@lumoai/cli 1.48.0 → 1.50.0

package/assets/skill/SKILL.md

@@ -32,6 +32,7 @@ The command catalog below is a **map**: it lists every command grouped by domain
 | `verify`, `task status` — machine verification loop, claim-done flow, self-check/resume | [references/verify.md](references/verify.md)                   |
 | `cost` — per-operation (per-tool) token cost read-out; `task lineage` Top-5             | [references/task-context.md](references/task-context.md)       |
 | `outcome show/record/rate` — post-hoc outcome well (falsifier oracle, rejection-only)   | [references/outcome.md](references/outcome.md)                 |
+| `fidelity show` — per-delivery grounding + independence change-pattern read-out         | [references/fidelity.md](references/fidelity.md)               |
 | `project list`, `milestone*`                                                            | [references/milestones.md](references/milestones.md)           |
 | `doc create/update/list/move/bind/share/import` (CRUD)                                  | [references/docs.md](references/docs.md)                       |
 | `doc show --raw/--section`, `doc patch/append/diff/rebuild-source` (editing live docs)  | [references/doc-editing.md](references/doc-editing.md)         |
@@ -101,7 +102,16 @@ The command catalog below is a **map**: it lists every command grouped by domain
 
 - `lumo outcome show <task>` — read the post-hoc outcome well: the **falsifier** verdict (`REJECTED` | `INCONCLUSIVE` — never a "pass") plus its backing rejection signals. `INCONCLUSIVE` = no rejection on record, **not** "satisfied".
 - `lumo outcome record <task> --note "<what reality did>" [--kind <kind>]` — record a human-observed post-hoc **rejection** of a delivery (revert / rollback / CI regression / downstream redirect / bypass). Append-only; **there is no "mark satisfied" counterpart** — the well only asserts rejection. `--note` is required (the observed referent).
-- `lumo outcome rate [--min N] [--json]` — workspace **trust × post-hoc-fate** join (LUM-603): per delivery-time forecast-confidence bracket (high/medium/low), the post-hoc REJECTED rate from the well. Honest by construction — thin brackets read `insufficient` (no fabricated rate), the high-vs-low comparison stays `inconclusive` until CIs separate, and the rate is a **lower bound** (no signal = INCONCLUSIVE, never satisfied). Under-sampled today by design — the skeleton produces real strata once the well fills.
+- `lumo outcome rate [--min N] [--json]` — workspace **trust × post-hoc-fate** join (LUM-603, LUM-606): per delivery-time **verification-friction** bucket (`no-verification` / `single-round` / `multi-round-or-sendback` — two raw counts frozen at delivery, replacing the saturating forecast-confidence axis), the post-hoc REJECTED rate from the well. Honest by construction — thin buckets read `insufficient` (no fabricated rate), the single-round-vs-multi comparison stays `inconclusive` until CIs separate, and the rate is a **lower bound** (no signal = INCONCLUSIVE, never satisfied). Bucket names are value-neutral — direction is decided by the correlation, never welded into the label. Under-sampled today by design — the skeleton produces real strata once the well fills.
+
+**Fidelity read-out (mechanical change-pattern)** — see [fidelity.md](references/fidelity.md)
+
+- `lumo fidelity show <task> [--json]` — per delivery snapshot (LUM-609), a **composition table, not a single score**: (1) the **grounding** of the frozen contract — grounded (`EXTERNAL_FACT`, a machine-checkable upper bound) / self-confirming (`AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION`) / inconclusive (`PENDING_OUTCOME` + `UNCLASSIFIED`, surfaced not swallowed) + the full effective-kind tally; (2) the **independence** signal — criteria `ADDED`/`UPDATED` at round>0 (after work started) that the delivery rode on = backward-inference suspects. Purely mechanical (timing + op + grounding) — **no direction verdict**. A no-snapshot task is reported explicitly (not a pass). Zero new storage — reads the snapshot + `CRITERION_CHANGED` trail.
+
+```bash
+lumo fidelity show LUM-42
+lumo fidelity show LUM-42 --json
+```
 
 **Artifacts & Figma** — see [artifacts-figma.md](references/artifacts-figma.md)
 
@@ -147,7 +157,8 @@ The command catalog below is a **map**: it lists every command grouped by domain
 **Sessions** — see [sessions.md](references/sessions.md)
 
 - `lumo session attach <id>` — bind this session to a task (then run `task context`). **Lifetime lock**: re-attaching to the same task is a no-op; attaching to a _different_ task is refused with 409 — start a new Claude Code session instead. No `--force`, no `session detach`.
-- `lumo session status` — show current binding
+- `lumo session attach --steward <milestone>` — bind this session to a **milestone** as a **STEWARD (governance) session** (LUM-640): plan & accept only. Governance passes (task create/update, criteria set incl. `--human`, deps confirm/dismiss, `verdict --fail` with session provenance, milestone add/remove, all reads); implementation is gated (`lumo verify` → 409 **without burning a round**; moving a task to in_progress assigned to yourself → 409); commits/PRs produced anyway are recorded as milestone-scoped boundary crossings (fail-closed; disposition stays web+human-only, no CLI clear path). Same lifetime lock: same milestone idempotent, any other attach (a task, or a different milestone) → 409; multiple stewards per milestone are fine. See [sessions.md](references/sessions.md)
+- `lumo session status` — show current binding (a task, or the milestone + STEWARD role)
 - End-of-session housekeeping is fully automatic (no command). On DONE the server runs three best-effort silent passes: Layer-1 memory curation, fragment-usage audit, and blocked-tag automation. See [sessions.md](references/sessions.md)
 - Git-suggest at session start (suggests `session attach`, never auto-binds) + Layer-2 project-memory review — see the reference
 
@@ -169,7 +180,7 @@ lumo criteria audit
    - `EXTERNAL_FACT` — declared as externally observable (git SHA, CI status, DB row) and the checkpointer invokes real external tooling
    - `AGENT_CONSTRUCTED_STATE` — passes by checking output the agent itself produced
    - `PENDING_OUTCOME` — deferred to post-hoc falsifier
-   - `UNVERIFIED_ASSERTION` — declared `EXTERNAL_FACT` but the checkpointer does **not** actually invoke external tooling (git/CI/HTTP); downgraded by the audit
+   - `UNVERIFIED_ASSERTION` — declared `EXTERNAL_FACT` but the checkpointer does **not** actually invoke external tooling (git/CI/HTTP); auto-downgraded. As of LUM-605 this is an **enforced gate, not just a label**: `lumo task criteria set` warns on it, and `lumo verify` blocks a PASS on it with **422 (no round burned)** until it's re-grounded or honestly re-declared `AGENT_CONSTRUCTED_STATE` (see references/criteria.md "referentKind")
    - `UNCLASSIFIED` — legacy rows predating the `referentKind` field (null in DB)
 
 2. **Self-confirming-green headline ratio** — `(AGENT_CONSTRUCTED_STATE + UNVERIFIED_ASSERTION) / classified`. Criteria in these two buckets pass by confirming only the agent's own work, not an independent external state.
@@ -182,6 +193,7 @@ Don't guess these:
 
 - No `lumo session start` — binding is `lumo session attach <LUM-N>`
 - No `lumo session detach` — the session↔task binding is a lifetime lock; to work on a different task, start a new Claude Code session
+- No steward "role switch" or un-steward — `session attach --steward` is the same lifetime lock on a milestone; a steward session never converts to an implementation session (and there is no CLI path to clear its boundary crossings)
 - No `lumo task delete` — tasks can't be deleted from the CLI (web UI only)
 - No `lumo task artifact edit` — it's `lumo task artifact update`
 - No `lumo auth status` — identity check is `lumo whoami`

package/assets/skill/references/criteria.md

@@ -60,6 +60,21 @@ The 3–7 range is calibrated for typical multi-file tasks. Criterion count must
 
 ### judgeSteps — agent-drafted judging steps for HUMAN criteria
 
+**`referentKind` — what the criterion anchors (required, and a real gate as of LUM-605):**
+
+Every criterion declares one `referentKind` — the only dimension that decides whether a PASS is independent or self-confirming. Required on every item (the API rejects a missing one with 400):
+
+- `EXTERNAL_FACT` — anchored on a fact the agent cannot author: a git SHA / diff, CI status, an HTTP probe, a DB row, `prisma migrate status`. **Only honest when the checkpointer actually invokes external tooling** (`git`/`gh`/`curl`/`psql`/…) AND its output or exit status reaches the verdict (piped into an assertion, captured in `$(…)`, or the terminal command whose exit IS the verdict). A no-op or output-discarded external command (`git --version && cat frozen.txt | grep`) does **not** count.
+- `AGENT_CONSTRUCTED_STATE` — passes by checking output the agent itself produced: **your own jest/vitest/tsc/node/tsx tests, build, type-check**. This is the honest kind for almost every code task's checks. Green here is self-confirming — that's fine, just label it truthfully.
+- `PENDING_OUTCOME` — truth lands post-delivery (a downstream regression, a revert). Has no check today: it **cannot** be MACHINE (the API rejects PENDING_OUTCOME + MACHINE). Draft it HUMAN or leave it out of the encoded contract.
+
+**The gate (LUM-605):** declaring `EXTERNAL_FACT` + MACHINE on a checkpointer that doesn't ground external (e.g. `npx jest …`) is the LUM-601 fakeGit shape — it would launder a self-confirming green into a "verified external fact". The system now downgrades it to `UNVERIFIED_ASSERTION` and:
+
+- at **`criteria set`** — stores it but returns a non-rejecting ⚠ warning naming the criterion (re-ground or re-declare);
+- at **`lumo verify`** — a PASS on it is **blocked with 422 (no round burned)**; the round does not land and the task does not move to IN_REVIEW until you either re-ground the checkpointer against a real external fact, or honestly re-declare it `AGENT_CONSTRUCTED_STATE`. Both fixes are free (no round consumed).
+
+Don't reach for `EXTERNAL_FACT` to look stronger — a jest test is `AGENT_CONSTRUCTED_STATE`, full stop. Reserve `EXTERNAL_FACT` for checks that truly read external state, or use a HUMAN criterion for "a person ran the real system and observed X" (HUMAN is never mechanically downgraded).
+
 A HUMAN criterion is judged by a person, not a checkpointer — so don't hand them a bare assertion ("the copy reads naturally") and make them reverse-engineer what to do. Attach **`judgeSteps`**: short, human-readable instructions the adjudication card renders verbatim (light markdown, URLs made clickable). Structured labour is yours; the human just follows the steps.
 
 **Shape — 1–3 steps, always in this order:**
@@ -78,6 +93,7 @@ A HUMAN criterion is judged by a person, not a checkpointer — so don't hand th
 {
   "statement": "The acceptance tab reads as plain operational instructions, not agent-voice assertions",
   "verifierType": "HUMAN",
+  "referentKind": "AGENT_CONSTRUCTED_STATE",
   "judgeSteps": "Open the task's Acceptance tab (the IN_REVIEW card). For each HUMAN criterion, read its 'How to judge' block. Pass if each one names where to look, what to do, and what counts as pass vs send-back; send back if any reads as a bare assertion with no steps."
 }
 ```
@@ -97,12 +113,14 @@ Two real-repo invariant examples — `prisma/migrations/` files never deleted (t
   {
     "statement": "No file under prisma/migrations/ is deleted by this change (vs origin/main)",
     "verifierType": "MACHINE",
-    "checkpointer": "bash -c \"test -z \\\"$(git diff --diff-filter=D --name-only origin/main -- prisma/migrations/)\\\"\""
+    "checkpointer": "bash -c \"test -z \\\"$(git diff --diff-filter=D --name-only origin/main -- prisma/migrations/)\\\"\"",
+    "referentKind": "EXTERNAL_FACT"
   },
   {
     "statement": "Live-doc keeps its table structure after the edit (no rows/headings dropped)",
     "verifierType": "MACHINE",
-    "checkpointer": "npx tsx scripts/verify-live-doc.ts <docId> docs/live-docs/<file>.md"
+    "checkpointer": "npx tsx scripts/verify-live-doc.ts <docId> docs/live-docs/<file>.md",
+    "referentKind": "AGENT_CONSTRUCTED_STATE"
   }
 ]
 ```
@@ -120,17 +138,20 @@ One invariant criterion is usually enough — it's the guardrail, not the whole
   {
     "statement": "PUT /api/tasks/[id]/criteria rejects a second AGENT_DRAFT submission with 409",
     "verifierType": "MACHINE",
-    "checkpointer": "npx jest __tests__/task-criteria.service.test.ts -t 'agent lock'"
+    "checkpointer": "npx jest __tests__/task-criteria.service.test.ts -t 'agent lock'",
+    "referentKind": "AGENT_CONSTRUCTED_STATE"
   },
   {
     "statement": "The criteria section reads naturally as part of the task statement",
     "verifierType": "HUMAN",
+    "referentKind": "AGENT_CONSTRUCTED_STATE",
     "judgeSteps": "Open the task's Acceptance tab. Read the contract top to bottom. Pass if it scans as one coherent definition of done; send back if a criterion reads as boilerplate or contradicts another."
   },
   {
     "statement": "Session-start injection shows the contract ahead of memory",
     "verifierType": "MACHINE",
     "checkpointer": "npx jest __tests__/cli/hook-runner-session-start-stdout.test.ts",
+    "referentKind": "AGENT_CONSTRUCTED_STATE",
     "evidenceRequired": true
   }
 ]
@@ -141,6 +162,7 @@ Fields:
 - `statement` — required, ≤2000 chars.
 - `verifierType` — `"MACHINE"` | `"HUMAN"`.
 - `checkpointer` — required for MACHINE.
+- `referentKind` — **required**, `"EXTERNAL_FACT"` | `"AGENT_CONSTRUCTED_STATE"` | `"PENDING_OUTCOME"` (see "referentKind" above). Your own tests/build/type-check are `AGENT_CONSTRUCTED_STATE`; `EXTERNAL_FACT` is gated (warned at set, 422 at verify) unless the checkpointer truly grounds external; `PENDING_OUTCOME` can't be MACHINE.
 - `evidenceRequired` — optional, default false.
 - `judgeSteps` — optional, ≤2000 chars; agent-drafted human-judging steps for a HUMAN criterion (see "judgeSteps" above).
 - `id` — only in `--human` revisions (see below).

package/assets/skill/references/fidelity.md

@@ -0,0 +1,32 @@
+# Fidelity read-outs (mechanical change-pattern)
+
+`lumo fidelity` is the fidelity-axis read surface — pure, read-only analytics over what the acceptance loop already records, in the same family as `lumo criteria audit` and `lumo outcome rate`. It adds **no storage and no write path**; it only reads the LUM-609 delivery snapshots and the `CRITERION_CHANGED` audit trail.
+
+## `lumo fidelity show <task>`
+
+```bash
+lumo fidelity show LUM-42
+lumo fidelity show LUM-42 --json
+```
+
+For **each delivery** of the task (one append-only `TaskCriteriaSnapshot` per fresh IN_REVIEW entry — a reopen→re-deliver appends another), it discloses two compositions and deliberately stops there. There is **no single fidelity score and no good/bad direction verdict** — the read-out is purely mechanical (timing + op + checkpointer grounding; it never reads statement or diff semantics).
+
+### 1. Grounding composition
+
+Runs the same `effectiveReferentKind` classifier the LUM-605 verify gate uses over the **frozen** contract (delivery-time truth, not the since-edited `latest`), rolled into three buckets plus the full per-kind tally:
+
+- **grounded** — `EXTERNAL_FACT` (anchored on a fact the agent cannot author: a git SHA/diff, CI status, a DB row). This count is a **machine-checkable _upper bound_** — the checkpointer heuristic can over-count external grounding, never under-count it.
+- **self-confirming** — `AGENT_CONSTRUCTED_STATE` + `UNVERIFIED_ASSERTION` (passes by checking the agent's own output, incl. a declared-EXTERNAL_FACT checkpointer that doesn't truly ground external).
+- **inconclusive** — `PENDING_OUTCOME` + `UNCLASSIFIED` (not mechanically resolvable here). **Surfaced, never silently swallowed.**
+
+### 2. Independence signal
+
+A criterion is a **backward-inference suspect** when it is both (a) in this delivery's frozen contract and (b) was `ADDED`/`UPDATED` at **round>0** (after work started) at or before the freeze — i.e. the contract the delivery rode on was bent after the work began rather than fixed up front. round-0 (initial-draft) criteria are clean; `DELETED` ops and edits recorded after the freeze (a later cycle) don't count. Each suspect shows its `op`, `round`, and `causeTag`. The read-out **counts and discloses — it does not judge** whether a given edit was legitimate sharpening or tampering (that direction call is left to a human / a later axis).
+
+### Caveat (printed on every report)
+
+The time anchor is the **work-start boundary** (`Task.workStartedAt`), so the independence signal detects a contract edited _after work started_ — not specifically _after output was produced_. A task with **no delivery snapshot** (never entered IN_REVIEW, or predates the LUM-609 freeze) is reported explicitly — "nothing to read yet", which is **not** a pass.
+
+`--json` emits the full report (`taskId`, `workStartedAt`, `hasSnapshots`, `deliveries[]` with `grounding`/`independence`, `caveat`) for scripting.
+
+**When to suggest**: when the user wants to see how externally-grounded a task's delivered acceptance contract actually was, or whether criteria were added/changed after work began (independence). It's a disclosure tool, not a gate — it never blocks DONE and emits no verdict.

package/assets/skill/references/milestones.md

@@ -73,6 +73,8 @@ Accepts UUID or name. With a name, `--project <ref>` is required when the worksp
 
 Prints a key:value header (name, status, **health**, dates, project, description), task counts, and the full task table under the milestone. The `Health:` line shows the same target-date risk light as `milestone list` (`ON-TRACK` / `AT-RISK` / `OVERDUE`, or `-` when none applies).
 
+**Staleness hints (LUM-624):** the `Status:` line is annotated `(stale — task progress indicates <STATUS>; auto-updating)` when the stored status lags the task-derived one (the server self-heals the drift in the background — a re-read shows the corrected status), and the `Target:` line is annotated `(no target date — schedule health unavailable)` for an in-flight milestone with no target date.
+
 It also prints a **Sprint coverage** section (above the task table) listing which
 sprints the milestone's tasks span — each row shows the sprint number, status, name,
 and `done/total` progress — plus an `Unscheduled` line counting milestone tasks not in any
@@ -107,6 +109,8 @@ lumo milestone show 11111111-2222-3333-4444-555555555555
 
 At least one field required.
 
+**Status rolls up automatically (LUM-624):** milestone status follows task completion — PLANNED → ACTIVE when any task starts, → COMPLETED when every task is DONE (stamps `completedAt`, triggers the retro summary), and COMPLETED → ACTIVE when a non-DONE task (re)appears. A manual `--status planned/active/completed` that contradicts task reality gets reconciled back on the next task event or detail read; `--status cancelled` and archived milestones are human terminal choices the rollup never touches. You normally don't need `--status completed` by hand anymore.
+
 ```bash
 lumo milestone update "Q3 Launch" --status active
 lumo milestone update "Q3 Launch" --target 2026-09-15

package/assets/skill/references/outcome.md

@@ -40,7 +40,7 @@ lumo outcome record LUM-42 --note "downstream rewrote the API shape this task in
 
 ## `lumo outcome rate [--min N] [--json]`
 
-The workspace-level **trust × post-hoc-fate** join (LUM-603). For every delivery that has a frozen forecast snapshot, it buckets the delivery by its **delivery-time forecast-confidence** (high / medium / low — the only trust axis frozen at delivery, recomputed from the snapshot's `cohortSize` / `tokenCostBasis`) and reports each bracket's post-hoc **REJECTED** rate from the well. The question it answers once data is sufficient: _do high-trust deliveries get rejected by reality less often than low-trust ones?_
+The workspace-level **trust × post-hoc-fate** join (LUM-603, LUM-606). For every delivery that has a frozen forecast snapshot, it buckets the delivery by its **delivery-time verification friction** — two raw counts (`verificationRounds`, `sendBackCount`) frozen at delivery from the append-only `VerificationRun` log, cut at `capturedAt`, then bucketed value-neutrally into `no-verification` / `single-round` / `multi-round-or-sendback` — and reports each bucket's post-hoc **REJECTED** rate from the well. The friction axis replaced the original sample-size forecast-confidence axis (LUM-606), which saturated: every mature-project delivery landed in `high`, so `high`-vs-`low` could never compare. The question it answers once data is sufficient: _do deliveries that took more verification friction get rejected by reality more (fragility) or less (scrutiny) often?_ The bucket names carry **no** good/bad direction — the correlation, not the label, decides.
 
 ```bash
 lumo outcome rate
@@ -49,17 +49,17 @@ lumo outcome rate --min 20 --json
 
 This is the falsifier discipline applied at the **query layer** — it refuses to manufacture a finding off a thin sample:
 
-- A bracket with fewer than `--min` (default 10) deliveries reads **`insufficient`** with the rate withheld — the raw `rejected/delivered` counts are still shown, but never divided into a believable proportion.
-- The per-bracket rate is an explicit **lower bound** on true failure: the well only records rejections, so a zero-signal delivery is `INCONCLUSIVE` (counted in the denominator), never "satisfied".
-- The headline **high-vs-low** comparison asserts a direction **only** when both brackets are measured _and_ their 95% confidence intervals are disjoint; otherwise it stays **`inconclusive`**.
+- A bucket with fewer than `--min` (default 10) deliveries reads **`insufficient`** with the rate withheld — the raw `rejected/delivered` counts are still shown, but never divided into a believable proportion.
+- The per-bucket rate is an explicit **lower bound** on true failure: the well only records rejections, so a zero-signal delivery is `INCONCLUSIVE` (counted in the denominator), never "satisfied".
+- The **`single-round` vs `multi-round-or-sendback`** comparison asserts a direction **only** when both buckets are measured _and_ their 95% confidence intervals are disjoint; otherwise it stays **`inconclusive`**. `no-verification` is never a comparison arm (silence is not a friction level).
 
-**Expect `inconclusive` today.** The well is freshly wired and under-sampled — that is the designed state, not a bug. The same command produces real strata once enough post-hoc signals accumulate (the deferred outcome the skeleton exists to read).
+**Expect `inconclusive` today.** The well is freshly wired and the discriminating end of the friction axis is sparse (multi-round/send-back deliveries are rare) — that is the designed state, not a bug. The same command produces real strata once enough post-hoc signals accumulate against the populated friction buckets (the deferred outcome the skeleton exists to read).
 
-> Scope note (debt-a): the trust axis is **task-level** forecast confidence only. Fragment-level trust is not frozen at delivery and drifts, so it is deliberately **not** joined here — doing so would read a post-hoc value against a past delivery. Freezing fragment trust is a separate follow-up.
+> Scope note: friction is frozen **at delivery** and cut at `capturedAt`, so it is replayable and never reads a drifted current value. A delivery with no `VerificationRun` before capture is its own `no-verification` bucket — absence of verification is never folded into `single-round` (silence ≠ a clean pass).
 
 ## When to suggest
 
 - A teammate says a shipped task **was reverted / rolled back / broke prod / got redone / was bypassed** — record it with `lumo outcome record` so the well carries reality's verdict.
 - Auditing whether a "done" task actually held up — `lumo outcome show <task>` reads the well.
-- Asking whether **higher-confidence deliveries actually fail less** (does delivery-time trust predict post-hoc fate?) — `lumo outcome rate`. Expect `inconclusive` until the well fills; it will never print a correlation the sample can't support.
+- Asking whether **verification friction predicts post-hoc fate** (do harder-to-verify deliveries fail more, or less?) — `lumo outcome rate`. Expect `inconclusive` until the well fills; it will never print a correlation the sample can't support.
 - **Never** use it to mark something good: the well has no positive verdict by design. To assert a delivery met its contract, that is the acceptance loop (`lumo verify` / `lumo task status`), not the well.

package/assets/skill/references/sessions.md

@@ -113,12 +113,40 @@ A successful `session attach` also runs a **best-effort team-memory downsync** f
 Error: this session is permanently bound to LUM-7 "Other task". A session works one task for its lifetime — start a new Claude Code session to work on LUM-42.
 ```
 
-There is no `--force` and no `session detach`. To work on a different task, open a new terminal / Claude Code session and run `lumo session attach <new-task>` there.
+There is no `--force` and no `session detach`. To work on a different task, open a new terminal / Claude Code session and run `lumo session attach <new-task>` there. A session already bound as **STEWARD** of a milestone (below) also 409s here — it can never attach a task.
 
 #### When to suggest
 
 If `session attach` returns 409, do not retry or look for a workaround — start a fresh Claude Code session for the target task.
 
+### `lumo session attach --steward <milestone>` — bind as a STEWARD (governance) session (LUM-640)
+
+The **second legal session form**: instead of a task, the session binds a **milestone** and becomes a governance role — it plans and accepts, it never implements.
+
+```bash
+lumo session attach --steward "Agent-Native Milestones"   # by name (case-insensitive)
+lumo session attach --steward agent-native-milestones     # by slug
+lumo session attach --steward cmxyz123...                 # by milestone id
+```
+
+- **Resolution:** exact id → case-insensitive name/slug across the workspace's active milestones. An **ambiguous** name is refused with 400 listing the candidates (retry with the id); no match is 404.
+- **Lifetime lock, same semantics as the task form:** re-attach to the **same** milestone = idempotent no-op; attach a **task** after a steward bind → 409; attach a **different milestone** → 409; a task-bound session running `--steward` → 409. No `--force`, no detach — a different binding needs a new Claude Code session.
+- **Multiple stewards per milestone are allowed** (acceptance is multi-round by nature); sessions don't conflict.
+
+**Allowed (governance — pass through unchanged, with the session recorded as provenance):** `task create` / `task update`, `task criteria set` (incl. `--human`), `task deps confirm/dismiss`, `verdict --fail` (the send-back rows carry `sourceSessionId`), `milestone add/remove`, and **all read operations**.
+
+**Blocked (implementation — first layer, API gate):**
+
+- `lumo verify` → **409, no round burned, no VerificationRun written**. The error names the milestone and the remedy (start an implementation session and `lumo session attach <task>`). Do not retry from the steward session.
+- Moving a task to `in_progress` with **yourself as the effective assignee** (whether already assigned to you or assigned in the same call) → 409. Dispatching to _someone else_ is planning and passes.
+- Red line unchanged: a steward writes no PASS of any kind; DONE stays human-only.
+
+**Backstop (second layer, detector):** commits / PR creations produced during a steward session anyway (the CLI can't stop local git) are recorded as **`STEWARD_IMPLEMENTATION_ARTIFACT` boundary crossings against the milestone** — fail-closed (an unparseable Bash payload records an _unconfirmed_ crossing rather than nothing), disposition stays **web + human-only**, and there is **no CLI clear path** (`crossing explain` remains an appeal, never a clear).
+
+#### When to suggest
+
+The user asks to "review/accept/plan a milestone", to act as reviewer/steward across tasks, or wants a governance session that must not implement. If a steward session needs code changed, dispatch the task to an implementation owner (or tell the user to open a new implementation session) — never work around the gate.
+
 ### Parallel sessions
 
 Each Claude Code session has its own `CLAUDE_CODE_SESSION_ID`. Two terminals running `claude code` and binding to different tasks will not interfere — bindings are scoped per session row server-side.
@@ -129,7 +157,7 @@ Each Claude Code session has its own `CLAUDE_CODE_SESSION_ID`. Two terminals run
 lumo session status
 ```
 
-Prints which task the current Claude Code session is bound to, or "(no task)" if none. Requires `$CLAUDE_CODE_SESSION_ID` (must run inside Claude Code).
+Prints what the current Claude Code session is bound to — a task, a milestone (`Role: STEWARD (governance — plan & accept only)`), or "(no task)" if none. Requires `$CLAUDE_CODE_SESSION_ID` (must run inside Claude Code).
 
 #### When to suggest
 

package/assets/skill/references/verify.md

@@ -21,10 +21,10 @@ lumo verify --note "…" --timeout 900     # per-checkpointer timeout in seconds
 **`--note` is required (LUM-597)** whenever a round will actually be posted (the
 task has MACHINE criteria). It is your one-line self-report — what you did and
 why it is ready ("我改了 X,因为 Y 可验收"). When the round all-passes and the
-task flips to IN_REVIEW, the note is frozen as the task's **claim** (provenance
+task flips to IN*REVIEW, the note is frozen as the task's **claim** (provenance
 `AGENT` — the汇报者's own voice, not a summarizer paraphrase) and is checked
 against the diff for faithfulness. Capturing the claim is deterministic ("不填不
-让 post"); whether it is _truthful_ is the faithfulness audit's job — so don't
+让 post"); whether it is \_truthful* is the faithfulness audit's job — so don't
 under- or over-state it. A missing/blank note is refused **before** the round is
 posted, so no round is burned; just re-run with one. (An old CLI that omits it
 still verifies — the claim degrades to the synthesized run-summary fallback.)
@@ -61,15 +61,16 @@ errors.
 
 ## Edge cases
 
-| Case                                            | Behavior                                                                                                                                                                                                                                                                                                             |
-| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **No contract yet**                             | Error pointing at `lumo task criteria set`; draft the contract first (criteria.md golden rule).                                                                                                                                                                                                                      |
-| **HUMAN-only contract** (zero MACHINE criteria) | Nothing to run; CLI says so and suggests `lumo task update <id> --status in_review` for human review. No server write happens.                                                                                                                                                                                       |
-| **Partial round**                               | A round must cover every MACHINE criterion; the CLI always runs all of them and the server rejects partial rounds.                                                                                                                                                                                                   |
-| **`REVIEW_ADDED` criteria**                     | Criteria added during review appear in the contract and are picked up automatically by the next round.                                                                                                                                                                                                               |
-| **Session bound to a different task**           | Server returns 409, surfaced as an error. No advisory printed; the verify round is rejected outright.                                                                                                                                                                                                                |
-| **Provably-unbound session**                    | Response carries `bindingAdvisory: 'unbound'`; prints `⚠ Working unbound — this verify ran from a Claude Code session not attached to the task.` Recorded as a `SESSION_BINDING_MISSING` boundary crossing (visible in `lumo task status` open crossings). Run `lumo session attach <LUM-N>` before the next verify. |
-| **Unconfirmed session binding**                 | `bindingAdvisory: 'unconfirmed'` → softer advisory `⚠ Could not confirm this session is attached to the task.` Same remediation: `lumo session attach <LUM-N>`.                                                                                                                                                      |
+| Case                                            | Behavior                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **No contract yet**                             | Error pointing at `lumo task criteria set`; draft the contract first (criteria.md golden rule).                                                                                                                                                                                                                                                                                                                                          |
+| **HUMAN-only contract** (zero MACHINE criteria) | Nothing to run; CLI says so and suggests `lumo task update <id> --status in_review` for human review. No server write happens.                                                                                                                                                                                                                                                                                                           |
+| **Partial round**                               | A round must cover every MACHINE criterion; the CLI always runs all of them and the server rejects partial rounds.                                                                                                                                                                                                                                                                                                                       |
+| **`REVIEW_ADDED` criteria**                     | Criteria added during review appear in the contract and are picked up automatically by the next round.                                                                                                                                                                                                                                                                                                                                   |
+| **Session bound to a different task**           | Server returns 409, surfaced as an error. No advisory printed; the verify round is rejected outright.                                                                                                                                                                                                                                                                                                                                    |
+| **Ungrounded EXTERNAL_FACT PASS** (LUM-605)     | A reported PASS on a criterion declared `EXTERNAL_FACT` whose checkpointer doesn't invoke external tooling (e.g. `npx jest …`) is blocked with **422 — no round burned**; the task does **not** move to IN_REVIEW. Fix it for free: re-ground the checkpointer against a real external fact, or honestly re-declare `referentKind` as `AGENT_CONSTRUCTED_STATE` (`lumo task criteria set`), then re-run. See criteria.md "referentKind". |
+| **Provably-unbound session**                    | Response carries `bindingAdvisory: 'unbound'`; prints `⚠ Working unbound — this verify ran from a Claude Code session not attached to the task.` Recorded as a `SESSION_BINDING_MISSING` boundary crossing (visible in `lumo task status` open crossings). Run `lumo session attach <LUM-N>` before the next verify.                                                                                                                     |
+| **Unconfirmed session binding**                 | `bindingAdvisory: 'unconfirmed'` → softer advisory `⚠ Could not confirm this session is attached to the task.` Same remediation: `lumo session attach <LUM-N>`.                                                                                                                                                                                                                                                                          |
 
 ## Round discipline
 

package/dist/cli/src/commands/fidelity.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fidelityShow = fidelityShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo fidelity show <task>` — the LUM-610 mechanical change-pattern read-out
+ * (fidelity axis, second block, on the LUM-609 delivery-snapshot foundation).
+ *
+ * Per delivery snapshot it discloses two compositions and NOTHING else — no
+ * single score, no good/bad verdict (approach (a): purely mechanical):
+ *   • grounding — how much of the FROZEN contract is externally grounded
+ *     (EXTERNAL_FACT) vs self-confirming (agent-authored) vs inconclusive.
+ *     `grounded` is a machine-checkable UPPER BOUND.
+ *   • independence — criteria ADDED/UPDATED after work started (round>0) that
+ *     the delivery rode on: backward-inference suspects. Direction left blank.
+ */
+const EFFECTIVE_KINDS = [
+    'EXTERNAL_FACT',
+    'AGENT_CONSTRUCTED_STATE',
+    'UNVERIFIED_ASSERTION',
+    'PENDING_OUTCOME',
+    'UNCLASSIFIED',
+];
+function authBase() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds)
+        return { error: 'not logged in. Run `lumo auth login` first.' };
+    const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
+    return { base, headers };
+}
+function formatReport(report, taskId) {
+    const lines = [];
+    lines.push(`Fidelity change-pattern — ${(0, sanitize_1.sanitizeField)(taskId)}`);
+    if (!report.hasSnapshots) {
+        lines.push('  No delivery snapshot on record (task never entered IN_REVIEW, or ' +
+            'predates the LUM-609 freeze). Nothing to read yet — not a pass.');
+        lines.push('');
+        lines.push(`  ${report.caveat}`);
+        return lines.join('\n') + '\n';
+    }
+    report.deliveries.forEach((d, i) => {
+        const when = d.frozenAt.slice(0, 19).replace('T', ' ');
+        lines.push('');
+        lines.push(`  Delivery ${i + 1}/${report.deliveries.length} · frozen ${when}Z · ${(0, sanitize_1.sanitizeField)(d.trigger)} · ${d.total} criteria`);
+        const g = d.grounding;
+        lines.push(`    grounding:    grounded ${g.grounded}  ·  self-confirming ${g.selfConfirming}  ·  inconclusive ${g.inconclusive}   (grounded = machine-checkable upper bound)`);
+        const kinds = EFFECTIVE_KINDS.filter(k => g.byEffectiveKind[k] > 0)
+            .map(k => `${k} ${g.byEffectiveKind[k]}`)
+            .join(', ');
+        lines.push(`      effective kinds: ${kinds || '(none)'}`);
+        const ind = d.independence;
+        lines.push(`    independence: ${ind.postStartChanges}/${ind.total} criteria ADDED/UPDATED after work started (backward-inference suspects; direction not judged)`);
+        for (const s of ind.suspects) {
+            const cause = s.causeTag ? ` · ${(0, sanitize_1.sanitizeField)(s.causeTag)}` : '';
+            lines.push(`      ↳ ${(0, sanitize_1.sanitizeField)(s.criterionId)}  ${s.op}@round${s.round}${cause}  (${s.at.slice(0, 10)})`);
+        }
+    });
+    lines.push('');
+    lines.push(`  ${report.caveat}`);
+    return lines.join('\n') + '\n';
+}
+async function fidelityShow(taskId, options = {}) {
+    if (!taskId || taskId.trim() === '') {
+        console.error('Error: a task is required: lumo fidelity show <task>');
+        return 1;
+    }
+    const auth = authBase();
+    if ('error' in auth) {
+        console.error(`Error: ${auth.error}`);
+        return 1;
+    }
+    let res;
+    try {
+        res = await fetch(`${auth.base}/api/tasks/${encodeURIComponent(taskId)}/fidelity`, { headers: auth.headers });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${(0, sanitize_1.sanitizeField)(taskId)} not found.`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: could not read the fidelity change-pattern (HTTP ${res.status}).`);
+        return 1;
+    }
+    const report = (await res.json());
+    if (options.json) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return;
+    }
+    process.stdout.write(formatReport(report, taskId));
+    return;
+}

package/dist/cli/src/commands/milestone-show.js

@@ -44,13 +44,19 @@ function formatMilestoneShow(m, tasks) {
         m.taskCounts.IN_PROGRESS +
         m.taskCounts.IN_REVIEW +
         m.taskCounts.DONE;
+    const statusLine = m.staleness?.statusDrift
+        ? `Status:       ${m.status}  (stale — task progress indicates ${(0, sanitize_1.sanitizeField)(m.staleness.statusDrift)}; auto-updating)`
+        : `Status:       ${m.status}`;
+    const targetLine = m.staleness?.datesMissing
+        ? `Target:       ${fmtDate(m.targetDate)}  (no target date — schedule health unavailable)`
+        : `Target:       ${fmtDate(m.targetDate)}`;
     const lines = [
         `Milestone:    ${(0, sanitize_1.sanitizeField)(m.name)}`,
-        `Status:       ${m.status}`,
+        statusLine,
         `Archived:     ${m.archivedAt ? m.archivedAt.slice(0, 10) : 'no'}`,
         `Health:       ${fmtHealth(m.health)}`,
         `Start:        ${fmtDate(m.startDate)}`,
-        `Target:       ${fmtDate(m.targetDate)}`,
+        targetLine,
         `Project:      ${(0, sanitize_1.sanitizeField)(m.projectName)}`,
         `Description:`,
         `  ${m.description && m.description.length > 0 ? (0, sanitize_1.sanitizeField)(m.description) : '-'}`,
@@ -136,6 +142,7 @@ async function milestoneShow(identifier, opts) {
         projectName,
         taskCounts: milestone.taskCounts,
         health: milestone.health,
+        staleness: milestone.staleness,
         sprintCoverage: milestone.sprintCoverage,
     }, tasks) + '\n');
 }

package/dist/cli/src/commands/outcome.js

@@ -141,10 +141,12 @@ async function outcomeShow(taskId) {
     }
     return;
 }
+/** Width of the widest bucket label, for aligned columns. */
+const BUCKET_LABEL_WIDTH = 'multi-round-or-sendback'.length;
 /** Render the report client-side (same pattern as `lumo cost` / `outcome show`). */
 function formatRate(report) {
     const lines = [];
-    lines.push('Trust × post-hoc fate — delivery-time forecast confidence vs the outcome well');
+    lines.push('Trust × post-hoc fate — delivery-time verification friction vs the outcome well');
     lines.push('  (rejection rate is a LOWER BOUND: the well only records rejections; ' +
         'no signal = INCONCLUSIVE, never "satisfied")');
     lines.push(`  ${report.totalDeliveries} snapshotted deliveries · min ${report.minSamples} per bracket`);
@@ -157,10 +159,10 @@ function formatRate(report) {
             const pct = ((b.rejectionRate ?? 0) * 100).toFixed(1);
             const lo = ((b.interval?.lower ?? 0) * 100).toFixed(1);
             const hi = ((b.interval?.upper ?? 0) * 100).toFixed(1);
-            lines.push(`  ${b.bracket.padEnd(6)} ≥${pct}% rejected (${b.rejected}/${b.delivered}, 95% CI ${lo}–${hi}%)`);
+            lines.push(`  ${b.bracket.padEnd(BUCKET_LABEL_WIDTH)} ≥${pct}% rejected (${b.rejected}/${b.delivered}, 95% CI ${lo}–${hi}%)`);
         }
         else {
-            lines.push(`  ${b.bracket.padEnd(6)} insufficient (${b.rejected}/${b.delivered} deliveries < ${report.minSamples} — rate withheld)`);
+            lines.push(`  ${b.bracket.padEnd(BUCKET_LABEL_WIDTH)} insufficient (${b.rejected}/${b.delivered} deliveries < ${report.minSamples} — rate withheld)`);
         }
     }
     const verdict = report.comparison.status === 'measured'
@@ -171,10 +173,12 @@ function formatRate(report) {
 }
 /**
  * `lumo outcome rate [--min N] [--json]` — read the workspace trust × post-hoc-
- * fate join: per delivery-time forecast-confidence bracket, the post-hoc
- * REJECTED rate from the outcome well. Honest by construction — thin brackets
- * read `insufficient` (no fabricated rate) and the high-vs-low comparison stays
- * `inconclusive` until the well has enough signal to tell the brackets apart.
+ * fate join: per delivery-time verification-friction bucket (LUM-606:
+ * no-verification / single-round / multi-round-or-sendback, frozen at delivery),
+ * the post-hoc REJECTED rate from the outcome well. Honest by construction — thin
+ * buckets read `insufficient` (no fabricated rate) and the single-round
+ * vs multi-round-or-sendback comparison stays `inconclusive` until the well has
+ * enough signal to tell the buckets apart.
  */
 async function outcomeRate(options = {}) {
     const auth = authBase();

package/dist/cli/src/commands/session-attach.js

@@ -7,21 +7,30 @@ const sanitize_1 = require("../lib/sanitize");
 const resolve_project_1 = require("../lib/resolve-project");
 const memory_auto_1 = require("../lib/memory-auto");
 /**
- * `lumo session attach <identifier>` — bind the currently-running
- * Claude Code session to a task.
+ * `lumo session attach <identifier> [--steward]` — bind the currently-running
+ * Claude Code session to a task, or (with `--steward`) to a MILESTONE as a
+ * STEWARD (governance) session (LUM-640).
  *
  * Required environment: `CLAUDE_CODE_SESSION_ID` (set automatically by
  * Claude Code). Must be invoked from inside a Claude Code session.
  *
- * The binding is a **lifetime lock** (LUM-459): `Session.taskId` is write-once.
- * Re-attaching to the *same* task is an idempotent no-op (re-emits context).
- * Attaching to a *different* task is refused with HTTP 409 — there is no
- * `--force` and no `session detach`; a different task requires a brand-new
- * Claude Code session.
+ * Both forms are a **lifetime lock** (LUM-459/LUM-640): the binding is
+ * write-once. Re-attaching to the *same* task/milestone is an idempotent
+ * no-op. Attaching to anything else — a different task, a different
+ * milestone, a task after a steward bind, a milestone after a task bind —
+ * is refused with HTTP 409; there is no `--force` and no `session detach`;
+ * a different binding requires a brand-new Claude Code session.
+ *
+ * A STEWARD session plans and accepts only: task create/update, criteria
+ * set, deps confirm/dismiss, verdict --fail, milestone add/remove and all
+ * reads pass; `lumo verify` and self-dispatch are refused with 409, and
+ * implementation artifacts (commits/PRs) are recorded as boundary crossings.
  */
-async function sessionAttach(identifier) {
+async function sessionAttach(identifier, options) {
     if (!identifier) {
-        console.error('Error: missing <identifier>. Usage: lumo session attach <LUM-42>');
+        console.error(options?.steward
+            ? 'Error: missing <identifier>. Usage: lumo session attach --steward <milestone id | name | slug>'
+            : 'Error: missing <identifier>. Usage: lumo session attach <LUM-42>');
         return 1;
     }
     const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
@@ -35,6 +44,14 @@ async function sessionAttach(identifier) {
         console.error('Error: not logged in. Run `lumo auth login` first.');
         return 1;
     }
+    if (options?.steward) {
+        return stewardAttach({
+            identifier,
+            sessionId,
+            apiUrl: (0, api_1.resolveAuthedApiUrl)(creds.apiUrl),
+            token: creds.token,
+        });
+    }
     const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
     const url = `${(0, api_1.trimTrailingSlash)(apiUrl)}/api/sessions/${encodeURIComponent(sessionId)}/bind-task`;
     let res;
@@ -70,12 +87,17 @@ async function sessionAttach(identifier) {
         console.error(`Error: ${(0, sanitize_1.sanitizeField)(message)}`);
         return 1;
     }
-    // Lifetime lock (LUM-459): the session is permanently bound to another task.
+    // Lifetime lock (LUM-459): the session is permanently bound to another task —
+    // or (LUM-640) it is a STEWARD session bound to a milestone.
     if (res.status === 409) {
         let current = 'another task';
+        let stewardMilestone = null;
         try {
             const data = (await res.json());
-            if (data.currentTaskIdentifier) {
+            if (data.currentMilestoneName) {
+                stewardMilestone = (0, sanitize_1.sanitizeField)(data.currentMilestoneName);
+            }
+            else if (data.currentTaskIdentifier) {
                 current = data.currentTaskTitle
                     ? `${data.currentTaskIdentifier} "${(0, sanitize_1.sanitizeField)(data.currentTaskTitle)}"`
                     : data.currentTaskIdentifier;
@@ -84,6 +106,12 @@ async function sessionAttach(identifier) {
         catch {
             // fall through with the generic phrasing
         }
+        if (stewardMilestone) {
+            console.error(`Error: this session is a STEWARD (governance) session for milestone "${stewardMilestone}" — ` +
+                'it cannot attach a task. Start a new Claude Code session to ' +
+                `implement ${identifier}.`);
+            return 1;
+        }
         console.error(`Error: this session is permanently bound to ${current}. ` +
             'A session works one task for its lifetime — start a new Claude Code ' +
             `session to work on ${identifier}.`);
@@ -139,3 +167,75 @@ async function sessionAttach(identifier) {
         // best-effort — the bind already succeeded; never surface a sync error here
     }
 }
+/**
+ * LUM-640: the `--steward` form — bind this session to a MILESTONE as a
+ * governance session. Same lifetime-lock error surface as the task form; the
+ * success output spells out the allowed/blocked action split so the agent
+ * knows its lane without a round-trip to the docs.
+ */
+async function stewardAttach(args) {
+    const { identifier, sessionId, apiUrl, token } = args;
+    const url = `${(0, api_1.trimTrailingSlash)(apiUrl)}/api/sessions/${encodeURIComponent(sessionId)}/bind-milestone`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${token}`,
+            },
+            body: JSON.stringify({ milestoneRef: identifier }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    // 400 (ambiguous reference) and 404 (no match) carry actionable server
+    // messages — print them verbatim (sanitized).
+    if (res.status === 400 || res.status === 404) {
+        let message = res.status === 404 ? 'Not found' : 'Bad request';
+        try {
+            const data = (await res.json());
+            if (data.error)
+                message = data.error;
+        }
+        catch {
+            // fall through
+        }
+        console.error(`Error: ${(0, sanitize_1.sanitizeField)(message)}`);
+        return 1;
+    }
+    // Lifetime lock: already task-bound, or steward of a different milestone.
+    if (res.status === 409) {
+        let message = 'this session is already permanently bound';
+        try {
+            const data = (await res.json());
+            if (data.error)
+                message = data.error;
+        }
+        catch {
+            // fall through with the generic phrasing
+        }
+        console.error(`Error: ${(0, sanitize_1.sanitizeField)(message)} ` +
+            'A session holds one binding for its lifetime — start a new Claude ' +
+            'Code session for a different task or milestone.');
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: bind-milestone failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const body = (await res.json());
+    console.log(`Attached session ${sessionId} as STEWARD of milestone "${(0, sanitize_1.sanitizeField)(body.milestoneName)}"`);
+    console.log('');
+    console.log('Governance role — plan & accept only (lifetime lock):');
+    console.log('  allowed: task create/update · criteria set (incl. --human) · deps confirm/dismiss · verdict --fail · milestone add/remove · all reads');
+    console.log('  blocked: lumo verify (409, no round burned) · moving a task to in_progress assigned to yourself · attaching a task');
+    console.log('  note:    commits/PRs produced in this session are recorded as boundary crossings (human-reviewed on the web)');
+}

package/dist/cli/src/commands/session-status.js

@@ -45,6 +45,14 @@ async function sessionStatus() {
         return 1;
     }
     const data = (await res.json());
+    // LUM-640: the steward form — milestone-bound governance session.
+    if (data.role === 'STEWARD' && data.milestoneName) {
+        process.stdout.write(`Session ${sessionId}\n` +
+            `  Role:      STEWARD (governance — plan & accept only)\n` +
+            `  Bound to:  milestone "${(0, sanitize_1.sanitizeField)(data.milestoneName)}"\n` +
+            `  Events:    ${data.eventCount}\n`);
+        return;
+    }
     if (data.taskIdentifier && data.taskTitle) {
         process.stdout.write(`Session ${sessionId}\n` +
             `  Bound to:  ${data.taskIdentifier} "${(0, sanitize_1.sanitizeField)(data.taskTitle)}"\n` +

package/dist/cli/src/commands/task-criteria-set.js

@@ -197,6 +197,11 @@ async function taskCriteriaSet(identifier, options) {
     if (data.judgeStepsWarning) {
         process.stdout.write(`⚠ ${(0, sanitize_1.sanitizeField)(data.judgeStepsWarning)}\n`);
     }
+    // LUM-605: EXTERNAL_FACT criteria whose checkpointer doesn't ground external
+    // — stored, but the verify loop will refuse a PASS on them until re-grounded.
+    if (data.referentWarning) {
+        process.stdout.write(`⚠ ${(0, sanitize_1.sanitizeField)(data.referentWarning)}\n`);
+    }
     const readbackIssues = verifyReadback(criteriaItems, data.criteria);
     if (readbackIssues.length > 0) {
         for (const issue of readbackIssues) {

package/dist/cli/src/index.js

@@ -48,6 +48,7 @@ const session_status_1 = require("./commands/session-status");
 const next_1 = require("./commands/next");
 const cost_1 = require("./commands/cost");
 const criteria_audit_1 = require("./commands/criteria-audit");
+const fidelity_1 = require("./commands/fidelity");
 const verify_1 = require("./commands/verify");
 const verdict_1 = require("./commands/verdict");
 const crossing_explain_1 = require("./commands/crossing-explain");
@@ -285,16 +286,25 @@ criteria
     .command('audit')
     .description('Show the workspace referent-kind distribution + self-confirming-green ratio (GET /api/criteria/audit)')
     .action(wrap(() => (0, criteria_audit_1.criteriaAudit)()));
+const fidelity = program
+    .command('fidelity')
+    .description('Mechanical fidelity read-outs (LUM-610)');
+fidelity
+    .command('show <task>')
+    .description('Per delivery snapshot (LUM-609): the grounding composition of the frozen contract (grounded / self-confirming / inconclusive) and the independence signal (criteria ADDED/UPDATED after work started = backward-inference suspects). A composition table, not a single score — direction is never judged. inconclusive is surfaced, never swallowed.')
+    .option('--json', 'Emit the report as JSON')
+    .action(wrap((task, options) => (0, fidelity_1.fidelityShow)(task, options)));
 const session = program
     .command('session')
     .description('Manage per-terminal coding-session context');
 session
     .command('attach <identifier>')
-    .description('Attach the currently-running Claude Code session (CLAUDE_CODE_SESSION_ID) to a task. The binding is a lifetime lock: re-attaching to the same task is a no-op, attaching to a different task is refused — start a new session for a different task.')
-    .action(wrap(identifier => (0, session_attach_1.sessionAttach)(identifier)));
+    .description('Attach the currently-running Claude Code session (CLAUDE_CODE_SESSION_ID) to a task — or, with --steward, to a MILESTONE as a governance session (LUM-640: plan/accept only). Either binding is a lifetime lock: re-attaching the same target is a no-op, anything else is refused — start a new session instead.')
+    .option('--steward', 'Bind as a STEWARD (governance) session to a milestone (id, name, or slug) instead of a task. Steward sessions plan and accept only: lumo verify is refused (409, no round burned), self-dispatch to in_progress is refused, and implementation commits/PRs are recorded as boundary crossings.')
+    .action(wrap((identifier, options) => (0, session_attach_1.sessionAttach)(identifier, options)));
 session
     .command('status')
-    .description('Show the task currently bound to this Claude Code session (or "no task" if none).')
+    .description('Show what this Claude Code session is bound to: a task, a milestone (STEWARD governance session), or nothing.')
     .action(wrap(() => (0, session_status_1.sessionStatus)()));
 const task = program
     .command('task')

package/dist/shared/src/gate-map.js

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * Static gate map (LUM-614) — the single source of truth that classifies the
+ * engineer-facing mechanical gates into a stable key set, splits them by how
+ * their signal is produced, and (for execution gates) carries the command
+ * patterns that recognize an executed check in the hook-event stream.
+ *
+ * Shared by the read-model that derives a delivery's gate audit (server) and
+ * the delivery-card panel that renders it (app). It deliberately carries NO
+ * status — status is derived per delivery from HookEvent rows, never stored.
+ *
+ * The class → provenance split seeds the fidelity independence axis: a detection
+ * gate is something Lumo derives itself from the tool-intent stream it already
+ * ingests (independent of the agent). An execution gate's signal can come from
+ * EITHER source: the agent's own tool runs (self-reported — it chose to run the
+ * check and could skip it) OR, as of LUM-616, an independent CI run read back
+ * from GitHub (check-runs / commit-statuses), which the agent cannot skip or
+ * fake. So execution-gate provenance is no longer a pure function of class — it
+ * is carried per produced signal (see NormalizedGateEvent.provenance in the
+ * gate-audit read-model); `provenanceForClass` is only the not-run/not-configured
+ * default. Detection-gate provenance is still class-fixed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GATE_DEFINITIONS = exports.ALL_GATE_KEYS = void 0;
+exports.provenanceForClass = provenanceForClass;
+exports.gateDefinition = gateDefinition;
+exports.classifyCommand = classifyCommand;
+exports.classifyGateName = classifyGateName;
+/** Provenance is a pure function of class — the only place the mapping lives. */
+function provenanceForClass(cls) {
+    return cls === 'detection' ? 'independent_harness' : 'agent_self_reported';
+}
+const RAW_DEFINITIONS = [
+    // 'parse' (node --check) was dropped (LUM-616 follow-up): it's a strict subset
+    // of typecheck/build (which both parse before they can run), so a separate
+    // parse gate carried no independent information and was never sourced — it sat
+    // perpetually not_run. Removed rather than fabricated-green.
+    {
+        key: 'typecheck',
+        class: 'execution',
+        // No build-exclusion lookahead: classification is one-command → N gates
+        // (LUM-629), so `tsc && npm run build` reports typecheck AND build instead
+        // of needing build to win a single-choice tie.
+        commandPatterns: [/\btsc\b/, /typecheck/],
+    },
+    {
+        key: 'build',
+        class: 'execution',
+        commandPatterns: [/\bnext\s+build\b/, /\bnpm\s+run\s+build\b/],
+    },
+    {
+        key: 'test',
+        class: 'execution',
+        commandPatterns: [/\bjest\b/, /\bvitest\b/, /\bnpm\s+(run\s+)?test\b/],
+    },
+    // Detection-class gates were all removed (LUM-616 follow-up): detection belongs
+    // in boundary crossings, not audit-only gates.
+    //  - 'git-hygiene' (committed secrets) ≡ the HARDCODED_SECRET crossing, which
+    //    is detected server-side, surfaced, AND blocks DONE — strictly stronger.
+    //  - 'diff-scope' (out-of-declared-scope edits) has no source of truth yet
+    //    (Lumo has no "declared scope"); the right home is a future
+    //    OUT_OF_SCOPE_EDIT crossing, not a perpetually not_configured gate.
+    // The 'detection' GateClass stays as scaffolding for a clean future re-add.
+];
+const DEFINITIONS = RAW_DEFINITIONS.reduce((acc, raw) => {
+    acc[raw.key] = { ...raw, provenance: provenanceForClass(raw.class) };
+    return acc;
+}, {});
+exports.ALL_GATE_KEYS = RAW_DEFINITIONS.map(d => d.key);
+exports.GATE_DEFINITIONS = exports.ALL_GATE_KEYS.map(k => DEFINITIONS[k]);
+/** Look up a gate's definition by key. */
+function gateDefinition(key) {
+    return DEFINITIONS[key];
+}
+/**
+ * Strip double- and single-quoted substrings from a command line, leaving only
+ * the unquoted invocation tokens. This is what stops a gate keyword that merely
+ * appears inside an *argument* — e.g. a `lumo task create "…parse/typecheck/
+ * build/test…"` description, or `echo "…run the test…"` — from being mistaken
+ * for an invocation of that gate (the LUM-614 prod false-positive, where a
+ * task-create description was classified as a passed typecheck and overwrote
+ * the real `tsc` signal). A real gate run names its tool unquoted, so it
+ * survives the strip.
+ */
+function unquotedInvocation(command) {
+    return command.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, ' ');
+}
+/**
+ * Classify an executed shell command as execution gates — EVERY gate whose
+ * invocation tokens the command hits, in declaration order; empty when none.
+ * One command → N gates (LUM-629): agents routinely chain checks in a single
+ * shell line (`npx jest …; npx tsc --noEmit`), and single-choice classification
+ * silently dropped all but one gate's signal (the LUM-620 #770 test=not_run
+ * under-report). Matching still runs against the unquoted invocation only, so
+ * a gate keyword buried in quoted argument text never produces a false signal
+ * (LUM-614). Detection gates are never returned here — they're not derived
+ * from commands.
+ */
+function classifyCommand(command) {
+    const invocation = unquotedInvocation(command);
+    return exports.GATE_DEFINITIONS.filter(def => def.commandPatterns.some(p => p.test(invocation))).map(def => def.key);
+}
+/**
+ * Patterns that classify a CI check-run / commit-status NAME (not a shell
+ * command) as an execution gate. LUM-616: the independent harness reads CI
+ * signals straight from GitHub (check-runs + commit-statuses) across ANY
+ * provider, and the only semantics GitHub exposes is each check's name plus its
+ * pass/fail — so mapping a named check to a gate is unavoidably name-based.
+ * Platform-agnostic on purpose (GitHub Actions, Vercel, CircleCI, Travis, …).
+ * First match wins; order = most specific (typecheck/test) before the build
+ * catch-all so a "build and test" job lands on the narrower gate.
+ */
+const CHECK_NAME_PATTERNS = [
+    ['typecheck', [/\btypecheck\b/i, /\btsc\b/i, /type[\s-]?check/i]],
+    ['test', [/\btests?\b/i, /\bjest\b/i, /\bvitest\b/i, /\bspec\b/i]],
+    ['build', [/\bbuild\b/i, /\bvercel\b/i, /\bdeploy/i]],
+];
+/**
+ * Classify a CI check / commit-status name as an execution gate, or null when
+ * it matches none — an unrecognized check is dropped, never coerced into a
+ * fabricated gate. A name carrying "comment" (e.g. "Vercel Preview Comments")
+ * is a bot annotation, not a CI check, and is rejected before pattern matching.
+ */
+function classifyGateName(name) {
+    const n = name.trim();
+    if (!n || /comment/i.test(n))
+        return null;
+    for (const [key, patterns] of CHECK_NAME_PATTERNS) {
+        if (patterns.some(p => p.test(n)))
+            return key;
+    }
+    return null;
+}

package/dist/shared/src/referent-kind.js

@@ -47,6 +47,20 @@ function wordMatches(word, tools) {
     // exact tool, or a tool-prefixed filename like jest-t.ts / vitest.config
     return tools.some(t => word === t || word.startsWith(`${t}-`) || word.startsWith(`${t}.`));
 }
+/**
+ * No-op external invocations (LUM-605): forms whose exit code and output are
+ * constant w.r.t. external state (`git --version`, `gh --help`, …). An external
+ * tool invoked this way establishes no external fact, so it must never ground
+ * EXTERNAL — this is half of the C-hole fix (the other half is the consumption
+ * requirement below). Kept deliberately small/conservative: a smaller set means
+ * fewer real external checks get mistaken for no-ops (we'd rather under-flag a
+ * decoy than false-downgrade a genuine check, which enforcement now penalizes).
+ */
+const NOOP_FLAG_TOKENS = new Set(['--version', '--help']);
+/** No-op SUBCOMMAND forms — only when they are the first word after the tool
+ *  (`git version`, `gh help`). Not matched as a bare flag-anywhere, so we don't
+ *  trip on an unrelated positional like a psql `-h <host>` (host, not help). */
+const NOOP_SUBCOMMANDS = new Set(['version', 'help']);
 /**
  * Given a raw command word (possibly `npx jest`, `npm run build`, etc.),
  * normalize to the effective tool name. Returns null for pure wrapper tokens
@@ -138,6 +152,143 @@ function collectCommandWords(script) {
     }
     return result;
 }
+function isExternalTool(word) {
+    return wordMatches(word, EXTERNAL_TOOLS);
+}
+/**
+ * Parse one shell command segment (already split off sequencing/pipe operators)
+ * into its effective tool + whether it is a no-op invocation. Mirrors the
+ * wrapper-skipping of {@link collectCommandWords} (npx / sudo / command / npm
+ * run), then reads the post-tool tokens to flag no-op forms (LUM-605).
+ */
+function parseInvocation(segment) {
+    const cleaned = segment
+        .replace(/['"]/g, ' ')
+        .replace(/\[|\]/g, ' ')
+        .replace(/\$\{?[^}]*}?/g, ' ')
+        .trim();
+    if (!cleaned)
+        return null;
+    const tokens = cleaned.split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length) {
+        const lower = tokens[i].toLowerCase();
+        if (lower === 'npx' || lower === 'sudo' || lower === 'command') {
+            i++;
+            continue;
+        }
+        if (lower === 'npm' && tokens[i + 1]?.toLowerCase() === 'run') {
+            i += 2;
+            continue;
+        }
+        break;
+    }
+    if (i >= tokens.length)
+        return null;
+    const tool = normalizeCommandWord(tokens[i].toLowerCase());
+    const rest = tokens.slice(i + 1).map(t => t.toLowerCase());
+    const isNoop = rest.some(t => NOOP_FLAG_TOKENS.has(t)) ||
+        (rest.length > 0 && NOOP_SUBCOMMANDS.has(rest[0]));
+    return { tool, isNoop };
+}
+/**
+ * Does this script contain a CONSUMED, non-no-op external command (LUM-605)?
+ * "Consumed" — the discriminator that closes the C hole — means the external
+ * command's output or exit actually reaches the check's verdict:
+ *   - captured in a `$(...)` / backtick substitution (output → data → assertion);
+ *   - piped into a downstream stage (`ext | …`);
+ *   - the terminal command of the whole script (its exit status IS the verdict).
+ * A non-terminal external word whose output is discarded (the decoy
+ * `git --version && cat frozen.txt | grep`), or any no-op invocation, does NOT
+ * ground EXTERNAL.
+ */
+function groundsExternal(script) {
+    const noComments = script.replace(/(^|\s)#[^\n]*/gm, ' ');
+    return scanScript(noComments);
+}
+/** Pull out substitutions / `bash -c` payloads (recursing into them) then walk
+ *  statements → `&&`/`||` segments → pipeline stages to test each consumed slot. */
+function scanScript(text) {
+    let remaining = text;
+    let foundInNested = false;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_m, inner) => {
+        if (scanConsumed(inner))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/`([^`]*)`/g, (_m, inner) => {
+        if (scanConsumed(inner))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+'([^']*)'/g, (_m, payload) => {
+        if (scanScript(payload))
+            foundInNested = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/\b(?:bash|sh)\b[^'"]*-c\s+"([^"]*)"/g, (_m, payload) => {
+        if (scanScript(payload))
+            foundInNested = true;
+        return ' ';
+    });
+    if (foundInNested)
+        return true;
+    const statements = remaining
+        .split(/;|\n/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    for (let si = 0; si < statements.length; si++) {
+        const terminalStatement = si === statements.length - 1;
+        const segments = statements[si].split(/&&|\|\|/)
+            .map(s => s.trim())
+            .filter(Boolean);
+        for (let gi = 0; gi < segments.length; gi++) {
+            const terminalSegment = gi === segments.length - 1;
+            const stages = segments[gi].split(/\|/)
+                .map(s => s.trim())
+                .filter(Boolean);
+            for (let pi = 0; pi < stages.length; pi++) {
+                const finalStage = pi === stages.length - 1;
+                const inv = parseInvocation(stages[pi]);
+                if (!inv || !isExternalTool(inv.tool) || inv.isNoop)
+                    continue;
+                const pipedIntoConsumer = !finalStage;
+                const exitIsVerdict = finalStage && terminalSegment && terminalStatement;
+                if (pipedIntoConsumer || exitIsVerdict)
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/** Substitution context: the captured output is data fed to the surrounding
+ *  assertion, so a non-no-op external command word in ANY position is consumed. */
+function scanConsumed(inner) {
+    let remaining = inner;
+    let found = false;
+    remaining = remaining.replace(/\$\(([^)]*)\)/g, (_m, x) => {
+        if (scanConsumed(x))
+            found = true;
+        return ' ';
+    });
+    remaining = remaining.replace(/`([^`]*)`/g, (_m, x) => {
+        if (scanConsumed(x))
+            found = true;
+        return ' ';
+    });
+    if (found)
+        return true;
+    const segments = remaining
+        .split(/&&|\|\||;|\||\n/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    for (const seg of segments) {
+        const inv = parseInvocation(seg);
+        if (inv && isExternalTool(inv.tool) && !inv.isNoop)
+            return true;
+    }
+    return false;
+}
 function classifyCheckpointerGrounding(checkpointer) {
     if (!checkpointer || checkpointer.trim() === '')
         return 'NONE';
@@ -145,11 +296,13 @@ function classifyCheckpointerGrounding(checkpointer) {
     // Fast path for known two-word external phrases (e.g. prisma migrate status)
     if (EXTERNAL_PHRASES.some(p => lower.includes(p)))
         return 'EXTERNAL';
-    const words = collectCommandWords(checkpointer.toLowerCase());
+    const words = collectCommandWords(lower);
     if (words.length === 0)
         return 'NONE';
-    // Strongest signal wins: EXTERNAL > AGENT_HARNESS > ASSERTION_ONLY
-    if (words.some(w => wordMatches(w, EXTERNAL_TOOLS)))
+    // Strongest signal wins: EXTERNAL > AGENT_HARNESS > ASSERTION_ONLY. EXTERNAL
+    // is gated on a CONSUMED, non-no-op external command (LUM-605) — a no-op or
+    // output-discarded external word falls through to harness/assertion.
+    if (groundsExternal(lower))
         return 'EXTERNAL';
     if (words.some(w => wordMatches(w, HARNESS_TOOLS)))
         return 'AGENT_HARNESS';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.48.0",
+  "version": "1.50.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",