Fixed
+
+- `hq bot promote` accepts server-signed upload URLs without SSE headers when the bucket supplies encryption. SSE header names are checked case-insensitively, and any supplied encryption must be a complete SSE-KMS pair.
+- Company slug lookup errors now point to the supported `hq sources entities` command.
+
+### Added
+
+- QMD native-binding startup failures after sync can emit an actionable warning
+  when the `qmd.reindex-startup-warning` hq-flags canary is enabled. The flag
+  defaults off, and sync still succeeds when indexing cannot run.
+
 ## [5.189.0] — 2026-09-25
 
 ### Added
@@ -70,6 +99,14 @@
 
 ### Added
 
+- `hq lanes` validates story references against project `prd.json` files and records
+  explicit `--no-story` reasons. When `lanes.story-ledger` is enabled, lane state,
+  blockers, questions, and PR links sync back to project stories. Terminal history
+  writes are atomic and retry-safe. Stale-lock cleanup reclaims abandoned ownerless
+  locks after their directory ages while preserving fresh replacements.
+  `hq lanes status --project` summarizes workers, PRs,
+  blockers, questions, and story counts.
+
 - `hq doctor --json` includes stable sync `reasonCode` enums. Client-health reports add `checkId: reasonCode` pairs only when the company-scoped `client-health-sync-reason-codes` hq-flags gate is enabled. `hq doctor --fix --json` reports refresh-sync outcomes without raw error details.
 
 - Repair known stale QMD collection paths behind the default-off `qmd.collection-path-repair` hq-flags canary while preserving collection metadata.

package/dist/command-catalog.generated.d.ts

@@ -6868,6 +6868,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--story <id>";
             readonly description: "Story id from the project's prd.json";
+        }, {
+            readonly flags: "--no-story <reason>";
+            readonly description: "Create a lane without a story and record why";
         }, {
             readonly flags: "--additional-story <id>";
             readonly description: "Additional story carried by this lane; repeatable and discouraged when active";
@@ -6998,7 +7001,28 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Filter by senior ref";
         }, {
             readonly flags: "--json";
-            readonly description: "JSON on stdout (always)";
+            readonly description: "Emit JSON on stdout (default)";
+        }, {
+            readonly flags: "--human";
+            readonly description: "Emit human-readable output";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "status";
+        readonly description: "Summarize project stories, lanes, PRs, blockers, and pending questions";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--project <slug>";
+            readonly description: "HQ project slug";
+        }, {
+            readonly flags: "--company <slug|uid>";
+            readonly description: "Company project scope; omit for a personal project";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Emit JSON on stdout";
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -8874,6 +8874,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--story <id>",
                         "description": "Story id from the project's prd.json"
                     },
+                    {
+                        "flags": "--no-story <reason>",
+                        "description": "Create a lane without a story and record why"
+                    },
                     {
                         "flags": "--additional-story <id>",
                         "description": "Additional story carried by this lane; repeatable and discouraged when active"
@@ -9044,7 +9048,34 @@ export const COMMAND_CATALOG = [
                     },
                     {
                         "flags": "--json",
-                        "description": "JSON on stdout (always)"
+                        "description": "Emit JSON on stdout (default)"
+                    },
+                    {
+                        "flags": "--human",
+                        "description": "Emit human-readable output"
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "status",
+                "description": "Summarize project stories, lanes, PRs, blockers, and pending questions",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--project <slug>",
+                        "description": "HQ project slug"
+                    },
+                    {
+                        "flags": "--company <slug|uid>",
+                        "description": "Company project scope; omit for a personal project"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Emit JSON on stdout"
                     }
                 ],
                 "subcommands": []

package/dist/commands/agents.js

@@ -55,6 +55,8 @@ export const VALID_PROVIDERS = new Set(["codex", "grok", "claude", "agents-v2"])
 export const VALID_AUTH_MODES = new Set(["subscription", "apiKey"]);
 /** Customer-facing agent size keys served by hq-pro's authoritative catalog. */
 export const VALID_AGENT_SIZE_KEYS = new Set(["basic", "power", "dev"]);
+// Keep cloud agent create slugs aligned with hq-pro-agents POST /v1/agents.
+const AGENT_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
 const CLAUDE_PROVISION_COMMAND = "hq agents provision <name> --provider agents-v2 --model claude-opus-5-5";
 const CLAUDE_API_KEY_ARGS = "--auth-mode apiKey --api-key-env <VAR>";
 function claudeProvisionGuidance() {
@@ -1281,6 +1283,12 @@ export function registerAgentsCommand(program) {
         .addHelpText("after", `\n${claudeProvisionGuidance()}\n`)
         .action(async function (name, opts) {
         try {
+            const slug = opts.slug ?? slugifyAgentName(name);
+            if (!AGENT_SLUG_PATTERN.test(slug)) {
+                console.error(chalk.red("Agent slug must start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens, and be at most 63 characters. " +
+                    "Update --slug or the agent name."));
+                process.exit(1);
+            }
             // Both of these previously fell back to their default on an
             // unrecognised value, silently provisioning a billable box the operator
             // did not ask for. They now exit(1) instead — see parseEnumOption.
@@ -1341,7 +1349,6 @@ export function registerAgentsCommand(program) {
             // Every path confirms hq-pro's company-specific quote. Omission still
             // leaves the POST size implicit, preserving the server-side default.
             confirmAgentCreateQuoteOrExit(quotedSize, opts.yes, opts.json);
-            const slug = opts.slug ?? slugifyAgentName(name);
             try {
                 const result = await provisionAgent(token, {
                     companyUid,

package/dist/commands/lanes.d.ts

@@ -1,7 +1,7 @@
 /**
  * `hq lanes` — worker lane management and decision queue (spec §5–§7, §10–§11).
  *
- * Existing commands print JSON on stdout and take no interactive input, except
+ * Existing commands print JSON on stdout by default and take no interactive input, except
  * `accounts login`, which hands the terminal to the vendor's own sign-in.
  * `watch` and the monitor reminder are the line-oriented text surfaces.
  */
@@ -80,6 +80,8 @@ export interface LanesCommandDeps {
     lanePlacementEnabled?: () => boolean;
     /** Test seam for the default-off lane hire-grants rollout gate. */
     laneHireGrantsEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
+    /** Test seam for the default-off story ledger flag. */
+    storyLedgerEnabled?: () => boolean;
     /** Test seam for the SSM-only Outpost owner grant path. */
     isSsmOwnerDispatch?: () => boolean;
     /** Test seam for changing a lane between pre-lock and locked grant reads. */

package/dist/commands/lanes.js

@@ -1,7 +1,7 @@
 /**
  * `hq lanes` — worker lane management and decision queue (spec §5–§7, §10–§11).
  *
- * Existing commands print JSON on stdout and take no interactive input, except
+ * Existing commands print JSON on stdout by default and take no interactive input, except
  * `accounts login`, which hands the terminal to the vendor's own sign-in.
  * `watch` and the monitor reminder are the line-oriented text surfaces.
  */
@@ -10,6 +10,7 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { Option } from "commander";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
@@ -29,7 +30,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { openMeshTransport } from "../lib/mesh/client.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, LANE_HIRE_GRANTS_FLAG, planHireGrantBackfill, withHireGrantAdmission, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, DEFAULT_ACCOUNT_HOMES, LANE_PROVIDERS, LANE_STATES, PROVIDER_HOME_ENV, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installDrainHook, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, LANE_HIRE_GRANTS_FLAG, planHireGrantBackfill, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listAccountStatuses, listLaneIds, listQuestionIds, listSessionLiveness, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseLivenessState, parseQuestionStatus, parseSeniorKind, readDaemonPresenceConnected, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, writeLanesConfig, appendDropboxMessage, answerDropboxMessage, deliveryRefusalReason, resumeCommandRefusal, dropboxDir, dropboxInboxPath, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, withLaneAdmissionLock, withLaneHireLocks, laneIdForAnswerDelivery, operatorMessageRefusalReason, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -257,6 +258,7 @@ function resolveDeps(deps = {}) {
         fetchText: deps.fetchText ?? defaultFetchText,
         lanePlacementEnabled: deps.lanePlacementEnabled ?? defaultLanePlacementEnabled,
         laneHireGrantsEnabled: deps.laneHireGrantsEnabled ?? defaultLaneHireGrantsEnabled,
+        storyLedgerEnabled: deps.storyLedgerEnabled ?? laneStoryLedgerEnabled,
         isSsmOwnerDispatch: deps.isSsmOwnerDispatch ?? (() => isSsmRunCommandProcess()),
         withGrantHireLocks: deps.withGrantHireLocks ?? withLaneHireLocks,
         laneClaudeAccountBalanceEnabled: deps.laneClaudeAccountBalanceEnabled ?? defaultLaneClaudeAccountBalanceEnabled,
@@ -2112,18 +2114,28 @@ async function runCreate(ctx, opts) {
     const meshCompanyFlag = opts.meshCompany?.trim();
     const project = opts.project?.trim();
     const story = opts.story?.trim();
+    const noStoryReason = opts.noStory?.trim();
     const additionalStories = (opts.additionalStory ?? []).map((value) => value.trim());
     const briefFile = opts.briefFile?.trim();
     if (!project) {
         throw new LanesError("missing_project", "--project is required", {});
     }
-    if (!story) {
+    if (opts.story !== undefined && opts.noStory !== undefined) {
+        throw new LanesError("story_selection_conflict", "Pass either --story or --no-story, not both", {});
+    }
+    if (opts.noStory !== undefined && !noStoryReason) {
+        throw new LanesError("missing_no_story_reason", "--no-story requires a non-empty reason", {});
+    }
+    if (!story && !noStoryReason) {
         throw new LanesError("missing_story", "--story is required", {});
     }
+    if (noStoryReason && additionalStories.length > 0) {
+        throw new LanesError("story_selection_conflict", "--additional-story requires --story and cannot be used with --no-story", {});
+    }
     if (additionalStories.some((value) => value.length === 0)) {
         throw new LanesError("missing_story", "--additional-story values must be non-empty", {});
     }
-    const storyIds = [story, ...additionalStories];
+    const storyIds = story ? [story, ...additionalStories] : [];
     if (new Set(storyIds).size !== storyIds.length) {
         throw new LanesError("duplicate_story", "A lane cannot carry the same project/story more than once", {
             project_id: project,
@@ -2174,6 +2186,9 @@ async function runCreate(ctx, opts) {
         throw new LanesError("max_lane_depth", `Lane depth ${laneDepth} exceeds cap ${MAX_LANE_DEPTH}`, { depth: laneDepth, max: MAX_LANE_DEPTH });
     }
     // A no-company lane must not call company resolution (openMeshTransport).
+    if (storyIds.length > 0 && ctx.storyLedgerEnabled()) {
+        validateProjectStories(hqRoot, project, storyIds, company?.slug);
+    }
     let meshCompany = company;
     if (meshCompanyFlag) {
         const resolvedMeshCompany = await ctx.resolveCompany(meshCompanyFlag);
@@ -2189,7 +2204,7 @@ async function runCreate(ctx, opts) {
     const seniorCompany = companyOfSenior(hqRoot, senior, ctx);
     assertSameTenant(company, senior, seniorCompany);
     const createStoryWarnings = [];
-    if (meshCompany) {
+    if (meshCompany && storyIds.length > 0) {
         const warning = await storyBoardWarning(ctx, meshCompany, project, storyIds);
         if (warning !== undefined)
             createStoryWarnings.push(warning);
@@ -2630,7 +2645,8 @@ async function runCreate(ctx, opts) {
                 ? { mesh_company: meshCompany }
                 : {}),
             project_id: project,
-            story_id: story,
+            story_id: story ?? "",
+            ...(noStoryReason ? { no_story_reason: noStoryReason } : {}),
             stories: storyIds.map((storyId) => ({
                 project_id: project,
                 story_id: storyId,
@@ -3416,6 +3432,9 @@ async function runPickup(ctx, opts) {
     });
 }
 async function runList(ctx, opts) {
+    if (opts.json && opts.human) {
+        throw new LanesError("conflicting_output_format", "Use either --json or --human for hq lanes list", { json: true, human: true });
+    }
     const hqRoot = ctx.hqRoot();
     const state = opts.state ? parseLaneState(opts.state) : undefined;
     const senior = opts.senior ? parseSeniorRef(opts.senior) : undefined;
@@ -3430,9 +3449,11 @@ async function runList(ctx, opts) {
         .filter((lane) => {
         if (state && lane.state !== state)
             return false;
-        if ((opts.project || opts.story) &&
-            !laneStories(lane).some((story) => (!opts.project || story.project_id === opts.project) &&
-                (!opts.story || story.story_id === opts.story))) {
+        const carriesFilter = laneStories(lane).some((story) => (!opts.project || story.project_id === opts.project) &&
+            (!opts.story || story.story_id === opts.story));
+        const matchingNoStory = !opts.story && opts.project !== undefined &&
+            lane.no_story_reason !== undefined && lane.project_id === opts.project;
+        if ((opts.project || opts.story) && !carriesFilter && !matchingNoStory) {
             return false;
         }
         if (company && !recordMatchesCompany(lane, company)) {
@@ -3465,6 +3486,9 @@ async function runList(ctx, opts) {
         return {
             ...lane,
             ...hireByLane.get(lane.lane_id),
+            stories: laneStories(lane),
+            story_ids: laneStories(lane).map((story) => story.story_id),
+            no_story_reason: lane.no_story_reason ?? null,
             ...(remoteQueued
                 ? { state: "remote", remote_state: lane.state, queued_reason: undefined }
                 : {}),
@@ -3486,12 +3510,74 @@ async function runList(ctx, opts) {
     const host_capacity = ctx.lanePlacementEnabled()
         ? (await loadHostCapacitySnapshots(ctx, hqRoot)).entries
         : undefined;
-    printJson({
+    const result = {
         ok: true,
         action: "list",
         lanes,
         ...(host_capacity !== undefined ? { host_capacity } : {}),
+    };
+    if (opts.human)
+        console.log(formatLaneListHuman(lanes));
+    else
+        printJson(result);
+}
+function formatLaneListHuman(lanes) {
+    if (lanes.length === 0)
+        return "No lanes.";
+    return lanes.map((lane) => {
+        const ids = lane.story_ids;
+        const storyLabel = ids.length > 0
+            ? "stories: " + ids.join(", ")
+            : "no story: " + (lane.no_story_reason ?? "reason not recorded");
+        return lane.lane_id + "  " + lane.state + "  " + lane.provider + "  " + lane.project_id +
+            "  " + storyLabel;
+    }).join("\n");
+}
+async function runStatus(ctx, opts) {
+    if (!ctx.storyLedgerEnabled()) {
+        throw new LanesError("story_ledger_disabled", "hq lanes status requires the lanes.story-ledger flag", {
+            flag: "lanes.story-ledger",
+        });
+    }
+    const hqRoot = ctx.hqRoot();
+    const company = opts.company ? await ctx.resolveCompany(opts.company) : undefined;
+    const lanes = loadAllLanes(hqRoot).filter((lane) => lane.company?.slug === company?.slug);
+    const pending = new Map();
+    for (const lane of lanes) {
+        const refs = [];
+        for (const questionId of lane.pending_question_ids ?? []) {
+            const question = readQuestion(hqRoot, questionId);
+            const sameCompany = question.company === null
+                ? lane.company === null
+                : lane.company !== null &&
+                    question.company.uid === lane.company.uid &&
+                    question.company.slug === lane.company.slug;
+            if (question.lane_id !== lane.lane_id || !sameCompany) {
+                throw new LanesError("story_ledger_question_mismatch", `Pending question ${questionId} does not belong to lane ${lane.lane_id}`, { lane_id: lane.lane_id, question_id: questionId, question_lane_id: question.lane_id });
+            }
+            if (question.status === "pending") {
+                refs.push({
+                    question_id: question.question_id,
+                    project_id: question.project_id,
+                    story_id: question.story_id,
+                });
+            }
+        }
+        pending.set(lane.lane_id, refs);
+    }
+    const snapshot = buildLaneStatusSnapshot({
+        hqRoot,
+        projectId: opts.project,
+        ...(company ? { companySlug: company.slug } : {}),
+        ...(company ? { companyUid: company.uid } : {}),
+        lanes,
+        generatedAt: ctx.now().toISOString(),
+        pendingQuestions: pending,
     });
+    if (opts.json)
+        printJson(snapshot);
+    else
+        console.log(formatLaneStatusHuman(snapshot));
 }
 async function runCapacity(ctx) {
     const hqRoot = ctx.hqRoot();
@@ -4736,6 +4822,12 @@ async function runMessage(ctx, laneId, opts) {
     const at = ctx.now().toISOString();
     const projectId = opts.project?.trim() || lane.project_id;
     const storyId = opts.story?.trim() || lane.story_id;
+    if (opts.story !== undefined && !opts.story.trim()) {
+        throw new LanesError("missing_story", "--story must be non-empty", {});
+    }
+    if ((opts.project !== undefined || opts.story !== undefined) && ctx.storyLedgerEnabled()) {
+        validateProjectStories(hqRoot, projectId, [storyId], lane.company?.slug);
+    }
     const dropboxMessage = {
         at,
         message_id: messageId,
@@ -4889,6 +4981,7 @@ async function runMessage(ctx, laneId, opts) {
                 ...current,
                 project_id: projectId,
                 story_id: storyId,
+                no_story_reason: storyId ? undefined : current.no_story_reason,
                 stories: laneStory(current, projectId, storyId)
                     ? laneStories(current)
                     : [
@@ -5190,6 +5283,12 @@ async function runResume(ctx, laneId, opts) {
     const at = ctx.now().toISOString();
     const projectId = opts.project?.trim() || lane.project_id;
     const storyId = opts.story?.trim() || lane.story_id;
+    if (opts.story !== undefined && !opts.story.trim()) {
+        throw new LanesError("missing_story", "--story must be non-empty", {});
+    }
+    if ((opts.project !== undefined || opts.story !== undefined) && ctx.storyLedgerEnabled()) {
+        validateProjectStories(hqRoot, projectId, [storyId], lane.company?.slug);
+    }
     const attributionChanged = projectId !== lane.project_id || storyId !== lane.story_id;
     const messageId = text !== undefined || attributionChanged ? mintMessageId() : undefined;
     let requestedMeshCompany;
@@ -5370,6 +5469,7 @@ async function runResume(ctx, laneId, opts) {
                 ...current,
                 project_id: projectId,
                 story_id: storyId,
+                no_story_reason: storyId ? undefined : current.no_story_reason,
                 stories: laneStory(current, projectId, storyId)
                     ? laneStories(current)
                     : [
@@ -5460,8 +5560,7 @@ function addCarriedStory(lane, projectId, storyId, at) {
     }
     return {
         ...lane,
-        project_id: projectId,
-        story_id: storyId,
+        ...(lane.story_id.trim() ? {} : { project_id: projectId, story_id: storyId }),
         stories: [
             ...laneStories(lane),
             { project_id: projectId, story_id: storyId, status: "in_progress", added_at: at, updated_at: at },
@@ -5521,7 +5620,7 @@ async function emitStoryTransition(ctx, lane, projectId, storyId, event, status,
     const company = lane.mesh_company ?? lane.company;
     if (!company)
         return;
-    const ready = await ensureStoryThread(ctx, lane, projectId);
+    const ready = await ensureStoryThread(ctx, lane, projectId, storyId);
     if (!ready.thread_id)
         return;
     await emitLaneMeshEvent(ctx, company, ready.thread_id, event, {
@@ -5593,6 +5692,9 @@ async function runStoryAdd(ctx, laneId, storyId, opts) {
     const normalizedStoryId = storyId.trim();
     if (!normalizedStoryId)
         throw new LanesError("missing_story", "<story-id> is required", {});
+    if (ctx.storyLedgerEnabled()) {
+        validateProjectStories(hqRoot, projectId, [normalizedStoryId], lane.company?.slug);
+    }
     const company = lane.mesh_company ?? lane.company;
     const warnings = [];
     if (company) {
@@ -5608,7 +5710,11 @@ async function runStoryAdd(ctx, laneId, storyId, opts) {
     const before = lane;
     const next = casUpdateLane(hqRoot, laneId, (current) => {
         assertLaneRunsHereForOperatorMutation(ctx, current, "update story status for");
-        return addCarriedStory(current, projectId, normalizedStoryId, at);
+        const added = addCarriedStory(current, projectId, normalizedStoryId, at);
+        return {
+            ...added,
+            no_story_reason: undefined,
+        };
     });
     const transitionWarning = await commitStoryTransition(ctx, before, next, projectId, normalizedStoryId, "lane_started", "in_progress");
     if (transitionWarning !== undefined)
@@ -6953,13 +7059,16 @@ export function registerLanesCommand(parent, deps = {}) {
         .command("lanes", { hidden: true })
         .description("Create, supervise, and steer worker lanes; routed decision queue");
     registerOutpostPrunerCommand(lanes);
+    const noStoryOption = new Option("--no-story <reason>", "Create a lane without a story and record why");
+    noStoryOption.attributeName = () => "noStory";
     lanes
         .command("create")
         .description("Register a lane, run admission, and return immediately")
         .option("--company <slug|uid>", "Company slug or cloud uid; omit for a core/personal lane")
         .option("--mesh-company <slug|uid>", "Explicit Work Mesh company for a personal lane; membership is verified")
         .requiredOption("--project <slug>", "HQ project slug")
-        .requiredOption("--story <id>", "Story id from the project's prd.json")
+        .option("--story <id>", "Story id from the project's prd.json")
+        .addOption(noStoryOption)
         .option("--additional-story <id>", "Additional story carried by this lane; repeatable and discouraged when active", collectRepeatable)
         .requiredOption("--brief-file <path>", "Path to the lane brief")
         .option("--worker <name>", "HQ worker or reusable profile id")
@@ -7009,10 +7118,20 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--story <id>", "Filter by story")
         .option("--state <state>", `Filter by state (${LANE_STATES.join("|")})`)
         .option("--senior <ref>", "Filter by senior ref")
-        .option("--json", "JSON on stdout (always)")
+        .option("--json", "Emit JSON on stdout (default)")
+        .option("--human", "Emit human-readable output")
         .action(wrap(async (opts) => {
         await runList(ctx, opts);
     }));
+    lanes
+        .command("status")
+        .description("Summarize project stories, lanes, PRs, blockers, and pending questions")
+        .requiredOption("--project <slug>", "HQ project slug")
+        .option("--company <slug|uid>", "Company project scope; omit for a personal project")
+        .option("--json", "Emit JSON on stdout")
+        .action(wrap(async (opts) => {
+        await runStatus(ctx, opts);
+    }));
     lanes
         .command("capacity")
         .description("Report this host's lane capacity by provider and account")

package/dist/lib/bot/promotion-upload.js

@@ -7,6 +7,22 @@ function assertState(state, bundle, companyUid, operationId) {
         state.phase !== "preparing")
         throw new Error("Promotion preparation returned a different identity or phase");
 }
+function hasValidEncryptionHeaders(headers) {
+    const valuesFor = (name) => Object.entries(headers)
+        .filter(([key]) => key.toLowerCase() === name)
+        .map(([, value]) => value);
+    const encryptionValues = valuesFor("x-amz-server-side-encryption");
+    const keyIdValues = valuesFor("x-amz-server-side-encryption-aws-kms-key-id");
+    // Multiple differently-cased copies are ambiguous, even when their values
+    // happen to match. Accept one exact SSE-KMS pair or no effective SSE values.
+    if (encryptionValues.length > 1 || keyIdValues.length > 1)
+        return false;
+    const encryption = encryptionValues[0] ?? "";
+    const keyId = keyIdValues[0] ?? "";
+    if (!encryption.trim() && !keyId.trim())
+        return true;
+    return encryption === "aws:kms" && Boolean(keyId.trim());
+}
 /** Only the presigned object request receives these bytes. Owner authorization
  * is handled by BotApi and is never forwarded to S3 or a redirect destination.
  */
@@ -15,8 +31,7 @@ async function uploadObject(upload, bytes, fetchImpl) {
     if (url.protocol !== "https:" || url.username || url.password || url.port ||
         !/^[a-z0-9.-]+\.s3(?:[.-][a-z0-9-]+)?\.amazonaws\.com$/.test(url.hostname) ||
         upload.method !== "PUT" || upload.bytes !== bytes.length || upload.sha256 !== sha(bytes) ||
-        upload.headers["x-amz-server-side-encryption"] !== "aws:kms" ||
-        !upload.headers["x-amz-server-side-encryption-aws-kms-key-id"] ||
+        !hasValidEncryptionHeaders(upload.headers) ||
         upload.headers["if-none-match"] !== "*" ||
         upload.headers["x-amz-checksum-sha256"] !== Buffer.from(upload.sha256, "hex").toString("base64") ||
         Object.keys(upload.headers).some(key => /^(authorization|cookie)$/i.test(key))) {

package/dist/lib/core-utils/qmd-reindex-after-sync.d.ts

@@ -1,6 +1,8 @@
 import { type EmbedLockDependencies } from "../search-index/embed-lock.js";
 import { type LoadGateDependencies } from "../search-index/load-gate.js";
 import { type UtilityIo } from "./common.js";
+export declare const QMD_REINDEX_STARTUP_WARNING_FLAG = "qmd.reindex-startup-warning";
+export declare const QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK = false;
 export type QmdReindexOptions = UtilityIo & {
     cwd?: string;
     /** Test seams; default to the real search-index implementations. */
@@ -17,6 +19,8 @@ export type QmdReindexOptions = UtilityIo & {
     embedLockDependencies?: EmbedLockDependencies;
     /** Test seams for the host load gate consulted while the embed lock is held. */
     loadGateDependencies?: LoadGateDependencies;
+    /** Test seam for the hq-flags-gated warning on qmd native startup failures. */
+    startupFailureWarningsEnabled?: () => boolean;
 };
 export declare function qmdReindexAfterSync(args?: string[], options?: QmdReindexOptions): number;
 //# sourceMappingURL=qmd-reindex-after-sync.d.ts.map

package/dist/lib/core-utils/qmd-reindex-after-sync.js

@@ -15,7 +15,14 @@ import { reconcileCollections, resolveQmdBin, resolveQmdHome, runQmd } from "../
 import { applyIndexSizeLimit } from "../search-index/max-doc-bytes.js";
 import { defaultEmbedLockDependencies, runWithEmbedLock, } from "../search-index/embed-lock.js";
 import { LoadGateConfigurationError, checkEmbedLoad, defaultLoadGateDependencies, recordSuccessfulEmbed, } from "../search-index/load-gate.js";
+import { resolveProcessFlagGate } from "../flag-registry.js";
+import { isQmdNativeBindingError, QMD_NATIVE_BINDING_REMEDY, } from "../../utils/qmd-native-binding-error.js";
 import { ioFor, line } from "./common.js";
+export const QMD_REINDEX_STARTUP_WARNING_FLAG = "qmd.reindex-startup-warning";
+export const QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK = false;
+function qmdStartupFailureWarningsEnabled() {
+    return resolveProcessFlagGate(QMD_REINDEX_STARTUP_WARNING_FLAG, { fallback: QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK }, () => QMD_REINDEX_STARTUP_WARNING_FLAG_FALLBACK);
+}
 export function qmdReindexAfterSync(args = [], options = {}) {
     let hqRoot = "";
     let embed = false;
@@ -42,6 +49,15 @@ export function qmdReindexAfterSync(args = [], options = {}) {
     const run = options.run ?? ((argv, opts) => runQmd(argv, opts));
     const sizeLimit = options.sizeLimit ?? ((root) => applyIndexSizeLimit(root));
     const { stderr } = ioFor(options);
+    let startupFailureWarningShown = false;
+    const warnOnNativeStartupFailure = (error) => {
+        if (startupFailureWarningShown ||
+            !isQmdNativeBindingError(error) ||
+            !(options.startupFailureWarningsEnabled ?? qmdStartupFailureWarningsEnabled)())
+            return;
+        startupFailureWarningShown = true;
+        line(stderr, `hq: search index was not updated after sync; ${QMD_NATIVE_BINDING_REMEDY}`);
+    };
     // Every qmd interaction is best-effort: the shell suffixed each with `|| true`.
     try {
         reconcile(hqRoot, { bin });
@@ -62,7 +78,8 @@ export function qmdReindexAfterSync(args = [], options = {}) {
     try {
         run(["update"], { bin, cwd: hqRoot });
     }
-    catch {
+    catch (error) {
+        warnOnNativeStartupFailure(error);
         /* never fail a sync on index freshness */
     }
     if (embed) {
@@ -91,6 +108,7 @@ export function qmdReindexAfterSync(args = [], options = {}) {
         catch (error) {
             if (error instanceof LoadGateConfigurationError)
                 line(stderr, `hq: ${error.message}`);
+            warnOnNativeStartupFailure(error);
             /* embeddings are deferred-cost and optional */
         }
     }

package/dist/lib/lanes/index.d.ts

@@ -16,6 +16,8 @@ export { DEFAULT_ACCOUNT_HOMES, DEFAULT_AUTO_COMPACT_TOKENS, DEFAULT_COMPACT_AFT
 export type { ConfigLoadDeps, ConfigWriteDeps } from "./config.js";
 export { resolveLanesHqRoot } from "./hq-root.js";
 export type { LanesHqRootOpts } from "./hq-root.js";
+export { LANE_STORY_LEDGER_FLAG, buildLaneStatusSnapshot, formatLaneStatusHuman, laneStoryLedgerEnabled, resolveProjectStoryLedger, syncLaneToProjectStoryLedger, validateProjectStories, } from "./story-ledger.js";
+export type { LaneStatusSnapshot, ProjectStoryLedger, StoryLedgerWriteDeps } from "./story-ledger.js";
 export { buildOutpostPickupCommand, parseOutpostPickupPayload, } from "./outpost-dispatch.js";
 export type { OutpostDispatchResult, OutpostPickupPayload, } from "./outpost-dispatch.js";
 export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, syncLaneRecordFromOwner, updateLane, updateQuestion, withLaneHireLocks, } from "./store.js";

package/dist/lib/lanes/index.js

@@ -10,6 +10,7 @@ export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HIS
 export { ACTIVE_LANE_STORY_STATUSES, activeLaneStories, laneStories, laneStory, storyKey, storyStatusForEnvelope, storyWarning, withCurrentStory, withLaneStories, } from "./stories.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_AUTO_COMPACT_TOKENS, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerAutoCompactTokens, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export { resolveLanesHqRoot } from "./hq-root.js";
+export { LANE_STORY_LEDGER_FLAG, buildLaneStatusSnapshot, formatLaneStatusHuman, laneStoryLedgerEnabled, resolveProjectStoryLedger, syncLaneToProjectStoryLedger, validateProjectStories, } from "./story-ledger.js";
 export { buildOutpostPickupCommand, parseOutpostPickupPayload, } from "./outpost-dispatch.js";
 export { LANES_STORE_REL, LANE_RECORDS_DIR, PENDING_INDEX_DIR, QUESTION_RECORDS_DIR, appendCappedHistory, appendLaneAttribution, appendLaneSeniorHistory, appendQuestionRouting, createLane, createQuestion, isConflictSidecarName, laneRecordPath, lanesStoreRoot, listLaneIds, listQuestionIds, mergeLaneRecords, mergeQuestionRecords, mintLaneId, mintQuestionId, parseLaneRecord, parseQuestionRecord, pendingMarkerPath, questionRecordPath, readLane, readQuestion, resolveStoreHqRoot, sanitizeHostComponent, tryReadLane, tryReadQuestion, retryUpdateLane, retryUpdateQuestion, syncLaneRecordFromOwner, updateLane, updateQuestion, withLaneHireLocks, } from "./store.js";
 export { DEFAULT_LANE_WATCH_INTERVAL_MS, MAX_LANE_WATCH_INTERVAL_MS, MAX_WATCHED_LANES, MAX_WATCH_OUTPUT_LINES, runLaneWatch, } from "./watch.js";