@indigoai-us/hq-cli 5.345.109 → 5.345.111

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [5.345.111] — 2026-10-13
+- The local bot runs a Create brief job from the desktop app in a fresh model session of its own instead of resuming the owner's whole DM conversation, and schedules it like a DM rather than behind the job slot. A resumed session that fails twice in a row with the model CLI's "An unknown error occurred (Unexpected)" is cleared so the next turn starts fresh; a single failure never clears it.
+
+- Add `--personal` support to `hq db provision`, `status`, and `sql` for a person's remote database.
+- `hq capacity` now keeps its Claude OAuth sessions awake on its own: when a
+  token is about to expire it refreshes in the background, with per-home
+  backoff so busy lanes do not thrash the auth endpoint. If a refresh is
+  rejected (revoked or invalid grant), the account is reported as "signed
+  out: sign-in revoked" and the printed fix is `hq capacity login claude
+  --account <id> --repair` for a managed non-default home, or `claude auth
+  login` for the default home.
+- Refreshes fail closed when the live-lane or running-process gates cannot
+  be verified (unexpected `hq lanes list --json` shape, `ps` failure, or
+  darwin credential pre-read failure with a prior refresh token), so a
+  rotation never races a running Claude Code.
+- Doctor's refresh error record stores only the HTTP status and a fixed
+  classification (`invalid_grant`, `revoked`, `server_error`, `timeout`),
+  never a response body.
+- An expired Claude account whose newest usage reading predates the token
+  expiry is now flagged as stale, so the router does not trust an old
+  reading as live headroom.
+- `hq capacity doctor` adds a per-account Claude table showing token age,
+  time to expiry, last refresh attempt and outcome, and any backoff
+  window. All strings in the report are passed through a token-redaction
+  scrubber before display.
+
+## [5.345.110] — 2026-10-13
+- The bundled sync runner now uses hq-cloud 6.18.69, which compacts the sync-state write-ahead log into a snapshot once the log grows past a size-scaled ratio of the snapshot, so large companies stop accumulating oversized sync-state files.
+- Remove the three policy-family shell rollback copies after the native route's clean release soak. `hq core policy age-report`, `policy retire`, and `policy frontmatter` now use the native route regardless of the retained `core-native-policy` flag, which still gates `knowledge-prefs`.
+
 ## [5.345.109] — 2026-10-13
 - `hq` commands no longer fail with "The HQ CLI package is being updated" while
   the desktop app updates the CLI. They wait for the update (up to 4 minutes,

package/dist/command-catalog.generated.d.ts

@@ -1916,7 +1916,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly options: readonly [];
     readonly subcommands: readonly [{
         readonly name: "status";
-        readonly description: "Show local (and remote when bound) vault DB status; auto-creates local SQLite if missing";
+        readonly description: "Show company local/remote status or your personal database status";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -1926,7 +1926,11 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly arguments: readonly [];
         readonly options: readonly [{
             readonly flags: "--company <slug>";
-            readonly description: "Company slug (tenant scope; required)";
+            readonly description: "Company slug (tenant scope)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "Show your personal database status";
             readonly hidden: false;
         }, {
             readonly flags: "--home <path>";
@@ -1945,7 +1949,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "sql";
-        readonly description: "Run SQL against the company vault DB (local) or an app's remote database (--app); read-only by default";
+        readonly description: "Run read-only SQL against a company or personal database; use --write for changes";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -1960,7 +1964,11 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [{
             readonly flags: "--company <slug>";
-            readonly description: "Company slug (tenant scope; required)";
+            readonly description: "Company slug (tenant scope)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "Run against your personal remote database";
             readonly hidden: false;
         }, {
             readonly flags: "--app <app>";
@@ -2027,7 +2035,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "provision";
-        readonly description: "Create the company remote database (Team plan)";
+        readonly description: "Create a company remote database or your personal database";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -2039,6 +2047,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Company slug";
             readonly hidden: false;
+        }, {
+            readonly flags: "--personal";
+            readonly description: "Provision your personal database";
+            readonly hidden: false;
         }, {
             readonly flags: "--region <region>";
             readonly description: "AWS region";

package/dist/command-catalog.generated.js

@@ -2298,7 +2298,7 @@ export const COMMAND_CATALOG = [
         "subcommands": [
             {
                 "name": "status",
-                "description": "Show local (and remote when bound) vault DB status; auto-creates local SQLite if missing",
+                "description": "Show company local/remote status or your personal database status",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -2309,7 +2309,12 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--company <slug>",
-                        "description": "Company slug (tenant scope; required)",
+                        "description": "Company slug (tenant scope)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--personal",
+                        "description": "Show your personal database status",
                         "hidden": false
                     },
                     {
@@ -2333,7 +2338,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "sql",
-                "description": "Run SQL against the company vault DB (local) or an app's remote database (--app); read-only by default",
+                "description": "Run read-only SQL against a company or personal database; use --write for changes",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -2351,7 +2356,12 @@ export const COMMAND_CATALOG = [
                 "options": [
                     {
                         "flags": "--company <slug>",
-                        "description": "Company slug (tenant scope; required)",
+                        "description": "Company slug (tenant scope)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--personal",
+                        "description": "Run against your personal remote database",
                         "hidden": false
                     },
                     {
@@ -2433,7 +2443,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "provision",
-                "description": "Create the company remote database (Team plan)",
+                "description": "Create a company remote database or your personal database",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -2447,6 +2457,11 @@ export const COMMAND_CATALOG = [
                         "description": "Company slug",
                         "hidden": false
                     },
+                    {
+                        "flags": "--personal",
+                        "description": "Provision your personal database",
+                        "hidden": false
+                    },
                     {
                         "flags": "--region <region>",
                         "description": "AWS region",

package/dist/commands/capacity.d.ts

@@ -11,6 +11,7 @@
 import { Command } from "commander";
 import { type CapacityState, type LedgerEvent, type LedgerOptions, type NowView, type ParserFailureEvent, type Reading, type ReadingSource } from "../lib/capacity/ledger.js";
 import { type CapacityAccount } from "../lib/capacity/accounts.js";
+import { type ClaudeRefreshLastEntry } from "../lib/capacity/collectors/claude-oauth.js";
 export declare const CAPACITY_SCHEMA_VERSION: "hq-capacity-now-view.v1";
 export declare const DOCTOR_SCHEMA_VERSION = "hq-capacity-doctor.v1";
 export declare const PARSER_FAILURE_WINDOW_MS: number;
@@ -40,6 +41,30 @@ export interface DoctorVersion {
     installed: string | null;
     match: boolean;
 }
+export interface DoctorClaudeAccount {
+    /** Account label from the capacity registry (eg "default"). */
+    label: string;
+    /** Resolved credential home directory. */
+    home: string;
+    /** ISO timestamp of the last refresh attempt, redacted. Null when nothing was tried for this home. */
+    lastRefreshAttempt: string | null;
+    /** Outcome of the last refresh attempt. Null when nothing was tried. */
+    lastRefreshOutcome: ClaudeRefreshLastEntry["outcome"] | null;
+    /** ms since the last refresh attempt. Null when nothing was tried. */
+    tokenAgeMs: number | null;
+    /** ms until the token's recorded expiry. Negative when past expiry. Null when the collector has not recorded one. */
+    timeToExpiryMs: number | null;
+    /** ISO expiry of the token the entry describes. Null when unknown. */
+    tokenExpiresAt: string | null;
+    /** ISO backoff window end, when the last outcome set one. Null otherwise. */
+    backoffUntil: string | null;
+    /** Short, token-free diagnostic from the last attempt. Null otherwise. Never contains a response body. */
+    errorMessage: string | null;
+    /** Fixed classification string for the last error outcome. Null otherwise. */
+    errorClass: ClaudeRefreshLastEntry["errorClass"] | null;
+    /** HTTP status from the last attempt that reached the token endpoint. Null otherwise. */
+    httpStatus: number | null;
+}
 export interface DoctorReport {
     schemaVersion: typeof DOCTOR_SCHEMA_VERSION;
     collector: "on" | "off";
@@ -50,6 +75,7 @@ export interface DoctorReport {
         provider: string;
         state: CapacityState;
     }[];
+    claudeAccounts: DoctorClaudeAccount[];
     ok: boolean;
     stale: boolean;
     ageMs: number;

package/dist/commands/capacity.js

@@ -3,9 +3,9 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as readline from "node:readline";
-import { LedgerCorrupt, LedgerMissing, READING_SOURCES, capacityOptionsFromEnv, capacityRoot, nowViewJsonSchema, readCollectorMark, readLedgerEvents, readNow, rebuildNow, setCollectorEnabled, } from "../lib/capacity/ledger.js";
+import { LedgerCorrupt, LedgerMissing, READING_SOURCES, capacityOptionsFromEnv, capacityRoot, nowViewJsonSchema, readCollectorMark, readLedgerEvents, readNow, rebuildNow, redactProviderTokens, setCollectorEnabled, } from "../lib/capacity/ledger.js";
 import { listCapacityAccounts, registryAccountIds } from "../lib/capacity/accounts.js";
-import { claudeIdentityKeys } from "../lib/capacity/collectors/claude-oauth.js";
+import { claudeIdentityKeys, readClaudeRefreshLast } from "../lib/capacity/collectors/claude-oauth.js";
 import { projectCapacityView } from "../lib/capacity/project.js";
 import { capacityWidgetTimeZone, renderCapacityWidget } from "../lib/capacity/widget.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
@@ -185,6 +185,7 @@ export function buildDoctorReport(options) {
         provider: provider.provider,
         state: provider.state,
     }));
+    const claudeAccounts = buildClaudeAccountDoctor(resolved.options, resolved.nowMs);
     const freshness = capacityFreshness(view.generatedAt, resolved.nowMs);
     return {
         schemaVersion: DOCTOR_SCHEMA_VERSION,
@@ -193,11 +194,56 @@ export function buildDoctorReport(options) {
         versions,
         parserFailures,
         providers,
+        claudeAccounts,
         ok: providers.every((provider) => provider.state !== "unknown"),
         stale: freshness.stale,
         ageMs: freshness.ageMs,
     };
 }
+function buildClaudeAccountDoctor(options, nowMs) {
+    const env = options.env ?? process.env;
+    const home = options.home ?? env.HOME;
+    const root = options.root ?? capacityRoot(env, home);
+    const accounts = listCapacityAccounts({ env, hqRoot: env.HQ_ROOT, home })
+        .filter((account) => account.provider === "claude");
+    return accounts.map((account) => {
+        const entry = readClaudeRefreshLast(root, account.home);
+        if (!entry) {
+            return {
+                label: account.label,
+                home: account.home,
+                lastRefreshAttempt: null,
+                lastRefreshOutcome: null,
+                tokenAgeMs: null,
+                timeToExpiryMs: null,
+                tokenExpiresAt: null,
+                backoffUntil: null,
+                errorMessage: null,
+                errorClass: null,
+                httpStatus: null,
+            };
+        }
+        const attemptedAtMs = Date.parse(entry.attemptedAt);
+        const expiresAtMs = entry.tokenExpiresAt ? Date.parse(entry.tokenExpiresAt) : NaN;
+        const tokenAgeMs = entry.outcome === "refreshed" && Number.isFinite(attemptedAtMs)
+            ? nowMs - attemptedAtMs
+            : null;
+        const timeToExpiryMs = Number.isFinite(expiresAtMs) ? expiresAtMs - nowMs : null;
+        return {
+            label: account.label,
+            home: account.home,
+            lastRefreshAttempt: redactProviderTokens(entry.attemptedAt),
+            lastRefreshOutcome: entry.outcome,
+            tokenAgeMs,
+            timeToExpiryMs,
+            tokenExpiresAt: entry.tokenExpiresAt ?? null,
+            backoffUntil: entry.backoffUntil ?? null,
+            errorMessage: entry.errorMessage ? redactProviderTokens(entry.errorMessage) : null,
+            errorClass: entry.errorClass ?? null,
+            httpStatus: typeof entry.httpStatus === "number" ? entry.httpStatus : null,
+        };
+    });
+}
 export function formatDoctor(report) {
     const sources = formatTable(["SOURCE", "LAST SUCCESS"], report.sources.map((source) => [source.source, source.lastSuccess ?? "—"]));
     const versions = formatTable(["PROVIDER", "PINNED", "INSTALLED", "MATCH"], report.versions.map((version) => [
@@ -212,6 +258,16 @@ export function formatDoctor(report) {
     const states = report.providers.length === 0
         ? "none"
         : report.providers.map((provider) => `${provider.provider}  ${provider.state}`).join("\n");
+    const claudeAccounts = report.claudeAccounts.length === 0
+        ? "none"
+        : formatTable(["ACCOUNT", "LAST ATTEMPT", "OUTCOME", "TOKEN AGE", "EXPIRES IN", "BACKOFF UNTIL"], report.claudeAccounts.map((account) => [
+            account.label,
+            account.lastRefreshAttempt ?? "—",
+            account.lastRefreshOutcome ?? "—",
+            account.tokenAgeMs === null ? "—" : formatSignedSpan(account.tokenAgeMs),
+            account.timeToExpiryMs === null ? "—" : formatSignedSpan(account.timeToExpiryMs),
+            account.backoffUntil ?? "—",
+        ]));
     const warning = report.stale
         ? report.ageMs === 0
             ? "collector not running, numbers may be stale; last update unknown"
@@ -226,8 +282,14 @@ export function formatDoctor(report) {
         failures,
         "provider state",
         states,
+        "claude accounts",
+        claudeAccounts,
     ].join("\n");
 }
+function formatSignedSpan(ms) {
+    const span = formatSpan(Math.floor(Math.abs(ms) / 1000));
+    return ms < 0 ? `-${span}` : span;
+}
 export function registerCapacityCommand(program) {
     const capacity = program
         .command("capacity")

package/dist/commands/core-policy.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from 'commander';
+import { policyValidatorDiagnostic } from '../lib/policy-validator.js';
 import { type FrontmatterResult } from './core-policy-frontmatter.js';
 export type CorePolicyResult = {
     code: number;
@@ -7,7 +8,9 @@ export type CorePolicyResult = {
 };
 export declare function runPolicyAgeReport(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, nowEpoch?: number, platform?: NodeJS.Platform): CorePolicyResult;
 export declare function runPolicyFrontmatter(args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): FrontmatterResult;
-export declare function runPolicyRetire(args: readonly string[], root: string, cwd: string, env?: NodeJS.ProcessEnv, now?: Date): CorePolicyResult;
+export declare function runPolicyRetire(args: readonly string[], root: string, cwd: string, env?: NodeJS.ProcessEnv, now?: Date, dependencies?: {
+    validatePolicy?: typeof policyValidatorDiagnostic;
+}): CorePolicyResult;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runPolicyFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;
 export declare function registerCorePolicyCommand(core: Command): void;

package/dist/commands/core-policy.js

@@ -4,14 +4,15 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { policyValidatorDiagnostic } from '../lib/policy-validator.js';
-import { resolveLiveRoot, resolveBundledAsset } from '../utils/hq-roots.js';
-import { runBundledScript } from '../utils/run-bundled-script.js';
+import { packageRoot, resolveLiveRoot } from '../utils/hq-roots.js';
 import { describeCoreCommand } from './core-command-catalog.js';
 import { runPolicyFrontmatter as runPolicyFrontmatterImpl } from './core-policy-frontmatter.js';
 import { awkCannotOpenFileDiagnostic } from '../lib/core-utils/awk-diagnostics.js';
-const POLICY_AGE_REPORT_ASSET = 'core/scripts/policy-age-report.sh';
-const POLICY_RETIRE_ASSET = 'core/scripts/policy-retire.sh';
-const POLICY_FRONTMATTER_ASSET = 'core/scripts/read-policy-frontmatter.sh';
+const POLICY_AGE_REPORT_SCRIPT = 'core/scripts/policy-age-report.sh';
+const POLICY_RETIRE_SCRIPT = 'core/scripts/policy-retire.sh';
+function formerScriptPath(relativePath) {
+    return path.join(packageRoot(), 'assets/scaffold', relativePath);
+}
 const AGE_HELP = [
     '# hq-core: public',
     '# policy-age-report.sh — measure policy usage and flag retirement candidates',
@@ -389,7 +390,7 @@ function bashTestGreaterOrEqual(left, right, scriptPath, line, platform) {
     return { value: BigInt(left) >= parsed, stderr: '' };
 }
 export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Math.floor(Date.now() / 1000), platform = process.platform) {
-    const parsed = parseAgeOptions(args, resolveBundledAsset(POLICY_AGE_REPORT_ASSET));
+    const parsed = parseAgeOptions(args, formerScriptPath(POLICY_AGE_REPORT_SCRIPT));
     if (parsed.kind === 'help')
         return policyResult(0, AGE_HELP);
     if (parsed.kind === 'error')
@@ -448,13 +449,13 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             const singleIncident = ['user-correction', 'session-learning', 'back-pressure-failure'].includes(source) && (version || '1') === '1';
             const classes = [];
             if (fired === 0) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 173, platform);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, formerScriptPath(POLICY_AGE_REPORT_SCRIPT), 173, platform);
                 stderr += comparison.stderr;
                 if (comparison.value && usage.anyFiles)
                     classes.push('never-fired');
             }
             if (fired > 0) {
-                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 174, platform);
+                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, formerScriptPath(POLICY_AGE_REPORT_SCRIPT), 174, platform);
                 stderr += comparison.stderr;
                 if (comparison.value)
                     classes.push('dormant');
@@ -464,7 +465,7 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             if (refs.renamed.length > 0)
                 classes.push('renamed-refs');
             if (singleIncident) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 178, platform);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, formerScriptPath(POLICY_AGE_REPORT_SCRIPT), 178, platform);
                 stderr += comparison.stderr;
                 if (comparison.value && fired <= 1)
                     classes.push('single-incident-old');
@@ -625,7 +626,7 @@ function rewriteStatus(content, status, reason, by, now) {
     }
     return Buffer.concat(output);
 }
-function setPolicyStatus(filePath, status, reason, by, env, now, cwd = process.cwd()) {
+function setPolicyStatus(filePath, status, reason, by, env, now, cwd = process.cwd(), validatePolicy = policyValidatorDiagnostic) {
     const resolvedPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
     let content;
     try {
@@ -639,7 +640,7 @@ function setPolicyStatus(filePath, status, reason, by, env, now, cwd = process.c
     if (!firstLine(content)?.toString('latin1').startsWith('---')) {
         return { ok: false, error: `policy-retire: ${filePath} has no frontmatter\n` };
     }
-    const diagnostic = policyValidatorDiagnostic(content.toString('utf8'), resolvedPath, env);
+    const diagnostic = validatePolicy(content.toString('utf8'), resolvedPath, env);
     if (diagnostic !== undefined) {
         // Bash command substitution in policy-retire.sh strips all trailing newlines
         // from the validator output before printf adds its single final newline.
@@ -929,8 +930,8 @@ function fromReport(options, root, cwd, env, now) {
         stdout += `policy-retire: ${selected} would be retired [${options.className}] (add --yes)\n`;
     return policyResult(0, stdout, stderr);
 }
-export function runPolicyRetire(args, root, cwd, env = process.env, now = new Date()) {
-    const parsed = parseRetireOptions(args, resolveBundledAsset(POLICY_RETIRE_ASSET), env);
+export function runPolicyRetire(args, root, cwd, env = process.env, now = new Date(), dependencies = {}) {
+    const parsed = parseRetireOptions(args, formerScriptPath(POLICY_RETIRE_SCRIPT), env);
     if (parsed.kind === 'help')
         return policyResult(0, RETIRE_HELP);
     if (parsed.kind === 'error')
@@ -946,14 +947,14 @@ export function runPolicyRetire(args, root, cwd, env = process.env, now = new Da
     if (file === undefined)
         return policyResult(3, '', `policy-retire: no policy found for '${options.target}'\n`);
     if (options.restore) {
-        const updated = setPolicyStatus(file, 'active', '', options.by, env, now, cwd);
+        const updated = setPolicyStatus(file, 'active', '', options.by, env, now, cwd, dependencies.validatePolicy);
         if (!updated.ok)
             return policyResult(1, '', updated.error);
         return policyResult(0, `policy-retire: restored ${displayPolicyPath(file, root)}\n`);
     }
     if (!options.reason)
         return policyResult(2, '', 'policy-retire: --reason is required\n');
-    const updated = setPolicyStatus(file, 'retired', options.reason, options.by, env, now, cwd);
+    const updated = setPolicyStatus(file, 'retired', options.reason, options.by, env, now, cwd, dependencies.validatePolicy);
     if (!updated.ok)
         return policyResult(1, '', updated.error);
     return policyResult(0, `policy-retire: retired ${displayPolicyPath(file, root)} — ${options.reason}\n`);
@@ -983,7 +984,7 @@ export function runPolicyFast(args, _stdin, cwd, hqRoot, commandName) {
 }
 export function registerCorePolicyCommand(core) {
     const group = core.command('policy').description('Policy maintenance commands');
-    const register = (name, asset, summary, rootKind) => {
+    const register = (name, summary, rootKind) => {
         const command = group
             .command(name)
             .description(summary)
@@ -991,47 +992,24 @@ export function registerCorePolicyCommand(core) {
             .allowExcessArguments()
             .helpOption(false)
             .argument('[args...]', 'arguments passed through to the scaffold command');
-        describeCoreCommand(command, { execution: 'native', asset, root: rootKind });
+        describeCoreCommand(command, { execution: 'native', root: rootKind });
         return command;
     };
-    const ageReport = register('age-report', POLICY_AGE_REPORT_ASSET, 'Report policy usage and retirement candidates', 'live');
+    const ageReport = register('age-report', 'Report policy usage and retirement candidates', 'live');
     ageReport.action(async (args = [], _options, command) => {
         const operands = command.args.length > 0 ? command.args : args;
-        const { coreNativePolicyEnabled } = await import('./core-native-policy-flag.js');
-        if (!await coreNativePolicyEnabled()) {
-            const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
-            const result = runBundledScript({ asset: POLICY_AGE_REPORT_ASSET, args: operands, cwd: process.cwd(), hqRoot: root });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
         writeResult(runPolicyAgeReport(operands, root));
     });
-    const retire = register('retire', POLICY_RETIRE_ASSET, 'Retire or restore a policy', 'live');
+    const retire = register('retire', 'Retire or restore a policy', 'live');
     retire.action(async (args = [], _options, command) => {
         const operands = command.args.length > 0 ? command.args : args;
-        const { coreNativePolicyEnabled } = await import('./core-native-policy-flag.js');
-        if (!await coreNativePolicyEnabled()) {
-            const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
-            const result = runBundledScript({ asset: POLICY_RETIRE_ASSET, args: operands, cwd: process.cwd(), hqRoot: root });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
         writeResult(runPolicyRetire(operands, root, process.cwd()));
     });
-    const frontmatter = register('frontmatter', POLICY_FRONTMATTER_ASSET, 'Extract policy frontmatter', 'cwd');
+    const frontmatter = register('frontmatter', 'Extract policy frontmatter', 'cwd');
     frontmatter.action(async (args = [], _options, command) => {
         const operands = command.args.length > 0 ? command.args : args;
-        const { coreNativePolicyEnabled } = await import('./core-native-policy-flag.js');
-        if (!await coreNativePolicyEnabled()) {
-            const result = runBundledScript({ asset: POLICY_FRONTMATTER_ASSET, args: operands, cwd: process.cwd() });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         writeResult(runPolicyFrontmatter(operands, process.cwd()));
     });
 }

package/dist/commands/core.js

@@ -306,17 +306,12 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/secret-patterns.sh", root: "live", summary: "Secret-pattern library sourced by the delegate rollback shells" },
     // Native knowledge-prefs retains its own shell companion until its family PR.
     { asset: "core/scripts/knowledge-prefs.sh", root: "live", summary: "Rollback companion for native knowledge-prefs" },
-    // Rollback companions for the default-off native knowledge and policy routes.
-    // policy-retire also runs the scaffold validator in-process when native, but
-    // its bundled shell fallback needs both helper assets at these exact paths.
-    { asset: "core/scripts/policy-age-report.sh", root: "live", summary: "Rollback companion for native policy age-report" },
-    { asset: "core/scripts/policy-retire.sh", root: "live", summary: "Rollback companion for native policy retire" },
-    { asset: "core/scripts/read-policy-frontmatter.sh", root: "cwd", summary: "Rollback companion for native policy frontmatter" },
+    // Retained policy helpers used by the policy validator and trigger tooling.
     { asset: "core/scripts/eval-trigger.sh", root: "live", summary: "Trigger grammar helper used by the policy validator companion" },
     { asset: "core/scripts/migrate-policy-triggers.sh", root: "live", summary: "Rollback shell for native migrate-policy-triggers" },
     { asset: "core/scripts/register-project.sh", root: "live", summary: "Rollback shell for native register-project" },
     { asset: "core/scripts/work-mesh-live-rebind.sh", root: "live", summary: "Rollback shell for native work-mesh-live-rebind" },
-    { asset: ".claude/hooks/validate-policy-frontmatter.sh", root: "live", summary: "Policy validator companion used by policy-retire rollback" },
+    { asset: ".claude/hooks/validate-policy-frontmatter.sh", root: "live", summary: "Hook-time policy frontmatter validator" },
     // Wave 2a handoff shells remain bundled as the default-off rollback path.
     { asset: "core/scripts/handoff-finalize.sh", root: "live", summary: "Rollback shell for native handoff finalize" },
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },

package/dist/commands/db-provision.js

@@ -9,24 +9,43 @@ import { defaultRemoteDeps, describeRemoteError, } from "./db-remote-deps.js";
 const defaultDeps = defaultRemoteDeps;
 export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
     db.command("provision")
-        .description("Create the company remote database (Team plan)")
-        .requiredOption("--company <slug>", "Company slug")
+        .description("Create a company remote database or your personal database")
+        .option("--company <slug>", "Company slug")
+        .option("--personal", "Provision your personal database")
         .option("--region <region>", "AWS region", "us-east-1")
         .action(async (opts) => {
         try {
             const deps = depsFactory();
             const company = String(opts.company ?? "").trim();
-            if (!company) {
-                console.error(chalk.red("Error: --company is required"));
+            if (opts.personal && opts.company !== undefined) {
+                console.error(chalk.red("Error: --personal cannot be used with --company"));
+                process.exitCode = 1;
+                return;
+            }
+            if (!opts.personal && !company) {
+                console.error(chalk.red("error: required option '--company <slug>' not specified"));
                 process.exitCode = 1;
                 return;
             }
-            const resolved = await deps.resolveCompany(company);
             const client = new ControlPlaneDbClient({
                 baseUrl: deps.apiBaseUrl,
                 getAccessToken: deps.getAccessToken,
                 fetchImpl: deps.fetchImpl,
             });
+            if (opts.personal) {
+                const result = await client.personalProvision({ region: opts.region });
+                if (result.status === "provisioning") {
+                    console.log("Your personal database is still being set up. Run this again in a minute.");
+                }
+                else if (result.idempotent || result.status === "existing") {
+                    console.log(`Your personal database already exists and is ready (${result.region}).`);
+                }
+                else {
+                    console.log(`Your personal database is ready (${result.region}).`);
+                }
+                return;
+            }
+            const resolved = await deps.resolveCompany(company);
             const result = await client.provision({
                 companyUid: resolved.companyUid,
                 companySlug: resolved.companySlug,
@@ -50,11 +69,13 @@ export function registerDbProvisionCommand(db, depsFactory = defaultDeps) {
             const status = error.status;
             if (described) {
                 console.error(chalk.red("Error:"), described);
-                if (status === 501 || error.code === "REMOTE_DB_NOT_AVAILABLE") {
-                    console.error(chalk.dim("Local hq db status|sql|migrate still work offline."));
-                }
-                else {
-                    console.error(chalk.dim("Local databases still work: hq db status|sql|migrate."));
+                if (!opts.personal) {
+                    if (status === 501 || error.code === "REMOTE_DB_NOT_AVAILABLE") {
+                        console.error(chalk.dim("Local hq db status|sql|migrate still work offline."));
+                    }
+                    else {
+                        console.error(chalk.dim("Local databases still work: hq db status|sql|migrate."));
+                    }
                 }
             }
             else if (status === 404) {

package/dist/commands/db-remote-deps.js

@@ -54,6 +54,18 @@ export function describeRemoteError(error) {
         return error.message;
     const status = error.status;
     const code = error.code;
+    if (code === "PERSONAL_DB_NOT_ENABLED") {
+        return "Personal databases are not turned on for your account.";
+    }
+    if (code === "PERSONAL_DB_NOT_PROVISIONED") {
+        return "You don't have a personal database yet. Run: hq db provision --personal";
+    }
+    if (code === "PERSONAL_DB_APP_LIMIT") {
+        return "Your personal database already holds 8 apps, which is the limit.";
+    }
+    if (status === 404 && error.personalRoute) {
+        return "The HQ API does not support personal databases yet. Update the CLI or try again later.";
+    }
     if (code === "REMOTE_DB_NOT_AVAILABLE" || status === 501) {
         const reason = error.reason;
         const message = error.message;