@oevery/rsp 3.1.1 → 3.3.0

package/dist/{entry-KAWA2AS4.mjs → entry-YAW3PYFA.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   inspectPackagedSkillInventory
-} from "./chunk-3Z4IO2TD.mjs";
+} from "./chunk-QM2UVPQK.mjs";
 import {
   openTerminalSession,
   truncateDisplay
 } from "./chunk-JOMFFQRG.mjs";
-import "./chunk-WJXKLLIF.mjs";
+import "./chunk-7HXQNBIG.mjs";
 
 // src/skills-tui/entry.tsx
 import process from "process";
@@ -90,7 +90,7 @@ var skillsCatalogs = {
   "en": {
     title: "RSP Skill manager",
     target: "Target",
-    defaultHeading: "Default lifecycle Skills",
+    defaultHeading: "Default suite Skills",
     optionalHeading: "Optional project Skills",
     missing: "missing",
     unchanged: "unchanged",
@@ -104,7 +104,7 @@ var skillsCatalogs = {
   "zh-CN": {
     title: "RSP Skill \u7BA1\u7406\u5668",
     target: "\u76EE\u6807",
-    defaultHeading: "\u9ED8\u8BA4\u751F\u547D\u5468\u671F Skills",
+    defaultHeading: "\u9ED8\u8BA4\u5957\u4EF6 Skills",
     optionalHeading: "\u53EF\u9009\u9879\u76EE Skills",
     missing: "\u672A\u5B89\u88C5",
     unchanged: "\u4E00\u81F4",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oevery/rsp",
   "type": "module",
-  "version": "3.1.1",
+  "version": "3.3.0",
   "description": "RSP (Reliable Software Practice), a repository-native engineering workflow for humans and AI agents",
   "author": "oevery",
   "license": "MIT",
@@ -37,10 +37,11 @@
   },
   "scripts": {
     "prepare": "pnpm run build",
-    "release:check": "pnpm run release:metadata-check && pnpm run docs:check && pnpm run docs:build && pnpm run build && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run release:package-check",
-    "release:candidate-check": "node scripts/release-candidate-check.mjs && pnpm run release:check",
-    "release:metadata-check": "node scripts/release-metadata-check.mjs",
-    "release:package-check": "node scripts/clean-install-check.mjs",
+    "release:acceptance": "node scripts/release-acceptance.mjs",
+    "release:behavior-check": "node scripts/release-behavior-acceptance.mjs",
+    "release:provider-compare": "node scripts/release-provider-comparison.mjs",
+    "release:candidate-check": "node scripts/release-candidate-check.mjs && node scripts/release-behavior-evidence-check.mjs && pnpm run release:acceptance",
+    "skills:security-check": "node scripts/skill-security-preflight.mjs --suppressions skill-security-suppressions.json",
     "prepublishOnly": "pnpm run release:candidate-check",
     "build": "tsup",
     "dev": "tsup --watch",
@@ -52,18 +53,22 @@
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest"
+    "test": "pnpm run build && vitest run",
+    "test:watch": "vitest --config vitest.watch.config.ts"
   },
   "dependencies": {
     "citty": "^0.2.2",
     "ink": "~7.1.1",
+    "mdast-util-from-markdown": "2.0.3",
+    "mdast-util-gfm": "3.1.0",
+    "micromark-extension-gfm": "3.0.0",
     "picocolors": "^1.1.1",
     "react": "~19.2.8",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^9.2.0",
+    "@types/mdast": "4.0.4",
     "@types/node": "^22.20.1",
     "@types/react": "19.2.17",
     "eslint": "^10.8.0",

package/rules/rsp-rules.md

@@ -5,72 +5,44 @@ description: Minimal fallback protocol for Rules, Specs, and Plans driven develo
 
 # RSP fallback protocol
 
-This file is the minimal fallback protocol for agents that cannot load the `rsp` skill. It is not the project instruction or design store.
+This file is the minimal fallback protocol for agents that cannot load the `rsp` Skill. It is a compatibility and safety kernel, not a replacement for project instructions, installed Skills, or durable design documentation.
 
 ## Entry
 
-- Read nearest `AGENTS.md` and relevant `CONTEXT.md` before RSP work. Use root `CONTEXT-MAP.md` when present.
-- Prefer the `rsp` skill for setup, focused work, readiness, repair, and durable review.
-- If the `rsp` skill is unavailable, read this file before operating `.rsp/`.
-- Treat `focus.d/` as the only current-focus source.
-- If `focus.d/` is empty and the user has not provided a concrete task, ask what to work on or suggest `npx -y @oevery/rsp create <name>`.
-- For grouped work, read the sibling Group Brief before the focused child Change. Then read only the relevant Specs and Decision Records under the configured authoritative path.
+- Read the nearest `AGENTS.md` and relevant `CONTEXT.md` before RSP work. Use the root `CONTEXT-MAP.md` when present.
+- Apply this fallback before operating `.rsp/` only after the Core Skill is absent or cannot be used.
+- Treat each `focus.d/` marker path as the only current-focus source. A marker may contain a short optional Markdown Focus Capsule with Manager-accepted recovery pointers, but its prose never selects work or grants authority, acceptance, lifecycle, Git, or worker coordination. A valid non-empty v1 capsule contains only one leading `<!-- rsp-focus:v1 -->`, blank lines, exactly one non-empty single-line `Current`, `Evidence`, and `Next`, and at most one non-empty single-line `Resume check`; unknown non-empty lines or fields are invalid. Legacy unversioned content is warning-only compatibility and makes no structured recovery claim. For grouped work, read the sibling Group Brief before the explicitly focused child Change. Then read only the relevant Specs and Decision Records under the configured authoritative path.
+- If `focus.d/` is empty and the user has not provided a concrete task, ask what to work on or suggest `npx -y @oevery/rsp create <name>`. Do not infer current work from open Changes or filenames.
 
-## Core
+## Ownership
 
-- Keep response language user/session-owned and durable project language repository-owned. For response prose, use an explicit current response language, user/host personal instructions, then conversation language; project `.rsp/config.yaml` never selects it. For a new authorized artifact, use an explicit artifact language, then the configured effective artifact language, artifact-scoped project instructions, and conversation language. Preserve an existing artifact's established language unless translation is explicitly authorized; changing configuration never rewrites it. Commit-message prose follows an explicit current commit-language instruction, configured effective commit language, nearest repository commit authority, then clear recent non-merge history. Preserve canonical headings, paths, commands, identifiers, Conventional Commit types/scopes, trailers, and machine values. WorkRefs follow the Unicode identity contract rather than the natural-language fallback chain.
-- Treat CLI-generated artifact scaffolds as deterministic structure, not natural-language generation: keep canonical structural tokens, neutral `<…>` placeholders, and verbatim user input; fill authorized prose from the effective artifact-language policy without a locale catalog or implicit English fallback.
-- Write persistent artifact prose in domain, system, user, or operator language. Mention AI or agents only when they are real product actors, consumers, interface participants, or constraints; agent authorship, execution narration, or convenience for a hypothetical future agent is not durable content.
-- `changes/` stores open work; `archives/` stores completed history; `specs/` stores stable current facts; the configured Decision Record path stores lasting rationale.
-- Every Change is one Markdown file with explicit `kind` and the fixed `Proposal`, `Spec`, `Design`, `Tasks`, `Verify`, and `Blockers` sections.
-- A Change is a convergent current-plan and final-evidence snapshot, not an append-only execution log. Keep Tasks aligned with current delivery and Verify limited to final decisive commands or scenarios, results, proven scope, omitted or unavailable coverage, and remaining risk. Replace superseded plans and evidence; retain an earlier failure only when it still explains a current blocker, coverage gap, or risk.
-- In a Change `Blockers` section, `- requires \`<change-work-ref>\`: <reason>` declares an exact dependency on another executable Change. Other meaningful blocker prose remains external and is never inferred as a dependency.
-- Executable Change identities are either `<change>` or `<group>/<change>`. Recursive work paths are unsupported.
-- A Change Group is the only composite shape and requires at least two independent direct children. Its non-executable, non-focusable `<group>/brief` at `<group>/00-brief.md` owns shared scope, constraints, declared Slices, completion, durable outcomes, and blockers. Read it before a child; archive children independently and close only a derived-complete Group.
-- A file and directory cannot claim the same work identity.
-- Managed roots, Group prefixes, recursive Spec paths, and final managed files must be real directories or regular files as applicable. Initialization, repair, inspection, Spec-index work, and mutations use shared no-follow checks; symlinks, special entries, missing roots, and incomplete inspection fail closed.
-- `status`, `check`, and `doctor` share work-tree, Change Group, and dependency inspection. They fail visibly on unsupported structure, membership mismatches, malformed or missing dependency targets, self-dependencies, and cycles. With no focus, status uses Group Brief declaration order and derived blockers to recommend the first executable slice.
-- `status` derives blockers, exact edges and reasons, ready Changes, and stable waves without persisted graph or delivery state. Filtered views retain prerequisite context. Archived prerequisites resolve; invalid or incompletely inspected graphs fail closed.
-- Parallel Changes in one Group follow the Brief `Slices` declaration order in plan output; unrelated work uses stable lexical ordering.
-- A Group Brief blocker is inherited by its direct child Changes as an external blocker; it does not create inferred dependency edges.
-- Persist only `open` and `archived`; readiness, blockers, verification, and next actions are derived.
-- When fresh evidence shows that archived acceptance was incomplete, restore the same owner explicitly. `rsp reopen <work-ref> --reason <text>` retains the selected archive, focuses the executable Change, and adds unfinished Task and Verify evidence. If the enclosing Group is closed, first run `rsp group reopen <group> --reason <text>` to restore only its retained Brief as unfocused work with unfinished completion evidence, then separately reopen only the incomplete child. Multiple matching Change or Group archives require exact `--from .rsp/archives/...` selection. Neither command cascades into children or dependents, and `rsp group create` never reuses archived identity. Open work wins over same-identity history in current state; genuinely new or independently delivered scope uses a new owner.
-- Ordinary implementation is the default after unexplained failures are ruled out. Use test-first only when authority requires it or a concrete risk makes pre-mutation failure materially safer. Retain a new test only when it protects observable behavior or a real boundary with distinct proportionate value; otherwise remove the temporary probe and use decisive final verification.
-- Before later-turn mutation under a direct report, design, tiny, or small route, rederive from the newly authorized objective and prospective work. Cross-module implementation, multiple acceptance surfaces, repeated production-path correction, real-host validation, bounded review convergence, lifecycle delivery, or a clear ready successor requires the smallest sufficient WorkRef and fresh qualification before mutation; unchanged tiny/small follow-ups stay direct. Elapsed time and message count alone never escalate work.
-- Before focusing or mutating a different WorkRef, compare dirty product or durable-truth paths with the prior owner's declared or observed paths. Overlap requires continuation of the same open WorkRef, an authorized reopen, an explicitly authorized integration owner, or a stop for boundary resolution. Disjoint authorized work may proceed without staging or forcing a commit; insufficient ownership evidence stops the transition.
-- This fallback does not emulate `rsp-manage`, even when project configuration selects automatic activation or local closeout. Invalid configuration grants nothing and remains visible. Every `manage.closeout` preset stays advisory because fallback Core never selects or qualifies Manage. For an explicit managed request or an automatically eligible completion/continuation, resolve the smallest owner using ordinary Core rules: reuse one unambiguous selected ready Change, send tiny settled work direct without a synthetic Change, and shape only independently authorized planning artifacts for clear non-trivial work. Automatic eligibility includes independent slices, interruption recovery, or prospective execution spanning implementation plus integration/review/lifecycle, cross-module or cross-process mutation, real-host/provider/hardware verification, bounded finding convergence, or a clear ready successor. Decline as direct one-step work only when one owner, one local seam, one mutation pass, one decisive check, no managed lifecycle coordination, and no ready successor all hold; a selected ready completion or continuation that fails any one condition is non-small and requires loaded Manage rather than an unclassified fallback. Report that Manage is unavailable rather than selected, the decisive eligibility or exclusion, the exact direct action, and any applicable serial/parallel overlap reason; do not persist that reasoning. Configuration grants no planning or product-mutation authority. Stop for material product, acceptance, interface, scope, mutation, or external-action decisions. Perform at most one ordinary Core or Discipline action, return its WorkRef and next action, and never dispatch, auto-continue successors, loop review corrections, archive, stage, commit, push, or persist controller state. Load the `rsp` and `rsp-manage` Skills when controller behavior is required.
-- Route one explicit isolated domain, module/seam, or evidence-seeking question to installed `rsp-design`; use a compact manual design pass only when that Skill is unavailable. Without a selected Change, use report-only Pre-Change Design without inventing a WorkRef only when the question is already bounded; when outcome, scope, non-goals, acceptance, or decomposition remains materially unclear, route to Shape. With a selected Change, return evidence, alternatives, owner decisions, and any authorized planned-design update to the same WorkRef. Do not implement or write durable current truth from either mode.
-- Route release documentation only for an explicit release operation with a confirmed identity or range and unfinished surfaces; no Release Change is required. Confirm identity only from explicit instruction or authoritative configuration. Until then stay version-neutral and do not mutate versioned surfaces. Keep ledgers transient; use an optional Release Change only for material decisions, coordination, recovery, blockers, or acceptance. This route grants no Git, publication, deployment, or approval authority.
-- Do not infer current work from open Changes or filenames.
-- Prefer RSP commands for deterministic setup, status, validation, repair, focus, Specs-index, history, archive, and reopen operations.
+- `changes/` owns open work, `archives/` owns completed history, `specs/` owns stable current facts, and the configured Decision Record path owns lasting rationale and tradeoffs.
+- A Change owns one executable outcome and its acceptance, Tasks, verification, and blockers. Executable WorkRefs are `<change>` or one direct `<group>/<change>` child. A Group Brief provides shared context but is not executable or focusable.
+- For a new inferred WorkRef, preserve explicit valid user input first, otherwise follow an explicit nearest project or domain naming convention, otherwise use ASCII lowercase kebab-case from stable domain or technical vocabulary. Language or locale settings never select or translate WorkRef language. Valid Unicode remains available through explicit input or project/domain convention, and existing identities are never renamed by later guidance.
+- Persist only `open` and `archived` lifecycle state. Readiness, blockers, routes, and acceptance remain derived from current artifacts and evidence. A Focus Capsule may project accepted current work, next action, evidence validity, and blockers for recovery without becoming lifecycle or controller state. Under `## Verify`, `### Required` owns acceptance-critical evidence and `### Optional` owns additional coverage; legacy unclassified items are Required. Incomplete Tasks, Required verification, or blockers fail the completion gate, while Optional omissions remain visible warnings.
+- Project-owned `AGENTS.md` and `CONTEXT.md` retain their own instruction and context authority. RSP does not replace them.
+- Prefer RSP commands for deterministic setup, status, validation, repair, focus, Spec-index, history, archive, and reopen operations. Invalid identity, structure, dependency, managed path, symlink, or incomplete inspection fails closed.
 
-## Durable review
+## One bounded action
 
-- Route artifacts by semantic owner: planned future design stays in the selected Change; implemented stable current facts go to the smallest authoritative Spec or, with explicit authority, project-owned context/instructions; lasting rationale is judged independently for the configured Decision Record path; temporary continuation stays in the response unless a path is explicitly authorized.
-- Project-owned `CONTEXT.md` owns stable navigation or scoped current context, while project-owned `AGENTS.md` owns stable operating instructions. Preserve their conventions and never treat RSP as their owner.
-- Before archive, decide independently whether current facts need a Spec or scoped-instruction update and whether lasting rationale needs a Decision Record.
-- Before archive, compress the Change to its final outcome, current design, completed delivery tasks, final decisive verification, and unresolved risks. Keep RED/GREEN/REFACTOR cycles, temporary probes, command transcripts, and step-by-step review corrections in the response instead of the Change or Archive.
-- After required durable updates, Core recommends explicit archive before final Git delivery. Ordinary work requires separate Git and release authority; fallback Core never executes archive, stage, commit, push, or publication.
-- When loaded Core or qualified Manage has already derived one authorized RSP-owned commit boundary, prefer the `rsp-commit` Skill for exact staging, repository-consistent structured message construction, one local commit, and complete post-commit observation. If that Skill alone is unavailable, loaded Core may provide its equivalent bounded manual action against the same owner; this minimal fallback still grants and executes no Git action.
-- Decision Records are for hard-to-reverse choices with real tradeoffs; they do not duplicate current facts.
-- Change Spec deltas are planning aids and are never promoted automatically into Specs or Decision Records.
-- Keep task history, debugging notes, and transient execution state out of Specs and Decision Records.
-- Generated local Specs `00-index.md` files and archives are not current-truth owners. Use each index only to discover direct child Specs and child Spec directories; authoritative Archive Markdown is queried directly without a generated Archive Index.
+- Derive the next action from user intent, explicit authority, the selected WorkRef, its current Change and Group Brief when any, relevant durable facts, the worktree, and fresh status or verification evidence.
+- Perform at most one bounded ordinary Core action or one optional Discipline action against the same owner. A mutation requires one ready owner, an explicit boundary, settled acceptance criteria, and one decisive verification. Do not auto-continue a successor or widen the boundary because more work is visible.
+- When an optional Discipline Skill is unavailable, a compact manual fallback may cover only the same bounded owner and action. It never substitutes for a required managed worker, independent verification, unresolved product or authority decision, or missing acceptance.
+- When the next action is a read-only pass over a Change-declared evidence boundary, use `rsp-verify` when available. Verify owns the bounded result and evidence; Core retains routing, while Manage validates required results and derives acceptance and closeout. Any required identity or independence evidence comes from the host. If Verify is unavailable, a manual fallback may collect only the same declared evidence and must report the capability gap truthfully.
+- Before later mutation or a different WorkRef, rederive authority and inspect dirty product and durable-truth paths. Continue the same owner, use an explicitly authorized reopen or integration owner, or stop for boundary resolution when ownership overlaps or remains uncertain.
+- If the action becomes multi-owner, cross-boundary, dependent on managed coordination, or unsafe without an unavailable capability, stop. Return the missing capability or input, decisive evidence, next owner, and the condition for safe resumption.
 
-## Continuation and conflicts
+## Durable routing
 
-- During managed execution, treat a progress or status inquiry as an evidence update, not a stop signal, and continue authorized work while authority and blockers permit it. An explicit pause stops and confirms active workers before acknowledgement, preserves the focused owner, and permits no further mutation until resume. Only an explicit release or unfocus request clears owner selection; environment and verification blockers preserve the focused owner.
-- Resume treats continuation prose only as pointers: reread authority, status, focus, owned diff, blockers, and decisive evidence, invalidate stale claims, and requalify Manage before mutation or dispatch. Never persist paused, worker, controller, or execution-chronology state.
-- When execution stops with accepted work remaining, return one compact continuation with the semantic fields `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, and `Next action`. Keep this field order, but localize the human-facing title and labels to the response language without changing referenced artifact prose or canonical technical values. Reopen its authority pointers, inspect drift, and refresh verification before resuming; it is not durable truth or a second state store.
-- Write a continuation file only when explicitly authorized. Never persist hidden handoff or controller state.
-- If an active merge, rebase, or cherry-pick conflict intersects authorized implementation, inspect the exact operation and conflicted paths, then compare base/ours/theirs semantics in that operation. Resolve only evidenced in-scope content while preserving unrelated work.
-- Stop on unrelated user work, an unresolved product decision, incomplete side/base evidence, or scope beyond the WorkRef. Name the exact conflict and required owner input; do not choose a side, stage a resolution, continue or abort the Git operation, commit, or infer any Git authority.
-- After an authorized working-tree resolution, rerun affected checks and return the continuation. Conflict-resolution authority alone does not grant Git continuation or delivery.
+- Route planned future design to the selected Change; stable implemented facts to the smallest authoritative Spec or explicitly authorized project context; lasting rationale to the configured Decision Record path when warranted; and temporary execution or continuation state to the response.
+- Keep a Change as a convergent current-plan and final-evidence snapshot, not an append-only execution log. Replace superseded plans and evidence; keep routine attempts, transcripts, and temporary probes out of durable artifacts.
+- Before archive, judge current-fact and rationale updates independently, then compress the Change to the delivered outcome, current design, completed Tasks, decisive final verification, unresolved blockers, and remaining risk. Required verification must pass; Optional omissions may remain as explicit coverage warnings. Reclassifying incomplete Required evidence as Optional changes acceptance and requires explicit owner authority plus fresh readiness and review. Change Spec deltas are never promoted automatically.
+- Use the response language for user-visible narration while preserving exact WorkRefs, paths, commands, headings, and machine values. Preserve each existing artifact's established language unless translation is explicitly authorized.
 
-## Safety
+## Safety ceiling
 
-- Do not create RSP-managed files directly when a command owns the operation.
-- Do not create archive entries directly; use `npx -y @oevery/rsp archive <name>`.
-- Do not restore archived Change or Group Brief content directly; use `npx -y @oevery/rsp reopen <name> --reason <text>` or `npx -y @oevery/rsp group reopen <group> --reason <text>` and exact `--from` selection when required.
-- Do not modify content outside the managed RSP block in `AGENTS.md` unless explicitly requested.
-- Archive reports warnings but does not grant commit, push, publication, deletion, or external approval authority.
+- This fallback does not emulate `rsp-manage`, ready-owner qualification, worker dispatch, convergence loops, managed resume, execution-environment selection, or configured closeout. Configuration selects no capability and grants no planning, product-mutation, lifecycle, Git, publication, deployment, approval, or human-acceptance authority. The fallback never selects, prepares, or integrates an execution environment; the host, user, and Git own execution location and cross-branch integration.
+- Do not create or repair command-owned RSP files directly. Do not create archives or restore archived content by editing files; use the owning RSP command only with explicit lifecycle authority.
+- This fallback never archives, closes a Group, stages, commits, tags, pushes, publishes, deploys, deletes unrelated work, or records external approval. Those actions require their own explicit authority and available owning capability.
+- On malformed or incomplete evidence, ambiguous focus or ownership, unresolved decisions, unavailable required capability, failed verification, or out-of-scope work, fail closed without mutation. State what was inspected, what is missing, who owns the next decision or action, and what evidence or authority permits resumption.
+- Return one outer `ControlOutcome` for the selected WorkRef with `mode: solo | delegated | coordinated`, `status: running | waiting | completed`, the current phase outcome or stop reason, decisive evidence, changed artifacts when present, next owner/action, and optional recovery. Status transitions are only `running -> waiting | completed` and `waiting -> running | completed`; route, strategy, lane result, acceptance, and closeout remain nested details or gates rather than peer statuses. This response is not durable truth or a second state store. The fallback reports these semantics but does not emulate Manage qualification, worker delegation, strategy selection, acceptance, or closeout.

package/skills/rsp/SKILL.md

@@ -4,14 +4,14 @@ description: Use this skill when initializing RSP, operating an existing .rsp pr
 license: MIT
 metadata:
   author: oevery
-  version: "2026.07.29.2"
+  version: "2026.08.21.3"
 ---
 
 # RSP Skill
 
 Use RSP to derive one current action from project authority and durable work artifacts. This Skill is the preferred operational guide; `.rsp/rsp-rules.md` is the runtime fallback when the Skill is unavailable.
 
-Nearest project instructions and relevant `CONTEXT.md` remain authoritative. Keep response language user/session-owned and durable project language repository-owned. Response prose follows an explicit current response language, user/host personal instructions, then conversation language; project `.rsp/config.yaml` never selects it. A new authorized artifact follows an explicit artifact language, then the configured effective artifact language, artifact-scoped project instructions, and conversation language; an existing artifact keeps its established language unless translation is explicitly authorized. Configuration changes never rewrite existing artifacts. Commit-message prose follows an explicit current commit-language instruction, configured effective commit language, nearest repository commit authority, then clear recent non-merge history. Preserve canonical headings, paths, commands, identifiers, Conventional Commit types/scopes, trailers, and machine values; WorkRefs follow the Unicode identity contract rather than the natural-language fallback chain. Write persistent artifacts in domain, system, user, or operator language; mention AI or agents only when they are actual product actors or constraints.
+Nearest project instructions and relevant `CONTEXT.md` remain authoritative. Use the response-language and artifact-language rules in [response language](references/response-language.md) for user-visible narration and durable prose. Preserve canonical headings, paths, commands, identifiers, and machine values. WorkRefs are stable identities independent from prose language and locale; Shape owns naming when a new identity must be inferred.
 
 ## Scope
 
@@ -21,70 +21,53 @@ Use this Skill for RSP setup or repair, focused `.rsp/` work, and the durable-up
 
 Read user intent, nearest authority, `rsp status --json`, the selected Change and its readiness, fresh verification evidence, and blockers. Stages are derived guidance, never persisted state.
 
+Use the canonical transient control vocabulary from the maintainer Skill Control Model. Before Core returns or composes a phase result, read the canonical [control outcome](references/control-outcome.md) contract. Route and stop dispositions, dispatch disposition, topology, lane results, acceptance, and closeout remain nested phase-specific details or gates; do not expose them as peer status flows or persist any control object. Core transfers current-phase control to Manage or one Discipline and receives its bounded result. Manage-to-worker communication is delegation, not control transfer: the worker never becomes owner of the managed goal. Core may mutate only RSP control-plane state; product mutation belongs to Implement or a bounded manual Discipline action. Every stop is fail-closed until its declared resume rule succeeds.
+
 Apply these routes in order:
 
-Before later-turn mutation under a direct report, design, tiny, or small route, rederive routing from the now-authorized objective and prospective work. If it materially expands into cross-module implementation, multiple acceptance surfaces, repeated production-path correction, real-host validation, bounded review convergence, lifecycle delivery, or a clear ready successor, establish or reuse the smallest sufficient WorkRef, then apply managed preflight and fresh qualification before mutation. Follow-ups that remain tiny/small stay direct. Elapsed time and message count are never escalation evidence.
+Before later-turn mutation under a direct report, design, tiny, or small route, rederive from the newly authorized objective and prospective work. Independent slices, recovery, distinct execution and acceptance owners, repeated production-path correction, real-host, provider, or hardware validation, bounded review convergence, managed lifecycle delivery, or a clear ready successor requires the smallest sufficient WorkRef plus fresh owner preflight and Manage qualification before mutation. Multiple files or documentation surfaces alone do not. Unchanged direct follow-ups remain direct. Elapsed time and message count alone never escalate work.
 
-1. Stop for ambiguous authority or selection and return the one required input and its owner. For a material owner decision inside an explicit managed request, continue to the Shape preflight in route 2 so repository inspection precedes the single owner question; otherwise stop here.
-2. For a requested completion or continuation that is not a report-only review or release operation, read [managed routing](references/managed-routing.md) when the request is explicitly managed or the effective status policy has `manage.activation: auto`. It owns owner preflight, qualification, later requalification, and the dormant-closeout fail-safe. Select `rsp-manage` only after that preflight for an eligible selected ready Change or shallow Group; once selected, that Skill solely owns interruption and resume, convergence, lifecycle and commit execution detail. Otherwise return the ordinary Core or Discipline action. Automatic activation grants controller selection only; planning, product mutation, lifecycle, Git, and external authority remain separately derived.
-3. Route an explicit report-only review with fixed scope to `rsp-review` when available, otherwise perform the same read-only review manually.
-4. Route an explicit release-documentation, finalization, publication, or reconciliation operation to `rsp-release-docs` when available; otherwise read [release operations](references/release-operations.md) for the manual fallback. Do this before ordinary Change routing.
-5. Route one explicit isolated material domain, module/seam, or evidence-seeking design question to installed `rsp-design`; never manually emulate it. Without a selected Change, use report-only Pre-Change Design only for an already bounded question; return its result without inventing a WorkRef or artifact. With a selected Change, return to that WorkRef. Only when unavailable, its manual fallback inspects authority and the live path, compares credible alternatives, and separates evidence from owner choice without implementation or durable-truth mutation.
-6. With no selected Change, name one ready WorkRef and direct focus action. For tiny settled work, return the direct engineering action. When outcome, scope, non-goals, acceptance, or decomposition is materially unclear, use `rsp-shape` when available and Change mutation is authorized; otherwise manually create or refine one Change to the same ready boundary.
-7. If the Change is not shape-ready, route to Shape under the same authority rule.
-8. For incomplete implementation or stale, missing, or failed verification, use [Implementation evidence](#implementation-evidence).
-9. When Tasks and required verification pass without blockers, perform the durable decision. Do not infer a release operation from Change completion.
+1. Route explicit fixed-scope review to `rsp-review`, release finalization or reconciliation to `rsp-release-docs`, and one bounded design question to installed `rsp-design`; never manually emulate it. Without a selected Change, use report-only Pre-Change Design without inventing a WorkRef or artifact. Only when unavailable, its manual fallback stays bounded to the same question.
+2. Return `RouteDisposition: direct` only for one ready owner, one writer, one execution phase, one integrated decisive check, no recovery, no independent acceptance obligation, no managed lifecycle coordination, and no ready successor. Multiple changed files or documentation surfaces do not by themselves alter that route. Perform no Manage handoff or managed Assignment. After the direct result and fresh verification exist, explicit local commit authority may route exactly once to `rsp-commit` with a `direct` owner summary, exact allowed paths, decisive evidence, and current authority; do not invent a Change, WorkRef, lifecycle state, or RSP trailer. An available Commit refusal returns its real missing condition to Core and never becomes a manual fallback. Rederive before further mutation if any condition changes.
+3. Core resolves whether one unambiguous shape-ready Change or shallow Group is the `WorkOwner` before Manage qualification. Missing or non-ready ownership reports `RouteDisposition: shape`; Core invokes Shape only with independently granted planning-artifact authority. Material product or authority questions stop for their `DecisionOwner`; ask one highest-impact owner question that resumes through fresh Core derivation after the answer. Invalid ownership, topology, dirty paths, scope, route, or authority stops for rerouting.
+4. Read [managed routing](references/managed-routing.md) for initial qualification and handoff. On `selected`, pass the WorkRef, authority, evidence, closeout ceiling, and return boundaries to `rsp-manage`. Once selected, Manage solely owns same-goal revalidation, interruption and resume, selected-goal execution, and lifecycle orchestration; `rsp-commit` retains the exact local delivery procedure. Automatic selection grants routing only.
+5. If Manage is declined, continue ordinary routing when the owner and authority are clear; otherwise return the one required input. For incomplete or failed evidence use [Implementation evidence](#implementation-evidence). When required Tasks and verification pass, load [durable writeback decision](references/durable-review.md); do not infer release, archive, Git, publication, approval, or human acceptance.
 
-State the derived stage, one next action, required input, returned owner, and decisive evidence. When managed routing is evaluated, state `selected` or `declined` with the decisive qualification signal or complete direct-work exclusion; when dispatch applies, also state why it is parallel or sequential. Name at most one optional capability, only when it is the next action and appears in the host's loaded Skill inventory. Missing capabilities never invalidate RSP: give the manual fallback against the same owner. When Core or qualified Manage has derived one authorized RSP-owned local commit boundary, route exact staging, structured message construction, local commit execution, and post-commit observation to `rsp-commit`; if unavailable, use the bounded manual action in durable review against the same owner. Do not preload, enumerate, or recursively invoke optional capabilities.
+Return the canonical outer `ControlOutcome` in localized prose through the Core-owned contract. Preserve exact machine values as secondary technical values and keep route, dispatch disposition, or topology only as nested technical evidence.
 
-### Implementation evidence
+For managed evaluation, report `selected` or `declined` and the decisive signal; report a sequential or parallel choice only when dispatch applies. Name at most one optional capability when it is the next action and available. A missing optional Discipline Skill does not invalidate RSP: use its bounded manual fallback against the same owner. This fallback never substitutes for a required managed worker or required independent Verify. Do not preload or recursively invoke capabilities.
 
-- **Diagnosis first:** diagnosis takes precedence over TDD for an evidenced but unexplained, conflicting, intermittent, or multi-layer failure. Use `rsp-diagnose` when available; its manual fallback reproduces, locates, and tests the smallest discriminating hypothesis. Do not encode an unexplained symptom as a guessed regression test.
-- **TDD when justified:** use `rsp-tdd` only when test-first is explicitly required by the user, Change, or project instructions, or when a concrete changed risk makes a pre-mutation RED materially safer. Public contracts, persisted data, security or money, concurrency, complex transitions, and escaped defects qualify; mere testability or being a fix does not. Its manual fallback observes the focused RED, makes the minimum GREEN change, and refactors only while green.
-- **Ordinary implementation by default:** use `rsp-implement`, or the equivalent bounded edit and verification, once the behavior, cause, and owner are sufficiently evidenced.
+### Implementation evidence
 
-All branches return evidence, Tasks, Verify updates, and blockers to the same Change. Fresh verification is required, but a new test is only one option; use the cheapest decisive check that covers the changed risk.
+For incomplete or failed implementation evidence, read [implementation evidence](references/implementation-evidence.md) before selecting Diagnose, TDD, ordinary Implement, or Verify. Diagnosis precedes TDD; every branch returns evidence to the same Change, and fresh Required verification remains mandatory.
 
 ## Operate the selected Change
 
-Before focusing or mutating a different WorkRef, compare dirty product or durable-truth paths with the prior owner's declared or observed paths. Overlap never transfers ownership: continue the same open WorkRef, explicitly reopen archived acceptance when authorized and applicable, use an explicitly authorized integration owner, or stop for boundary resolution. Disjoint authorized work may proceed without staging or forcing a commit; insufficient evidence stops the transition.
+Before focusing or mutating a different WorkRef, compare dirty product or durable-truth paths with the prior owner's paths. Overlap never transfers ownership; continue, explicitly reopen, use an authorized integration owner, or stop for boundary resolution. Disjoint work may proceed without staging or forcing a commit.
 
-Read the focused Change, its sibling Group Brief when grouped, and only the relevant Specs and Decision Records before implementation. Use generated local `.rsp/specs/**/00-index.md` files only as direct-child navigation; never treat them as durable owners. Run `npx -y @oevery/rsp check --focused` before treating it as ready. Only `focus.d/` markers select current work; open filenames do not. Preserve one explicit `kind` and the canonical Proposal, Spec, Design, Tasks, Verify, and Blockers sections.
+Read the focused Change, its sibling Group Brief when grouped, and only the relevant Specs and Decision Records. Use `rsp specs` for direct tree navigation or bounded literal discovery, then re-read the exact authoritative source before a material decision or mutation; generated index files are migration inputs, not navigation authority. Only a `focus.d/` marker path selects current work. When a Focus Capsule exists, is inspected or mutated, reports warnings, or a continuation resumes, read [focus and continuation recovery](references/focus-continuation.md). Run the focused check before treating the owner as ready. Preserve the canonical Proposal, Spec, Design, Tasks, Verify, and Blockers sections.
 
-Keep the Change a convergent snapshot of the current plan and final decisive evidence. Replace superseded content; keep routine attempts, RED/GREEN chronology, temporary probes, and command transcripts in the response. Update Tasks, Verify, and any invalidated Proposal, Spec, or Design in the same session.
+Keep the Change a convergent snapshot of the current plan and final decisive evidence. Replace superseded content; keep routine attempts, temporary probes, and command transcripts in the response. Persist only `open` and `archived`; focus, readiness, routing, and capability availability grant no implementation, review, Git, publication, or approval authority.
 
-Persist only `open` and `archived`; derive readiness, blockers, stage, and next actions. Do not infer implementation, review, Git, publication, or approval authority from focus, readiness, routing, or capability availability.
+RSP remains repository-native and derives workflow state from current project artifacts and checkout evidence; it requires no hidden runtime state.
 
-When fresh evidence shows that archived acceptance was incomplete, keep the correction under the same owner and read [reopen recovery](references/reopen-recovery.md) before any lifecycle mutation. Reopen requires explicit lifecycle authority and grants no Git or external authority; genuinely new or independently delivered scope uses a new corrective owner.
+When archived acceptance is incomplete, read [reopen recovery](references/reopen-recovery.md) before lifecycle mutation. Reopen requires explicit lifecycle authority and grants no Git or external authority.
 
-Load detailed procedures only when their path is active:
+Load detailed procedures only when active:
 
-- Read [setup and repair](references/setup-repair.md) before initializing, auditing, migrating, or repairing RSP state.
-- Read [groups and dependencies](references/groups-dependencies.md) before creating, focusing, planning, or closing grouped/dependent work.
-- Read [conflict handling](references/conflict-handling.md) only when an active merge, rebase, or cherry-pick conflict intersects authorized work.
-- Read [durable review](references/durable-review.md) only after required Tasks and verification pass, or when auditing archive readiness.
+- [setup and repair](references/setup-repair.md) for initialization, audit, migration, or repair.
+- [groups and dependencies](references/groups-dependencies.md) for grouped or dependent work.
+- [conflict handling](references/conflict-handling.md) for an intersecting Git operation.
+- [durable writeback decision](references/durable-review.md) after required Tasks and implementation verification pass.
 
 ## Ownership and safety
 
-Route planned design to the selected Change; stable implemented facts to the smallest relevant Spec or authorized scoped instruction; lasting rationale to one exact Decision Record; stable navigation to project-owned `CONTEXT.md`; stable operating rules to project-owned `AGENTS.md`; and temporary continuation to the response. Never write planned state as current truth or duplicate facts into rationale.
+Route planned design to the selected Change; implemented facts to the smallest fact owner; rationale to one Decision Record; stable navigation to project-owned `CONTEXT.md`; operating rules to project-owned `AGENTS.md`; temporary continuation to the response. Never write planned state as current truth or duplicate facts into rationale.
 
-Use RSP commands for managed setup, focus, repair, indexes, archive, and reopen. Do not directly create command-owned files, edit generated indexes or `.rsp/rsp-rules.md` as durable truth, or modify the managed RSP block. Preserve unrelated work. Core recommends explicit archive only after the durable decision; it does not execute archive or grant staging, commit, push, publication, deletion, deployment, approval, or human-acceptance authority. A configured `manage.closeout` preset remains dormant unless Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory even under `lifecycle` or `local`. Core also does not execute reopen without explicit lifecycle authority. During a qualified managed run, `rsp-manage` solely owns interruption and resume, convergence, lifecycle and commit execution detail; those procedures create no persisted controller state or additional authority.
+Use RSP commands for command-owned files. Do not directly create command-owned files; preserve unrelated work. Core recommends archive only after the durable decision; it does not execute archive or grant staging, commit, push, publication, deletion, deployment, approval, or human-acceptance authority. Detailed Manage closeout, local Commit, conflict, and recovery rules remain in their owning Skills or conditional references. Execution-environment selection and cross-branch integration remain host, user, or Git concerns outside RSP workflow state.
 
-When accepted work remains, return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values. The continuation points to existing owners, is not a second state store, and must not be persisted without explicit path authority. On resume, reopen its pointers, inspect drift, and refresh decisive evidence.
+When accepted work remains or a continuation resumes, read [focus and continuation recovery](references/focus-continuation.md), then return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values; the continuation is not a second state store. On resume, reopen its pointers to authority and owned artifacts, inspect drift and replay safety, and refresh decisive evidence before mutation.
 
 ## Durable decision output
 
-After loading [durable review](references/durable-review.md), choose current facts and rationale independently. Localize headings and labels, but preserve the canonical values below:
-
-```md
-## <localized Durable Decision heading>
-- <localized Current facts label>: <No current-fact update needed | Update existing spec or scoped instruction | Create a new durable spec>
-- <localized Current-fact target label>: <exact file path or N/A>
-- <localized Facts to write label>: <durable facts or none>
-- <localized Decision Record label>: <No Decision Record needed | Create or update a Decision Record>
-- <localized Decision Record target label>: <exact file path or N/A>
-- <localized Rationale to write label>: <lasting rationale or none>
-- <localized Archive ready label>: <yes | no>
-```
-
-Response-only Continuation and Durable Decision labels are not canonical artifact headings. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone. A required unwritten update or real blocker makes archive readiness `no`; CLI `archiveReady: judgment` is advisory, not approval.
+After loading [durable writeback decision](references/durable-review.md), use its canonical localized output and choose current facts and lasting rationale independently. A required unwritten update, incomplete Task, incomplete Required Verify item, or real blocker makes archive readiness `no`; Optional coverage warnings do not. Before lifecycle closeout, consume fresh `rsp ready <work-ref> --json` evidence with `completionGate: pass` and `archiveReady: yes`.

package/skills/rsp/references/control-outcome.md

@@ -0,0 +1,31 @@
+# Control outcome
+
+Load this reference whenever Core returns or composes the current phase result. `ControlOutcome` is the single outer response receipt for one current WorkRef. Its default session rendering is localized labeled natural language, not a required YAML or JSON object, durable workflow state, or a second status store. Use JSON only for an explicitly identified machine consumer, encode the same semantics, and do not emit a duplicate JSON copy by default.
+
+## Compose the outer receipt
+
+Use these contextual fields, localize their labels, and omit empty optional fields:
+
+```text
+Work: <current WorkRef>
+Mode: <solo | delegated | coordinated>
+Status: <running | waiting | completed>
+Phase: <current control or execution phase>
+Result: <phase-specific result>
+Stop: <phase-specific StopDisposition and reason>
+Evidence: <decisive evidence>
+Changed artifacts: <changed artifacts>
+Next owner: <NextOwner>
+Next action: <next action>
+Recovery: <bounded recovery guidance>
+```
+
+Exactly one of Result or Stop applies. Evidence, Changed artifacts, and Recovery appear only when present. Next owner and Next action form one transition and must not contradict the phase result or stop. The contextual labels shorten and localize the response form; canonical domain concepts such as `ControlOutcome`, `WorkRef`, `NextOwner`, and `StopDisposition` retain their precise names.
+
+## Preserve one status flow
+
+Outer status transitions are only `running -> waiting | completed` and `waiting -> running | completed`. Failure, cancellation, rerouting, verification blocking, and capability loss use the phase-specific `stop`; they never create peer outer status values. Route, dispatch, topology, lane result, acceptance, and closeout remain nested phase details or gates.
+
+The canonical fields retain `mode: solo | delegated | coordinated` and `status: running | waiting | completed`. Use `solo` when no worker participates, including selected Manage execution through a bounded local Discipline; use `delegated` when one worker participates; use `coordinated` when multiple workers participate or acceptance requires a separate verifier. Raw worker messages, host events, retry chronology, and unaccepted evidence never appear as outer receipt fields.
+
+Core composes this receipt from the selected phase result. Shape, Disciplines, and Manage return only their owned bounded result and evidence; they may name this invoking contract but never redefine its complete form. A `ControlOutcome` is response-only, not durable workflow state.

package/skills/rsp/references/durable-review.md

@@ -1,17 +1,36 @@
-# Durable review
+# Durable writeback decision
 
-Load this reference only after required Tasks and verification pass, or when auditing archive readiness.
+Load this reference only after required Tasks and implementation verification pass, or when auditing archive readiness.
+
+This operation is the durable writeback decision, not implementation verification and not fixed-scope change review. Implementation verification supplies fresh evidence after mutation. Fixed-scope change review is a report-only comparison owned by Review and is required only when explicitly requested, required by nearer authority or risk, or needed to derive managed `review-clean`; it is not automatically required for every tiny direct action. The durable writeback decision is always required before archive and independently decides current-fact and Decision Record updates. It never substitutes for fixed-scope change review.
 
 Run `rsp check --focused` and `rsp show --focused --json`, or `rsp ready <name> --json` for an explicit Change. Treat `durableReview.factCandidateTargets` and `decisionRecordsPath` as routing advice, not permission. Spec delta markers are planning aids and are never promoted automatically.
 
+If `rsp show --focused --json` or `rsp ready <name> --json` reports only `RSP project requires an update` after required Tasks and implementation verification already passed, and update mutation is not explicitly authorized, do not run `rsp update`. Preserve the passed implementation verification and `first_fix_result`; report the durable writeback decision and readiness as incomplete because migration evidence is unavailable, and keep archive and commit blocked. This exception never converts a failed declared implementation or independent verification check into success, and other inspection failures remain unresolved.
+
 Choose current facts and rationale independently. Use no update when there is no stable fact or lasting rationale worth rereading.
 
+Return the durable decision in this semantic field order. Localize headings and labels while preserving the canonical values:
+
+```md
+## <localized Durable Decision heading>
+- <localized Current facts label>: <No current-fact update needed | Update existing spec or scoped instruction | Create a new durable spec>
+- <localized Current-fact target label>: <exact file path or N/A>
+- <localized Facts to write label>: <durable facts or none>
+- <localized Decision Record label>: <No Decision Record needed | Create or update a Decision Record>
+- <localized Decision Record target label>: <exact file path or N/A>
+- <localized Rationale to write label>: <lasting rationale or none>
+- <localized Archive ready label>: <yes | no>
+```
+
+Response-only Continuation and Durable Decision labels are not canonical artifact headings. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone.
+
 Write a current-fact update only when implementation changed a stable behavior, boundary, default, or constraint that future maintainers need. Prefer the smallest existing domain Spec, `.rsp/specs/design.md` for project-wide boundaries/navigation, or an explicitly authorized scoped `CONTEXT.md`/`AGENTS.md`; create a new Spec only for reusable project-level truth that fits nowhere existing.
 
 Create or update a Decision Record only for a hard-to-reverse or surprising choice with a real tradeoff. It owns rationale, alternatives, tradeoffs, and consequences—not duplicated current facts. Choose one exact file under `durableReview.decisionRecordsPath`, not the directory itself.
 
 Never use generated indexes, archives, `.rsp/rsp-rules.md`, or the managed RSP block as ordinary writeback targets. Keep narrative history, debugging notes, task chronology, and transient evidence out of Specs and Decisions.
 
-Before archive, compress the Change to current design, completed outcomes, decisive evidence, omissions, remaining risks, and blockers. Archive only after required updates are written or explicitly unnecessary. Ordinary work needs later explicit Git authority for one independently reviewable logical commit. A `manage.closeout` preset applies only when Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory and configuration executes neither archive nor commit. In a qualified managed continuation, lifecycle closeout is independent from Git and follows the effective ceiling: `manual` leaves archive advisory, while `lifecycle` or `local` permits `rsp archive <change-work-ref>` after Core durable review unless nearer authority narrows it. For a shallow Group with lifecycle closeout, independently review and archive each child, re-derive completion, and run `rsp group close <group>` only after every child and Group gate passes. Inspect each complete lifecycle diff before deciding Git separately. `manual` and `lifecycle` grant no commit; `local` may justify recovery checkpoints and, after lifecycle closeout, requires one `rsp-commit` invocation for a terminal non-small Change or Group when owner, paths, fresh decisive verification, and a clean exact boundary are known and no nearer denial exists. Terminal small work defaults to no commit; ambiguous, mixed, stale, or denied boundaries stop without staging. A separately authorized release operation may use a dedicated release commit. Push remains separate and requires the user to mention it explicitly.
+Before archive, compress the Change to current design, completed outcomes, decisive evidence, omissions, remaining risks, and blockers. Archive only after required writeback is complete or explicitly unnecessary and every separately required fixed-scope change review is clean. Ordinary work needs later explicit Git authority for one independently reviewable logical commit. A `manage.closeout` preset applies only when Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory and configuration executes neither archive nor commit. In a qualified managed continuation, lifecycle closeout is independent from Git and follows the effective ceiling: `manual` leaves archive advisory, while `lifecycle` or `local` permits `rsp archive <change-work-ref>` after the durable writeback decision unless nearer authority narrows it. For a shallow Group with lifecycle closeout, make the durable writeback decision and archive each child independently, re-derive completion, and run `rsp group close <group>` only after every child and Group gate passes. Inspect each complete lifecycle diff before deciding Git separately. `manual` and `lifecycle` grant no commit; `local` may justify recovery checkpoints and, after lifecycle closeout, requires one `rsp-commit` invocation for a terminal non-small Change or Group when owner, paths, fresh decisive verification, and a clean exact boundary are known and no nearer denial exists. Terminal small work defaults to no commit; ambiguous, mixed, stale, or denied boundaries stop without staging. A separately authorized release operation may use a dedicated release commit. Push remains separate and requires the user to mention it explicitly.
 
-When commit eligibility and authority exist, give `rsp-commit` one envelope containing the Change, Group/wave, or confirmed release owner, exact allowed paths, decisive evidence, lifecycle state, and current authority. If that Skill is unavailable, perform the same bounded manual action: reread nearest authority and owner; inspect staged, unstaged, and untracked paths, the cached diff, and recent non-merge messages; stop without staging on ambiguity or stale evidence; stage only allowed paths; re-inspect the complete cached boundary; derive a repository-consistent Conventional subject plus a proportionate body and truthful RSP trailers; create one local commit; then observe its complete message, paths, remaining worktree, and remote safety without amending or performing any external action.
+When commit eligibility and authority exist, give `rsp-commit` one envelope containing the `change`, `group`, or `release` owner variant, exact allowed paths, decisive evidence, applicable lifecycle or release-boundary evidence, and current authority. Only if that Skill is unavailable, perform the same bounded manual action: reread nearest authority and owner; inspect staged, unstaged, and untracked paths, the cached diff, and recent non-merge messages; stop without staging on ambiguity or stale evidence; stage only allowed paths; re-inspect the complete cached boundary; derive a repository-consistent Conventional subject plus a proportionate body and truthful owner-derived trailers; create one local commit; then observe its complete message, paths, remaining worktree, and remote safety without amending or performing any external action. An available Commit Skill that rejects its envelope returns the missing condition and does not authorize manual reimplementation.

package/skills/rsp/references/focus-continuation.md

@@ -0,0 +1,9 @@
+# Focus and continuation recovery
+
+Load this reference only when a Focus Capsule exists, is inspected or mutated, reports warnings, accepted work needs a continuation, or a continuation resumes.
+
+The optional bounded Markdown Focus Capsule is a Manager-owned recovery pointer, never selection, authority, acceptance, worker transport, or host runtime state. A portable commit-safe v1 capsule permits only one leading version comment, blank lines, exactly one non-empty single-line `Current`, `Evidence`, and `Next`, and at most one non-empty single-line `Resume check`; unknown non-empty lines or fields are invalid. It excludes worker identity, handles, machine-specific paths, raw worker messages, chronology, topology, authority, acceptance, logs, diffs, and duplicated Tasks.
+
+When accepted work remains, return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values; the continuation is not a second state store.
+
+On same-session resume, reopen its pointers to authority and owned artifacts, inspect drift and replay safety, and refresh decisive evidence. On cross-session or cross-device resume, distrust transient worker and liveness claims and rederive authority, focus, baseline, dirty state, conflicting resources, blockers, evidence freshness, route, and Manage qualification before mutation.

package/skills/rsp/references/implementation-evidence.md

@@ -0,0 +1,12 @@
+# Implementation evidence
+
+Load this reference only when implementation evidence is incomplete or failed and Core must select Diagnose, TDD, ordinary Implement, or Verify.
+
+Apply these routes in order:
+
+- **Diagnosis first:** diagnosis takes precedence over TDD for an evidenced but unexplained, conflicting, intermittent, or multi-layer failure. Use `rsp-diagnose` when available; its manual fallback reproduces, locates, and tests the smallest discriminating hypothesis. Do not encode an unexplained symptom as a guessed regression test.
+- **TDD when justified:** use `rsp-tdd` only when test-first is explicitly required by the user, Change, or project instructions, or when a concrete changed risk makes a pre-mutation RED materially safer; mere testability or being a fix does not qualify. Its manual fallback observes the focused RED, makes the minimum GREEN change, and refactors only while green.
+- **Ordinary implementation by default:** use `rsp-implement`, or the equivalent bounded edit and verification, once the behavior, cause, and owner are sufficiently evidenced.
+- **Verification as one bounded action:** use `rsp-verify` for a read-only pass over the Change-declared evidence boundary. Verify owns its result; Core retains routing and continuation, while Manage validates required results and derives acceptance and closeout. Any worker identity or independence evidence comes from the host, not Verify self-report.
+
+All branches return evidence, Tasks, Verify updates, and blockers to the same Change. Required verification proves acceptance or changed material risk; Optional verification adds environment, compatibility, scale, or confidence coverage. Fresh Required verification is mandatory, and optional omissions remain visible warnings.