@oevery/rsp 3.2.0 → 3.3.0

package/dist/{entry-RG6HREUN.mjs → entry-YAW3PYFA.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   inspectPackagedSkillInventory
-} from "./chunk-JYDEJEM4.mjs";
+} from "./chunk-QM2UVPQK.mjs";
 import {
   openTerminalSession,
   truncateDisplay
 } from "./chunk-JOMFFQRG.mjs";
-import "./chunk-SEGJLWRE.mjs";
+import "./chunk-7HXQNBIG.mjs";
 
 // src/skills-tui/entry.tsx
 import process from "process";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oevery/rsp",
   "type": "module",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "RSP (Reliable Software Practice), a repository-native engineering workflow for humans and AI agents",
   "author": "oevery",
   "license": "MIT",
@@ -37,10 +37,11 @@
   },
   "scripts": {
     "prepare": "pnpm run build",
-    "release:check": "pnpm run release:metadata-check && pnpm run docs:check && pnpm run docs:build && pnpm run build && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run release:package-check",
-    "release:candidate-check": "node scripts/release-candidate-check.mjs && pnpm run release:check",
-    "release:metadata-check": "node scripts/release-metadata-check.mjs",
-    "release:package-check": "node scripts/clean-install-check.mjs",
+    "release:acceptance": "node scripts/release-acceptance.mjs",
+    "release:behavior-check": "node scripts/release-behavior-acceptance.mjs",
+    "release:provider-compare": "node scripts/release-provider-comparison.mjs",
+    "release:candidate-check": "node scripts/release-candidate-check.mjs && node scripts/release-behavior-evidence-check.mjs && pnpm run release:acceptance",
+    "skills:security-check": "node scripts/skill-security-preflight.mjs --suppressions skill-security-suppressions.json",
     "prepublishOnly": "pnpm run release:candidate-check",
     "build": "tsup",
     "dev": "tsup --watch",
@@ -52,18 +53,22 @@
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest"
+    "test": "pnpm run build && vitest run",
+    "test:watch": "vitest --config vitest.watch.config.ts"
   },
   "dependencies": {
     "citty": "^0.2.2",
     "ink": "~7.1.1",
+    "mdast-util-from-markdown": "2.0.3",
+    "mdast-util-gfm": "3.1.0",
+    "micromark-extension-gfm": "3.0.0",
     "picocolors": "^1.1.1",
     "react": "~19.2.8",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^9.2.0",
+    "@types/mdast": "4.0.4",
     "@types/node": "^22.20.1",
     "@types/react": "19.2.17",
     "eslint": "^10.8.0",

package/rules/rsp-rules.md

@@ -11,7 +11,7 @@ This file is the minimal fallback protocol for agents that cannot load the `rsp`
 
 - Read the nearest `AGENTS.md` and relevant `CONTEXT.md` before RSP work. Use the root `CONTEXT-MAP.md` when present.
 - Apply this fallback before operating `.rsp/` only after the Core Skill is absent or cannot be used.
-- Treat `focus.d/` as the only current-focus source. For grouped work, read the sibling Group Brief before the explicitly focused child Change. Then read only the relevant Specs and Decision Records under the configured authoritative path.
+- Treat each `focus.d/` marker path as the only current-focus source. A marker may contain a short optional Markdown Focus Capsule with Manager-accepted recovery pointers, but its prose never selects work or grants authority, acceptance, lifecycle, Git, or worker coordination. A valid non-empty v1 capsule contains only one leading `<!-- rsp-focus:v1 -->`, blank lines, exactly one non-empty single-line `Current`, `Evidence`, and `Next`, and at most one non-empty single-line `Resume check`; unknown non-empty lines or fields are invalid. Legacy unversioned content is warning-only compatibility and makes no structured recovery claim. For grouped work, read the sibling Group Brief before the explicitly focused child Change. Then read only the relevant Specs and Decision Records under the configured authoritative path.
 - If `focus.d/` is empty and the user has not provided a concrete task, ask what to work on or suggest `npx -y @oevery/rsp create <name>`. Do not infer current work from open Changes or filenames.
 
 ## Ownership
@@ -19,7 +19,7 @@ This file is the minimal fallback protocol for agents that cannot load the `rsp`
 - `changes/` owns open work, `archives/` owns completed history, `specs/` owns stable current facts, and the configured Decision Record path owns lasting rationale and tradeoffs.
 - A Change owns one executable outcome and its acceptance, Tasks, verification, and blockers. Executable WorkRefs are `<change>` or one direct `<group>/<change>` child. A Group Brief provides shared context but is not executable or focusable.
 - For a new inferred WorkRef, preserve explicit valid user input first, otherwise follow an explicit nearest project or domain naming convention, otherwise use ASCII lowercase kebab-case from stable domain or technical vocabulary. Language or locale settings never select or translate WorkRef language. Valid Unicode remains available through explicit input or project/domain convention, and existing identities are never renamed by later guidance.
-- Persist only `open` and `archived` lifecycle state. Readiness, blockers, routes, verification freshness, progress, and next actions are derived from current artifacts and evidence.
+- Persist only `open` and `archived` lifecycle state. Readiness, blockers, routes, and acceptance remain derived from current artifacts and evidence. A Focus Capsule may project accepted current work, next action, evidence validity, and blockers for recovery without becoming lifecycle or controller state. Under `## Verify`, `### Required` owns acceptance-critical evidence and `### Optional` owns additional coverage; legacy unclassified items are Required. Incomplete Tasks, Required verification, or blockers fail the completion gate, while Optional omissions remain visible warnings.
 - Project-owned `AGENTS.md` and `CONTEXT.md` retain their own instruction and context authority. RSP does not replace them.
 - Prefer RSP commands for deterministic setup, status, validation, repair, focus, Spec-index, history, archive, and reopen operations. Invalid identity, structure, dependency, managed path, symlink, or incomplete inspection fails closed.
 
@@ -28,6 +28,7 @@ This file is the minimal fallback protocol for agents that cannot load the `rsp`
 - Derive the next action from user intent, explicit authority, the selected WorkRef, its current Change and Group Brief when any, relevant durable facts, the worktree, and fresh status or verification evidence.
 - Perform at most one bounded ordinary Core action or one optional Discipline action against the same owner. A mutation requires one ready owner, an explicit boundary, settled acceptance criteria, and one decisive verification. Do not auto-continue a successor or widen the boundary because more work is visible.
 - When an optional Discipline Skill is unavailable, a compact manual fallback may cover only the same bounded owner and action. It never substitutes for a required managed worker, independent verification, unresolved product or authority decision, or missing acceptance.
+- When the next action is a read-only pass over a Change-declared evidence boundary, use `rsp-verify` when available. Verify owns the bounded result and evidence; Core retains routing, while Manage validates required results and derives acceptance and closeout. Any required identity or independence evidence comes from the host. If Verify is unavailable, a manual fallback may collect only the same declared evidence and must report the capability gap truthfully.
 - Before later mutation or a different WorkRef, rederive authority and inspect dirty product and durable-truth paths. Continue the same owner, use an explicitly authorized reopen or integration owner, or stop for boundary resolution when ownership overlaps or remains uncertain.
 - If the action becomes multi-owner, cross-boundary, dependent on managed coordination, or unsafe without an unavailable capability, stop. Return the missing capability or input, decisive evidence, next owner, and the condition for safe resumption.
 
@@ -35,13 +36,13 @@ This file is the minimal fallback protocol for agents that cannot load the `rsp`
 
 - Route planned future design to the selected Change; stable implemented facts to the smallest authoritative Spec or explicitly authorized project context; lasting rationale to the configured Decision Record path when warranted; and temporary execution or continuation state to the response.
 - Keep a Change as a convergent current-plan and final-evidence snapshot, not an append-only execution log. Replace superseded plans and evidence; keep routine attempts, transcripts, and temporary probes out of durable artifacts.
-- Before archive, judge current-fact and rationale updates independently, then compress the Change to the delivered outcome, current design, completed Tasks, decisive final verification, unresolved blockers, and remaining risk. Change Spec deltas are never promoted automatically.
+- Before archive, judge current-fact and rationale updates independently, then compress the Change to the delivered outcome, current design, completed Tasks, decisive final verification, unresolved blockers, and remaining risk. Required verification must pass; Optional omissions may remain as explicit coverage warnings. Reclassifying incomplete Required evidence as Optional changes acceptance and requires explicit owner authority plus fresh readiness and review. Change Spec deltas are never promoted automatically.
 - Use the response language for user-visible narration while preserving exact WorkRefs, paths, commands, headings, and machine values. Preserve each existing artifact's established language unless translation is explicitly authorized.
 
 ## Safety ceiling
 
-- This fallback does not emulate `rsp-manage`, ready-owner qualification, worker dispatch, convergence loops, managed resume, or configured closeout. Configuration selects no capability and grants no planning, product-mutation, lifecycle, Git, publication, deployment, approval, or human-acceptance authority.
+- This fallback does not emulate `rsp-manage`, ready-owner qualification, worker dispatch, convergence loops, managed resume, execution-environment selection, or configured closeout. Configuration selects no capability and grants no planning, product-mutation, lifecycle, Git, publication, deployment, approval, or human-acceptance authority. The fallback never selects, prepares, or integrates an execution environment; the host, user, and Git own execution location and cross-branch integration.
 - Do not create or repair command-owned RSP files directly. Do not create archives or restore archived content by editing files; use the owning RSP command only with explicit lifecycle authority.
 - This fallback never archives, closes a Group, stages, commits, tags, pushes, publishes, deploys, deletes unrelated work, or records external approval. Those actions require their own explicit authority and available owning capability.
 - On malformed or incomplete evidence, ambiguous focus or ownership, unresolved decisions, unavailable required capability, failed verification, or out-of-scope work, fail closed without mutation. State what was inspected, what is missing, who owns the next decision or action, and what evidence or authority permits resumption.
-- Return the selected `WorkRef`, effective authority, changed artifacts, fresh verification, blockers, and next action. This response is not durable truth or a second state store.
+- Return one outer `ControlOutcome` for the selected WorkRef with `mode: solo | delegated | coordinated`, `status: running | waiting | completed`, the current phase outcome or stop reason, decisive evidence, changed artifacts when present, next owner/action, and optional recovery. Status transitions are only `running -> waiting | completed` and `waiting -> running | completed`; route, strategy, lane result, acceptance, and closeout remain nested details or gates rather than peer statuses. This response is not durable truth or a second state store. The fallback reports these semantics but does not emulate Manage qualification, worker delegation, strategy selection, acceptance, or closeout.

package/skills/rsp/SKILL.md

@@ -4,14 +4,14 @@ description: Use this skill when initializing RSP, operating an existing .rsp pr
 license: MIT
 metadata:
   author: oevery
-  version: "2026.08.05.2"
+  version: "2026.08.21.3"
 ---
 
 # RSP Skill
 
 Use RSP to derive one current action from project authority and durable work artifacts. This Skill is the preferred operational guide; `.rsp/rsp-rules.md` is the runtime fallback when the Skill is unavailable.
 
-Nearest project instructions and relevant `CONTEXT.md` remain authoritative. Keep response language user/session-owned and durable project language repository-owned. Response prose follows an explicit current response language, user/host personal instructions, then conversation language; project `.rsp/config.yaml` never selects it. Every user-visible RSP progress update, phase or stage description, control result, worker receipt, stop reason, and handoff uses natural-language narration selected by that precedence. When exact identity matters, retain a canonical technical value unchanged in parentheses or code formatting; when its language differs from the response language, it must not stand alone as the human-facing label. This response-only rule does not change persisted artifact language or host-owned hidden reasoning summaries. A new authorized artifact follows an explicit artifact language, then the configured effective artifact language, artifact-scoped project instructions, and conversation language; an existing artifact keeps its established language unless translation is explicitly authorized. Configuration changes never rewrite existing artifacts. Commit-message prose follows an explicit current commit-language instruction, configured effective commit language, nearest repository commit authority, then clear recent non-merge history. Preserve canonical headings, paths, commands, identifiers, Conventional Commit types/scopes, trailers, and machine values. WorkRefs are stable identities independent from artifact, commit, response, host locale, and TUI language settings. Existing identities are never renamed by later language or naming guidance; when a new WorkRef must be inferred, Shape owns its naming policy. Write persistent artifacts in domain, system, user, or operator language; mention AI or agents only when they are actual product actors or constraints.
+Nearest project instructions and relevant `CONTEXT.md` remain authoritative. Use the response-language and artifact-language rules in [response language](references/response-language.md) for user-visible narration and durable prose. Preserve canonical headings, paths, commands, identifiers, and machine values. WorkRefs are stable identities independent from prose language and locale; Shape owns naming when a new identity must be inferred.
 
 ## Scope
 
@@ -21,84 +21,53 @@ Use this Skill for RSP setup or repair, focused `.rsp/` work, and the durable-up
 
 Read user intent, nearest authority, `rsp status --json`, the selected Change and its readiness, fresh verification evidence, and blockers. Stages are derived guidance, never persisted state.
 
-Represent each current decision as one response-only transient `ControlOutcome`: phase, phase-specific disposition, decisive evidence, next owner, required input when any, and the rule for resuming or rederiving. Never persist it in a Change, Group Brief, Spec, Decision Record, archive, registry, or generated projection.
-
-Core's `RouteDisposition` is exactly `specialist`, `direct`, `managed`, `shape`, or `stop`:
-
-- `specialist`: one bounded Discipline result; the Discipline does not become a completion controller.
-- `direct`: one non-managed completion or continuation, one decisive verification, no WorkerEnvelope, and at most one Discipline executor.
-- `managed`: one selected shape-ready owner and bounded goal handed to Manage; only this route composes worker lanes and review convergence.
-- `shape`: unclear owned work returned to Shape.
-- `stop`: no further action until one `StopDisposition` resume contract succeeds.
-
-Core may directly mutate only RSP control-plane state; product mutation belongs to Implement or the same bounded manual Discipline action. `StopDisposition` is exactly `ask-owner`, `return-to-shape`, `reroute`, `retry-with-evidence`, `environment-blocked`, `verification-blocked`, or `capability-unavailable`. No stop disposition permits worker dispatch, product mutation, lifecycle closeout, or Git action before its resume contract succeeds.
+Use the canonical transient control vocabulary from the maintainer Skill Control Model. Before Core returns or composes a phase result, read the canonical [control outcome](references/control-outcome.md) contract. Route and stop dispositions, dispatch disposition, topology, lane results, acceptance, and closeout remain nested phase-specific details or gates; do not expose them as peer status flows or persist any control object. Core transfers current-phase control to Manage or one Discipline and receives its bounded result. Manage-to-worker communication is delegation, not control transfer: the worker never becomes owner of the managed goal. Core may mutate only RSP control-plane state; product mutation belongs to Implement or a bounded manual Discipline action. Every stop is fail-closed until its declared resume rule succeeds.
 
 Apply these routes in order:
 
-Before later-turn mutation under a direct report, design, tiny, or small route, rederive from the newly authorized objective and prospective work. Cross-module implementation, multiple acceptance surfaces, repeated production-path correction, real-host validation, bounded review convergence, lifecycle delivery, or a clear ready successor requires the smallest sufficient WorkRef plus fresh owner preflight and Manage qualification before mutation. Unchanged tiny/small follow-ups remain direct. Elapsed time and message count alone never escalate work.
+Before later-turn mutation under a direct report, design, tiny, or small route, rederive from the newly authorized objective and prospective work. Independent slices, recovery, distinct execution and acceptance owners, repeated production-path correction, real-host, provider, or hardware validation, bounded review convergence, managed lifecycle delivery, or a clear ready successor requires the smallest sufficient WorkRef plus fresh owner preflight and Manage qualification before mutation. Multiple files or documentation surfaces alone do not. Unchanged direct follow-ups remain direct. Elapsed time and message count alone never escalate work.
 
-1. Route an explicit report-only review with fixed scope to `rsp-review` when available, otherwise perform the same read-only review manually.
-2. Route an explicit release-documentation, finalization, publication, or reconciliation operation to `rsp-release-docs` when available; otherwise read [release operations](references/release-operations.md) for the manual fallback. Do this before ordinary Change routing.
-3. Route one explicit isolated material domain, module/seam, or evidence-seeking design question to installed `rsp-design`; never manually emulate it. Without a selected Change, use report-only Pre-Change Design for an already bounded question without inventing a WorkRef or artifact. Tracked Design returns to its selected WorkRef. Only when unavailable, its manual fallback stays with the same question and performs no implementation or durable-truth mutation.
-4. Return tiny settled work directly only when it satisfies the complete small-work exclusion: one owner, one local seam, one mutation pass, one decisive check, no managed lifecycle coordination, and no ready successor. Report `RouteDisposition: direct`. Perform no Manage handoff or WorkerEnvelope, and rederive before further mutation if prospective work expands beyond any condition.
-5. For every other requested completion or continuation, Core resolves whether one unambiguous shape-ready Change or shallow Group is the `WorkOwner`. Missing or non-ready ownership reports `RouteDisposition: shape`; Core invokes Shape only with independently granted planning-artifact authority, then re-reads status and freshly derives ownership and routing from the returned ready WorkOwner. Material product or authority questions stop for their `DecisionOwner`; invalid WorkOwner, topology, dirty-path, route, scope, or authority stops with `StopDisposition: reroute`.
-6. With one ready owner, read [managed routing](references/managed-routing.md). It solely owns initial qualification and the `selected | declined` result: under `auto`, consider non-small completion or continuation; under `explicit`, qualify only an explicitly managed request. On selection, hand `rsp-manage` the goal, WorkRef, authority envelope, decisive qualification evidence, closeout ceiling, and return boundaries. Manage validates current handoff evidence without repeating eligibility. Once selected, Manage solely owns same-goal revalidation, interruption and resume, review convergence, acceptance, lifecycle closeout, and commit eligibility and orchestration; `rsp-commit` retains exact Git execution. Return to Core only for changed owner identity, topology, requested route, behavior, acceptance, public interface, scope, mutation authority, or external-action authority. Automatic activation selects a controller but grants no planning, product mutation, lifecycle, Git, or external authority.
-7. If Manage is not selected, stop only when authority or selection is actually ambiguous, then return the one required input and its `DecisionOwner`. With no selected Change, name one ready WorkRef and direct focus action. Otherwise preserve ordinary routing under the clear ready WorkOwner and continue to Implementation evidence or the durable decision as applicable; `manage.activation: explicit` without an explicitly managed request is not itself a stop signal.
-8. For incomplete implementation or stale, missing, or failed verification, use [Implementation evidence](#implementation-evidence). This is implementation verification.
-9. When Tasks and required verification pass without blockers, perform the durable writeback decision. A fixed-scope change review remains a separate report-only gate: require it only when explicitly requested, required by nearer authority or risk, or needed for managed `review-clean`; do not impose it automatically on every tiny direct action. Do not infer a release operation from Change completion.
+1. Route explicit fixed-scope review to `rsp-review`, release finalization or reconciliation to `rsp-release-docs`, and one bounded design question to installed `rsp-design`; never manually emulate it. Without a selected Change, use report-only Pre-Change Design without inventing a WorkRef or artifact. Only when unavailable, its manual fallback stays bounded to the same question.
+2. Return `RouteDisposition: direct` only for one ready owner, one writer, one execution phase, one integrated decisive check, no recovery, no independent acceptance obligation, no managed lifecycle coordination, and no ready successor. Multiple changed files or documentation surfaces do not by themselves alter that route. Perform no Manage handoff or managed Assignment. After the direct result and fresh verification exist, explicit local commit authority may route exactly once to `rsp-commit` with a `direct` owner summary, exact allowed paths, decisive evidence, and current authority; do not invent a Change, WorkRef, lifecycle state, or RSP trailer. An available Commit refusal returns its real missing condition to Core and never becomes a manual fallback. Rederive before further mutation if any condition changes.
+3. Core resolves whether one unambiguous shape-ready Change or shallow Group is the `WorkOwner` before Manage qualification. Missing or non-ready ownership reports `RouteDisposition: shape`; Core invokes Shape only with independently granted planning-artifact authority. Material product or authority questions stop for their `DecisionOwner`; ask one highest-impact owner question that resumes through fresh Core derivation after the answer. Invalid ownership, topology, dirty paths, scope, route, or authority stops for rerouting.
+4. Read [managed routing](references/managed-routing.md) for initial qualification and handoff. On `selected`, pass the WorkRef, authority, evidence, closeout ceiling, and return boundaries to `rsp-manage`. Once selected, Manage solely owns same-goal revalidation, interruption and resume, selected-goal execution, and lifecycle orchestration; `rsp-commit` retains the exact local delivery procedure. Automatic selection grants routing only.
+5. If Manage is declined, continue ordinary routing when the owner and authority are clear; otherwise return the one required input. For incomplete or failed evidence use [Implementation evidence](#implementation-evidence). When required Tasks and verification pass, load [durable writeback decision](references/durable-review.md); do not infer release, archive, Git, publication, approval, or human acceptance.
 
-State the `ControlOutcome`, derived stage, one next action, required input, returned owner, decisive evidence, and resume or rederivation rule. `ask-owner` asks one highest-impact owner question and resumes through fresh Core derivation after the answer; `return-to-shape` resumes only after Shape confirms a ready owner; `reroute` requires a valid owner or authority boundary. Other stops name the evidence, environment, verification, or capability condition that must change.
+Return the canonical outer `ControlOutcome` in localized prose through the Core-owned contract. Preserve exact machine values as secondary technical values and keep route, dispatch disposition, or topology only as nested technical evidence.
 
-For managed evaluation, state `selected` or `declined` with the decisive qualification signal or complete direct-work exclusion; when dispatch applies, state why it is parallel or sequential. Name at most one optional Discipline Skill, only when it is the next action and appears in the host's loaded Skill inventory. A missing optional Discipline Skill does not invalidate RSP: use its bounded manual fallback against the same owner. This fallback never substitutes for a required managed worker or required independent Verify: keep acceptance incomplete and stop with `capability-unavailable` or the more specific evidenced `StopDisposition`. For an authorized exact local commit boundary, route exact staging, structured message construction, local commit execution, and post-commit observation to `rsp-commit`; if unavailable, use the durable-decision manual fallback. Do not preload, enumerate, or recursively invoke optional capabilities.
+For managed evaluation, report `selected` or `declined` and the decisive signal; report a sequential or parallel choice only when dispatch applies. Name at most one optional capability when it is the next action and available. A missing optional Discipline Skill does not invalidate RSP: use its bounded manual fallback against the same owner. This fallback never substitutes for a required managed worker or required independent Verify. Do not preload or recursively invoke capabilities.
 
 ### Implementation evidence
 
-- **Diagnosis first:** diagnosis takes precedence over TDD for an evidenced but unexplained, conflicting, intermittent, or multi-layer failure. Use `rsp-diagnose` when available; its manual fallback reproduces, locates, and tests the smallest discriminating hypothesis. Do not encode an unexplained symptom as a guessed regression test.
-- **TDD when justified:** use `rsp-tdd` only when test-first is explicitly required by the user, Change, or project instructions, or when a concrete changed risk makes a pre-mutation RED materially safer. Public contracts, persisted data, security or money, concurrency, complex transitions, and escaped defects qualify; mere testability or being a fix does not. Its manual fallback observes the focused RED, makes the minimum GREEN change, and refactors only while green.
-- **Ordinary implementation by default:** use `rsp-implement`, or the equivalent bounded edit and verification, once the behavior, cause, and owner are sufficiently evidenced.
-
-All branches return evidence, Tasks, Verify updates, and blockers to the same Change. Fresh verification is required, but a new test is only one option; use the cheapest decisive check that covers the changed risk.
+For incomplete or failed implementation evidence, read [implementation evidence](references/implementation-evidence.md) before selecting Diagnose, TDD, ordinary Implement, or Verify. Diagnosis precedes TDD; every branch returns evidence to the same Change, and fresh Required verification remains mandatory.
 
 ## Operate the selected Change
 
-Before focusing or mutating a different WorkRef, compare dirty product or durable-truth paths with the prior owner's declared or observed paths. Overlap never transfers ownership: continue the same open WorkRef, explicitly reopen archived acceptance when authorized and applicable, use an explicitly authorized integration owner, or stop for boundary resolution. Disjoint authorized work may proceed without staging or forcing a commit; insufficient evidence stops the transition.
+Before focusing or mutating a different WorkRef, compare dirty product or durable-truth paths with the prior owner's paths. Overlap never transfers ownership; continue, explicitly reopen, use an authorized integration owner, or stop for boundary resolution. Disjoint work may proceed without staging or forcing a commit.
 
-Read the focused Change, its sibling Group Brief when grouped, and only the relevant Specs and Decision Records before implementation. Use generated local `.rsp/specs/**/00-index.md` files only as direct-child navigation; never treat them as durable owners. Run `npx -y @oevery/rsp check --focused` before treating it as ready. Only `focus.d/` markers select current work; open filenames do not. Preserve one explicit `kind` and the canonical Proposal, Spec, Design, Tasks, Verify, and Blockers sections.
+Read the focused Change, its sibling Group Brief when grouped, and only the relevant Specs and Decision Records. Use `rsp specs` for direct tree navigation or bounded literal discovery, then re-read the exact authoritative source before a material decision or mutation; generated index files are migration inputs, not navigation authority. Only a `focus.d/` marker path selects current work. When a Focus Capsule exists, is inspected or mutated, reports warnings, or a continuation resumes, read [focus and continuation recovery](references/focus-continuation.md). Run the focused check before treating the owner as ready. Preserve the canonical Proposal, Spec, Design, Tasks, Verify, and Blockers sections.
 
-Keep the Change a convergent snapshot of the current plan and final decisive evidence. Replace superseded content; keep routine attempts, RED/GREEN chronology, temporary probes, and command transcripts in the response. Update Tasks, Verify, and any invalidated Proposal, Spec, or Design in the same session.
+Keep the Change a convergent snapshot of the current plan and final decisive evidence. Replace superseded content; keep routine attempts, temporary probes, and command transcripts in the response. Persist only `open` and `archived`; focus, readiness, routing, and capability availability grant no implementation, review, Git, publication, or approval authority.
 
-Persist only `open` and `archived`; derive readiness, blockers, stage, and next actions. Do not infer implementation, review, Git, publication, or approval authority from focus, readiness, routing, or capability availability.
+RSP remains repository-native and derives workflow state from current project artifacts and checkout evidence; it requires no hidden runtime state.
 
-When fresh evidence shows that archived acceptance was incomplete, keep the correction under the same owner and read [reopen recovery](references/reopen-recovery.md) before any lifecycle mutation. Reopen requires explicit lifecycle authority and grants no Git or external authority; genuinely new or independently delivered scope uses a new corrective owner.
+When archived acceptance is incomplete, read [reopen recovery](references/reopen-recovery.md) before lifecycle mutation. Reopen requires explicit lifecycle authority and grants no Git or external authority.
 
-Load detailed procedures only when their path is active:
+Load detailed procedures only when active:
 
-- Read [setup and repair](references/setup-repair.md) before initializing, auditing, migrating, or repairing RSP state.
-- Read [groups and dependencies](references/groups-dependencies.md) before creating, focusing, planning, or closing grouped/dependent work.
-- Read [conflict handling](references/conflict-handling.md) only when an active merge, rebase, or cherry-pick conflict intersects authorized work.
-- Read [durable writeback decision](references/durable-review.md) only after required Tasks and implementation verification pass, or when auditing archive readiness.
+- [setup and repair](references/setup-repair.md) for initialization, audit, migration, or repair.
+- [groups and dependencies](references/groups-dependencies.md) for grouped or dependent work.
+- [conflict handling](references/conflict-handling.md) for an intersecting Git operation.
+- [durable writeback decision](references/durable-review.md) after required Tasks and implementation verification pass.
 
 ## Ownership and safety
 
-Route planned design to the selected Change; stable implemented facts to the smallest relevant Spec or authorized scoped instruction; lasting rationale to one exact Decision Record; stable navigation to project-owned `CONTEXT.md`; stable operating rules to project-owned `AGENTS.md`; and temporary continuation to the response. Never write planned state as current truth or duplicate facts into rationale.
+Route planned design to the selected Change; implemented facts to the smallest fact owner; rationale to one Decision Record; stable navigation to project-owned `CONTEXT.md`; operating rules to project-owned `AGENTS.md`; temporary continuation to the response. Never write planned state as current truth or duplicate facts into rationale.
 
-Use RSP commands for managed setup, focus, repair, indexes, archive, and reopen. Do not directly create command-owned files, edit generated indexes or `.rsp/rsp-rules.md` as durable truth, or modify the managed RSP block. Preserve unrelated work. Core recommends explicit archive only after the durable decision; it does not execute archive or grant staging, commit, push, publication, deletion, deployment, approval, or human-acceptance authority. A configured `manage.closeout` preset remains dormant unless Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory even under `lifecycle` or `local`. Core also does not execute reopen without explicit lifecycle authority. During a qualified managed run, `rsp-manage` solely owns interruption and resume, convergence, lifecycle closeout, and commit eligibility and orchestration; `rsp-commit` owns exact Git execution. Those procedures create no persisted controller state or additional authority.
+Use RSP commands for command-owned files. Do not directly create command-owned files; preserve unrelated work. Core recommends archive only after the durable decision; it does not execute archive or grant staging, commit, push, publication, deletion, deployment, approval, or human-acceptance authority. Detailed Manage closeout, local Commit, conflict, and recovery rules remain in their owning Skills or conditional references. Execution-environment selection and cross-branch integration remain host, user, or Git concerns outside RSP workflow state.
 
-When accepted work remains, return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values. The continuation points to existing owners, is not a second state store, and must not be persisted without explicit path authority. On resume, reopen its pointers, inspect drift, and refresh decisive evidence.
+When accepted work remains or a continuation resumes, read [focus and continuation recovery](references/focus-continuation.md), then return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values; the continuation is not a second state store. On resume, reopen its pointers to authority and owned artifacts, inspect drift and replay safety, and refresh decisive evidence before mutation.
 
 ## Durable decision output
 
-After loading [durable writeback decision](references/durable-review.md), choose current facts and rationale independently. Localize headings and labels, but preserve the canonical values below:
-
-```md
-## <localized Durable Decision heading>
-- <localized Current facts label>: <No current-fact update needed | Update existing spec or scoped instruction | Create a new durable spec>
-- <localized Current-fact target label>: <exact file path or N/A>
-- <localized Facts to write label>: <durable facts or none>
-- <localized Decision Record label>: <No Decision Record needed | Create or update a Decision Record>
-- <localized Decision Record target label>: <exact file path or N/A>
-- <localized Rationale to write label>: <lasting rationale or none>
-- <localized Archive ready label>: <yes | no>
-```
-
-Response-only Continuation and Durable Decision labels are not canonical artifact headings. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone. A required unwritten update or real blocker makes archive readiness `no`; CLI `archiveReady: judgment` is advisory, not approval.
+After loading [durable writeback decision](references/durable-review.md), use its canonical localized output and choose current facts and lasting rationale independently. A required unwritten update, incomplete Task, incomplete Required Verify item, or real blocker makes archive readiness `no`; Optional coverage warnings do not. Before lifecycle closeout, consume fresh `rsp ready <work-ref> --json` evidence with `completionGate: pass` and `archiveReady: yes`.

package/skills/rsp/references/control-outcome.md

@@ -0,0 +1,31 @@
+# Control outcome
+
+Load this reference whenever Core returns or composes the current phase result. `ControlOutcome` is the single outer response receipt for one current WorkRef. Its default session rendering is localized labeled natural language, not a required YAML or JSON object, durable workflow state, or a second status store. Use JSON only for an explicitly identified machine consumer, encode the same semantics, and do not emit a duplicate JSON copy by default.
+
+## Compose the outer receipt
+
+Use these contextual fields, localize their labels, and omit empty optional fields:
+
+```text
+Work: <current WorkRef>
+Mode: <solo | delegated | coordinated>
+Status: <running | waiting | completed>
+Phase: <current control or execution phase>
+Result: <phase-specific result>
+Stop: <phase-specific StopDisposition and reason>
+Evidence: <decisive evidence>
+Changed artifacts: <changed artifacts>
+Next owner: <NextOwner>
+Next action: <next action>
+Recovery: <bounded recovery guidance>
+```
+
+Exactly one of Result or Stop applies. Evidence, Changed artifacts, and Recovery appear only when present. Next owner and Next action form one transition and must not contradict the phase result or stop. The contextual labels shorten and localize the response form; canonical domain concepts such as `ControlOutcome`, `WorkRef`, `NextOwner`, and `StopDisposition` retain their precise names.
+
+## Preserve one status flow
+
+Outer status transitions are only `running -> waiting | completed` and `waiting -> running | completed`. Failure, cancellation, rerouting, verification blocking, and capability loss use the phase-specific `stop`; they never create peer outer status values. Route, dispatch, topology, lane result, acceptance, and closeout remain nested phase details or gates.
+
+The canonical fields retain `mode: solo | delegated | coordinated` and `status: running | waiting | completed`. Use `solo` when no worker participates, including selected Manage execution through a bounded local Discipline; use `delegated` when one worker participates; use `coordinated` when multiple workers participate or acceptance requires a separate verifier. Raw worker messages, host events, retry chronology, and unaccepted evidence never appear as outer receipt fields.
+
+Core composes this receipt from the selected phase result. Shape, Disciplines, and Manage return only their owned bounded result and evidence; they may name this invoking contract but never redefine its complete form. A `ControlOutcome` is response-only, not durable workflow state.

package/skills/rsp/references/durable-review.md

@@ -6,8 +6,25 @@ This operation is the durable writeback decision, not implementation verificatio
 
 Run `rsp check --focused` and `rsp show --focused --json`, or `rsp ready <name> --json` for an explicit Change. Treat `durableReview.factCandidateTargets` and `decisionRecordsPath` as routing advice, not permission. Spec delta markers are planning aids and are never promoted automatically.
 
+If `rsp show --focused --json` or `rsp ready <name> --json` reports only `RSP project requires an update` after required Tasks and implementation verification already passed, and update mutation is not explicitly authorized, do not run `rsp update`. Preserve the passed implementation verification and `first_fix_result`; report the durable writeback decision and readiness as incomplete because migration evidence is unavailable, and keep archive and commit blocked. This exception never converts a failed declared implementation or independent verification check into success, and other inspection failures remain unresolved.
+
 Choose current facts and rationale independently. Use no update when there is no stable fact or lasting rationale worth rereading.
 
+Return the durable decision in this semantic field order. Localize headings and labels while preserving the canonical values:
+
+```md
+## <localized Durable Decision heading>
+- <localized Current facts label>: <No current-fact update needed | Update existing spec or scoped instruction | Create a new durable spec>
+- <localized Current-fact target label>: <exact file path or N/A>
+- <localized Facts to write label>: <durable facts or none>
+- <localized Decision Record label>: <No Decision Record needed | Create or update a Decision Record>
+- <localized Decision Record target label>: <exact file path or N/A>
+- <localized Rationale to write label>: <lasting rationale or none>
+- <localized Archive ready label>: <yes | no>
+```
+
+Response-only Continuation and Durable Decision labels are not canonical artifact headings. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone.
+
 Write a current-fact update only when implementation changed a stable behavior, boundary, default, or constraint that future maintainers need. Prefer the smallest existing domain Spec, `.rsp/specs/design.md` for project-wide boundaries/navigation, or an explicitly authorized scoped `CONTEXT.md`/`AGENTS.md`; create a new Spec only for reusable project-level truth that fits nowhere existing.
 
 Create or update a Decision Record only for a hard-to-reverse or surprising choice with a real tradeoff. It owns rationale, alternatives, tradeoffs, and consequences—not duplicated current facts. Choose one exact file under `durableReview.decisionRecordsPath`, not the directory itself.
@@ -16,4 +33,4 @@ Never use generated indexes, archives, `.rsp/rsp-rules.md`, or the managed RSP b
 
 Before archive, compress the Change to current design, completed outcomes, decisive evidence, omissions, remaining risks, and blockers. Archive only after required writeback is complete or explicitly unnecessary and every separately required fixed-scope change review is clean. Ordinary work needs later explicit Git authority for one independently reviewable logical commit. A `manage.closeout` preset applies only when Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory and configuration executes neither archive nor commit. In a qualified managed continuation, lifecycle closeout is independent from Git and follows the effective ceiling: `manual` leaves archive advisory, while `lifecycle` or `local` permits `rsp archive <change-work-ref>` after the durable writeback decision unless nearer authority narrows it. For a shallow Group with lifecycle closeout, make the durable writeback decision and archive each child independently, re-derive completion, and run `rsp group close <group>` only after every child and Group gate passes. Inspect each complete lifecycle diff before deciding Git separately. `manual` and `lifecycle` grant no commit; `local` may justify recovery checkpoints and, after lifecycle closeout, requires one `rsp-commit` invocation for a terminal non-small Change or Group when owner, paths, fresh decisive verification, and a clean exact boundary are known and no nearer denial exists. Terminal small work defaults to no commit; ambiguous, mixed, stale, or denied boundaries stop without staging. A separately authorized release operation may use a dedicated release commit. Push remains separate and requires the user to mention it explicitly.
 
-When commit eligibility and authority exist, give `rsp-commit` one envelope containing the Change, Group/wave, or confirmed release owner, exact allowed paths, decisive evidence, lifecycle state, and current authority. If that Skill is unavailable, perform the same bounded manual action: reread nearest authority and owner; inspect staged, unstaged, and untracked paths, the cached diff, and recent non-merge messages; stop without staging on ambiguity or stale evidence; stage only allowed paths; re-inspect the complete cached boundary; derive a repository-consistent Conventional subject plus a proportionate body and truthful RSP trailers; create one local commit; then observe its complete message, paths, remaining worktree, and remote safety without amending or performing any external action.
+When commit eligibility and authority exist, give `rsp-commit` one envelope containing the `change`, `group`, or `release` owner variant, exact allowed paths, decisive evidence, applicable lifecycle or release-boundary evidence, and current authority. Only if that Skill is unavailable, perform the same bounded manual action: reread nearest authority and owner; inspect staged, unstaged, and untracked paths, the cached diff, and recent non-merge messages; stop without staging on ambiguity or stale evidence; stage only allowed paths; re-inspect the complete cached boundary; derive a repository-consistent Conventional subject plus a proportionate body and truthful owner-derived trailers; create one local commit; then observe its complete message, paths, remaining worktree, and remote safety without amending or performing any external action. An available Commit Skill that rejects its envelope returns the missing condition and does not authorize manual reimplementation.

package/skills/rsp/references/focus-continuation.md

@@ -0,0 +1,9 @@
+# Focus and continuation recovery
+
+Load this reference only when a Focus Capsule exists, is inspected or mutated, reports warnings, accepted work needs a continuation, or a continuation resumes.
+
+The optional bounded Markdown Focus Capsule is a Manager-owned recovery pointer, never selection, authority, acceptance, worker transport, or host runtime state. A portable commit-safe v1 capsule permits only one leading version comment, blank lines, exactly one non-empty single-line `Current`, `Evidence`, and `Next`, and at most one non-empty single-line `Resume check`; unknown non-empty lines or fields are invalid. It excludes worker identity, handles, machine-specific paths, raw worker messages, chronology, topology, authority, acceptance, logs, diffs, and duplicated Tasks.
+
+When accepted work remains, return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values; the continuation is not a second state store.
+
+On same-session resume, reopen its pointers to authority and owned artifacts, inspect drift and replay safety, and refresh decisive evidence. On cross-session or cross-device resume, distrust transient worker and liveness claims and rederive authority, focus, baseline, dirty state, conflicting resources, blockers, evidence freshness, route, and Manage qualification before mutation.

package/skills/rsp/references/implementation-evidence.md

@@ -0,0 +1,12 @@
+# Implementation evidence
+
+Load this reference only when implementation evidence is incomplete or failed and Core must select Diagnose, TDD, ordinary Implement, or Verify.
+
+Apply these routes in order:
+
+- **Diagnosis first:** diagnosis takes precedence over TDD for an evidenced but unexplained, conflicting, intermittent, or multi-layer failure. Use `rsp-diagnose` when available; its manual fallback reproduces, locates, and tests the smallest discriminating hypothesis. Do not encode an unexplained symptom as a guessed regression test.
+- **TDD when justified:** use `rsp-tdd` only when test-first is explicitly required by the user, Change, or project instructions, or when a concrete changed risk makes a pre-mutation RED materially safer; mere testability or being a fix does not qualify. Its manual fallback observes the focused RED, makes the minimum GREEN change, and refactors only while green.
+- **Ordinary implementation by default:** use `rsp-implement`, or the equivalent bounded edit and verification, once the behavior, cause, and owner are sufficiently evidenced.
+- **Verification as one bounded action:** use `rsp-verify` for a read-only pass over the Change-declared evidence boundary. Verify owns its result; Core retains routing and continuation, while Manage validates required results and derives acceptance and closeout. Any worker identity or independence evidence comes from the host, not Verify self-report.
+
+All branches return evidence, Tasks, Verify updates, and blockers to the same Change. Required verification proves acceptance or changed material risk; Optional verification adds environment, compatibility, scale, or confidence coverage. Fresh Required verification is mandatory, and optional omissions remain visible warnings.

package/skills/rsp/references/managed-routing.md

@@ -4,7 +4,8 @@ Load this reference only for a requested completion or continuation that is not
 
 ## OWNER PREFLIGHT — Core resolves the owner without execution
 
-Use this route after Core has preserved the fixed-scope Review, release, isolated Design, and tiny settled-work exceptions. Here fixed-scope Review means the explicit report-only fixed-scope change review. Under `manage.activation: explicit`, consider Manage only for an explicitly managed request. Under `manage.activation: auto`, consider it for every other requested completion or continuation that does not satisfy the complete small-work exclusion: one owner, one local seam, one mutation pass, one decisive check, no managed lifecycle coordination, and no ready successor.
+Use this route after Core has preserved the fixed-scope Review, release, isolated Design, and settled direct-work exceptions. Here fixed-scope Review means the explicit report-only fixed-scope change review. Under `manage.activation: explicit`, consider Manage only for an explicitly managed request. Under `manage.activation: auto`, qualify only from an observable coordination obligation; task size, file count, and elapsed effort are not substitutes.
+The tiny settled-work exceptions remain direct when the concrete session task is already clear and no sufficient ready WorkOwner exists. A Manage decline for that case reports the complete small-work exclusion and performs no Manage handoff or worker delegation; it does not manufacture a Change merely to satisfy controller entry.
 
 Treat the requested goal and independently allowed planning and product mutations as a transient authority envelope. Automatic activation grants controller selection only and never adds planning or product-mutation authority. Core resolves the smallest sufficient owner before testing Manage eligibility, without dispatching work or mutating product state.
 
@@ -14,30 +15,30 @@ Core derives one ownership `ControlOutcome`. `WorkOwner` means the selected shap
 
 A prior direct report, design, tiny, or small route is not sticky. Before later-turn mutation, rederive from the now-authorized objective and prospective work. Material expansion into cross-module implementation, multiple acceptance surfaces, repeated production-path correction, real-host validation, bounded review convergence, lifecycle delivery, or a clear ready successor requires Core to establish or reuse the smallest sufficient WorkRef and rerun owner preflight plus fresh Manage qualification before mutation. Unchanged tiny/small follow-ups remain direct; elapsed time and message count alone never trigger escalation.
 
-Owner preflight creates no Task, Blocker, worker envelope, frontier, ticket, run record, or synthetic WorkRef. Manage has no pre-owner Intake and never creates, focuses, or reshapes the durable owner.
+Owner preflight creates no Task, Blocker, worker task, frontier, ticket, run record, or synthetic WorkRef. Manage has no pre-owner Intake and never creates, focuses, or reshapes the durable owner.
 
 ## QUALIFY — select or decline Manage
 
-Select `rsp-manage` only for one selected ready Change or shallow Group that qualifies through at least one independent path: genuinely independent slices, interruption recovery, or prospective execution signals showing more than one bounded phase or authority surface. Prospective signals are implementation followed by integration verification, managed review, or lifecycle work; cross-module or cross-process mutation; real-host, provider, or hardware verification; bounded finding convergence; or a clear ready successor. A Change with prospective or recovery work does not also need independent or parallelizable slices. Derive these signals before dispatch from the authorized objective and expected phases; elapsed wall-clock minutes are never qualification evidence.
+Select `rsp-manage` only for one selected ready Change or shallow Group that qualifies through at least one independent path: genuinely independent slices, interruption recovery, distinct execution and acceptance owners, real-host, provider, or hardware verification, bounded finding convergence, managed lifecycle coordination, a clear ready successor, or prospective execution that contains more than one bounded phase or authority surface. A Change with one of these coordination obligations does not also need parallelizable slices. Derive the signal before dispatch from the authorized objective and expected phases; elapsed wall-clock minutes are never qualification evidence.
 
 A Group qualifies when it has at least two ready children, or when the continuation qualifies through prospective signals or recovery.
 
-Under automatic activation, bias non-small continuation toward Manage. A tracked completion spanning authoritative Specs, product presentation, public documentation, and multiple verification surfaces is multi-surface non-small work and reports `selected` even when one writer owns all mutations and dispatch must remain sequential. Writer count and lack of parallelism do not collapse multiple acceptance or authority surfaces into one local seam.
+Multiple files, Specs, product presentation, public documentation, or verification files do not by themselves qualify Manage. Under automatic activation, a hard near-miss remains direct when it has one owner, one writer, one execution phase, one integrated check, no recovery, no independent acceptance obligation, and no ready successor. Do not manufacture a second phase, worker, or acceptance surface from file layout.
 
-Decline as direct one-step work only when all of these are true: one owner, one local seam, one mutation pass, one decisive check, no managed lifecycle coordination, and no ready successor. A selected ready completion or continuation that fails any one of these conditions qualifies as non-small through this automatic path even when no separate prospective signal is obvious; do not leave the middle case unclassified. Worker-only work remains ineligible. Readiness alone does not qualify work without a requested completion or continuation, and automatic routing remains bounded by the requested goal.
+Substantial sequential work remains selected when a real multi-phase or authority obligation exists, such as implementation followed by independently owned acceptance, bounded review convergence, real-host verification, lifecycle closeout, or a ready successor. Sequential dispatch does not erase that coordination signal. Without such a signal, decline Manage and continue the ordinary Core or Discipline route. Worker-only work remains ineligible. Readiness alone does not qualify work without a requested completion or continuation, and automatic routing remains bounded by the requested goal.
 
-Make the route observable: report `selected` with the decisive qualification signal, or `declined` with the complete direct-work exclusion and exact Core or Discipline action. If dispatch applies, report the concrete overlap/isolation evidence that makes it sequential or parallel. Selection, decline, and dispatch reasoning remain transient and create no controller state.
+Make the route observable inside the single outer `ControlOutcome`: report `selected` with the decisive qualification signal, or `declined` with the complete direct-work exclusion and exact Core or Discipline action. Selection transfers current-phase control from Core to Manage; it does not imply worker delegation. The outer mode is `solo` before or without any worker, `delegated` when one worker participates, or `coordinated` when multiple workers participate or acceptance requires a separate verifier. Manage independently derives `DispatchDisposition: none | preferred | required` after selection. If dispatch applies, retain the strategy only as nested technical evidence and report the concrete overlap or isolation evidence that makes execution sequential or parallel. Selection, decline, dispatch disposition, and strategy reasoning remain transient and create no controller state.
 
 ## HANDOFF AND RETURN — bound selected execution
 
-Core and this reference solely own initial qualification and the `selected | declined` route result. Core hands selected Manage the goal, WorkRef, authority envelope, decisive qualification evidence, closeout ceiling, and exact return boundaries as transient control data. Manage validates handoff completeness and current owner, authority, and diff drift, but never repeats direct-versus-managed eligibility. Selected execution remains wholly owned by `rsp-manage`.
+Core and this reference solely own initial qualification and the `selected | declined` route result. Core hands selected Manage the goal, WorkRef, authority envelope, decisive qualification evidence, closeout ceiling, and exact return boundaries as transient control data. Manage validates the current owner, authority, baseline, observed execution location, conflicting resources, acceptance surfaces, and diff drift, then chooses the smallest safe strategy; it never repeats direct-versus-managed eligibility. Selected execution remains wholly owned by `rsp-manage`.
 
 - Ordinary Fix, Verify, Review, or Resolve Findings receipts remain inside Manage for fresh same-goal revalidation.
 - A clear in-scope ready successor under the unchanged owner topology and authority may continue inside the same managed goal.
 - Owner identity, topology, requested route, behavior, acceptance, public interface, scope, mutation authority, or external-action authority changes return evidence to Core for fresh ownership and routing.
 - Shape is entered only through Core when durable owner refinement is independently authorized.
 
-Never persist the goal envelope, WorkSet, waves, discovery classification, or transition chronology.
+The managed goal envelope and returned control objects remain transient.
 
 ## Dormant closeout fail-safe
 

package/skills/rsp/references/response-language.md

@@ -0,0 +1,11 @@
+# Response and artifact language
+
+Load this reference when the current action needs language selection beyond the Core routing summary.
+
+Response prose is user/session-owned. Precedence: explicit current response-language instruction → user or host personal instructions → conversation language. Project `.rsp/config.yaml` never selects response language. Use natural-language narration for progress, phases, control results, receipts, stop reasons, and handoffs. Preserve an exact machine value unchanged only as a secondary parenthesized or code-formatted value.
+
+Durable artifact prose is repository-owned. For a new authorized artifact: explicit artifact language → configured effective artifact language → artifact-scoped project instructions → conversation language. Existing artifacts retain their established language unless translation is explicitly authorized; configuration changes never rewrite them.
+
+Commit-message prose: explicit current instruction → configured effective commit language → nearest repository authority → clear recent non-merge history.
+
+Preserve canonical headings, paths, commands, identifiers, WorkRefs, Conventional Commit types and scopes, trailers, severity labels, and machine values. Language and locale never rename or translate an existing WorkRef. Persistent prose belongs to the domain, system, user, or operator; mention AI or agents only when they are actual product actors or constraints.

package/skills/rsp/references/setup-repair.md

@@ -4,8 +4,8 @@ Load this reference only before initializing, auditing, migrating, or repairing
 
 1. Initialize with `npx -y @oevery/rsp init [--agents-mode managed|print] [--with-project-setup]`.
 2. `--with-project-setup` creates and focuses `changes/project-setup.md`. Without it, create that Change only when explicit bootstrap tracking is still needed.
-3. Put project-wide boundaries in `.rsp/specs/design.md`, use generated local `00-index.md` files only for direct-child navigation, put cohesive reusable facts in the smallest domain Spec, and keep stable operating instructions in the nearest project-owned `AGENTS.md` outside its managed block.
-4. Diagnose with `npx -y @oevery/rsp doctor`. Apply only deterministic repairs with `doctor --fix` or `rsp update`; `fixed` entries are real filesystem mutations, while an empty list means nothing changed.
+3. Put project-wide boundaries in `.rsp/specs/design.md`, use `rsp specs` for direct current-file navigation and bounded literal discovery, put cohesive reusable facts in the smallest domain Spec, and keep stable operating instructions in the nearest project-owned `AGENTS.md` outside its managed block.
+4. Diagnose with `npx -y @oevery/rsp doctor`. Apply only deterministic repository repairs with `doctor --fix` or `rsp update`; `fixed` entries are real filesystem mutations, while an empty list means nothing changed.
 5. Do not use repair commands to decide stale focus, semantic durable updates, or archive readiness.
 
-For manual audit, require `.rsp/`, managed roots, and nested Spec parents to be real directories. Require the project `AGENTS.md`, managed markers, fallback/config files, generated local `00-index.md` files, and placeholders to be regular files. Confirm the managed block, root and populated-directory Specs indexes, `specs/design.md`, configured Decision Record exclusion, valid group briefs and direct children, supported path depth, and focus markers matching executable Changes. Symlinks, special files, incomplete inspection, unrecognized reserved indexes, and file/directory identity collisions fail closed.
+For manual audit, require `.rsp/`, managed roots, and nested Spec parents to be real directories. Require the project `AGENTS.md`, managed markers, fallback/config files, `specs/design.md`, placeholders, and any reserved generated-index compatibility path to be regular files. Confirm the managed block, direct Specs query, configured Decision Record exclusion, valid group briefs and direct children, supported path depth, and focus markers matching executable Changes. Symlinks, special files, incomplete inspection, unrecognized reserved indexes, and file/directory identity collisions fail closed. Fresh initialization and Spec creation never generate indexes. `rsp update` removes only a root `INDEX.md` or any `00-index.md` with exact generated Specs metadata, using complete preflight, quarantine, direct-query postcheck, and rollback; owner-controlled reserved content is preserved for explicit review.

package/skills/rsp-commit/SKILL.md

@@ -1,23 +1,34 @@
 ---
 name: rsp-commit
-description: Create one authorized, exact-scope local commit for an RSP-owned Change, Group wave, or confirmed release boundary with a repository-consistent structured message.
+description: Create one authorized, exact-scope local commit for a Core- or Manage-derived direct, Change, Group, or release boundary with a repository-consistent structured message.
 license: MIT
 metadata:
   author: oevery
-  version: "2026.07.28.2"
+  version: "2026.08.17.1"
 ---
 
 # RSP Commit
 
-Create one reviewable local commit after Core or qualified Manage has already derived the owner, allowed paths, decisive verification, lifecycle state, and commit authority. Skill availability grants none of those facts. Accept only one Change, one integration-coupled Group wave, one Group closeout, or one confirmed release commit boundary.
+Create one reviewable local commit after Core or qualified Manage has already derived one transient Commit envelope. Skill availability grants none of its facts. The envelope contains exactly one owner variant, exact allowed paths, fresh decisive verification, current commit authority, and lifecycle evidence only when the owner variant requires it.
+
+Accept exactly one owner variant:
+
+| Owner | Required identity and evidence | RSP metadata |
+| --- | --- | --- |
+| `direct` | a concise owner summary for one confirmed direct Tiny/Small boundary | none |
+| `change` | one real WorkRef and its applicable checkpoint or lifecycle evidence | `RSP-WorkRef` |
+| `group` | one integration-coupled wave or Group closeout, its Group ref, included WorkRefs, and applicable lifecycle evidence | `RSP-Group` and included `RSP-WorkRef` values |
+| `release` | one confirmed release identity and release-boundary evidence | only real included WorkRefs, when supplied |
+
+A direct owner is a transient Git delivery boundary, not a durable RSP WorkOwner. Never require it to create a Change, invent a WorkRef, or supply lifecycle evidence.
 
 Follow Core's response-versus-artifact language boundary for all user-visible control narration; when the response language differs, keep exact canonical values only as secondary parenthesized or code-formatted tokens.
 
 ## Audit the envelope
 
-Read nearest project authority, the relevant open Change, Group Brief and children, archive, or confirmed release owner, then inspect `git status`, staged, unstaged, and untracked paths, the cached diff, and recent non-merge commit messages. Recheck the supplied verification and lifecycle facts against current repository state.
+Read nearest project authority and the selected owner evidence: the supplied direct outcome summary, relevant open Change, Group Brief and children, archive, or confirmed release boundary. Then inspect `git status`, staged, unstaged, and untracked paths, the cached diff, and recent non-merge commit messages. Recheck supplied verification and any applicable lifecycle facts against current repository state. For a terminal Change or Group child, inspect its open or archived Verify section and stop before staging when a Task or Required Verify item remains incomplete or a blocker remains active. Legacy unclassified Verify items are Required. Optional coverage warnings do not block a terminal commit, but include a material omission in the commit body when it affects review. A checkpoint commit remains explicitly non-terminal and does not claim completed acceptance.
 
-Stop without staging when the owner, allowed paths, commit authority, verification, lifecycle state, or logical boundary is missing, ambiguous, stale, or conflicts with unrelated work. Stop when an allowed path contains mixed owned and unrelated changes that cannot be staged without guessing. Never infer archive, Group closeout, commit, push, tag, publication, approval, amend, rebase, force-push, or history-rewrite authority.
+Stop without staging when the owner variant, its required identity, allowed paths, commit authority, verification, applicable lifecycle evidence, or logical boundary is missing, ambiguous, stale, or conflicts with unrelated work. A missing WorkRef or lifecycle state is not a defect for a valid direct owner. Refuse an active merge, cherry-pick, revert, rebase, mail-apply, or sequencer operation before commit execution. Stop when an allowed path contains mixed owned and unrelated changes that cannot be staged without guessing. Never infer archive, Group closeout, commit, cross-branch integration, push, tag, publication, approval, amend, rebase, force-push, or history-rewrite authority.
 
 ## Derive the message
 
@@ -25,13 +36,15 @@ Choose subject and body prose language from explicit current commit-language ins
 
 Use the repository's established Conventional Commit form when present. Derive type and scope from the owned outcome and repository history, not from the conversation. Keep the subject concise and imperative or otherwise repository-consistent.
 
-A tiny or mechanical boundary may be subject-only when that subject fully explains it. For a non-trivial Change, integration wave, Group closeout, or release commit, add two to four concise bullets covering:
+Describe the accepted diff as a reader who did not see the working session. Omit rejected session-only alternatives, corrections, and temporary attempts that never entered the authoritative baseline. Such an alternative is not an omission: do not name or paraphrase it as a `without X`, `did not add X`, or `did not use X` compliance claim. Name a removal, exclusion, failed external action, compatibility boundary, migration, safety rule, audit fact, or requested comparison when it is a real owned change or material review fact.
+
+A tiny, mechanical, or direct `Tiny` or `Small` boundary may be subject-only when that subject fully explains it. For a non-trivial Change, integration wave, Group closeout, or release commit, add two to four concise bullets covering:
 
 - the observable outcome;
 - material behavior or compatibility boundaries; and
 - an important omission or risk when one affects review.
 
-Do not copy file lists, command transcripts, routine verification output, execution chronology, or the full Change/archive. Add only truthful trailers: one `RSP-WorkRef:` per included WorkRef, `RSP-Group:` when the Group is the commit owner, authoritative external references already owned by the work, and `BREAKING CHANGE:` only for an actual breaking change. Never invent an issue, co-author, sign-off, breaking change, or AI attribution.
+Do not copy file lists, command transcripts, routine verification output, execution chronology, or the full Change or archive. Project trailers from the selected owner variant: add one `RSP-WorkRef:` per real included WorkRef and `RSP-Group:` only when the Group is the owner. A direct or release owner with no included WorkRefs emits no RSP trailer. Add authoritative external references already owned by the work and `BREAKING CHANGE:` only for an actual breaking change. Never invent a WorkRef, Group, issue, co-author, sign-off, breaking change, or AI attribution.
 
 Project every owned issue relationship as a non-closing `Issue: <canonical-url>` reference when proportionate. Only a terminal commit whose selected Change acceptance is complete may additionally use a provider-supported closing keyword for an explicit `relation: closes`. Checkpoints, `relation: relates`, ambiguous Change or Group ownership, and unresolved provider or repository identity emit no closing keyword. When safe shorthand cannot be resolved, keep only the canonical URL; never infer an issue from changed files or mutate the external tracker.
 
@@ -41,8 +54,10 @@ Stage only the explicit allowed paths. Re-read `git status --short`, inspect the
 
 Transport a structured multiline message with actual line breaks or a safely prepared message file. Do not rely on ordinary quoted `\n` escape sequences as portable newlines; a host shell may pass those characters through literally.
 
-Create one local commit with the prepared subject, optional body, and trailers. Do not push, tag, publish, amend, rebase, or force-push. Afterward observe `HEAD`, the raw complete committed message, committed paths, remaining worktree state, and remote refs when required. A successful commit is still a post-commit mismatch when the observed message differs from the prepared message, including unintended literal `\n` sequences; report and stop without inferring amend or second-commit authority.
+When the packaged CLI is available, use `rsp commit --message-file <path> [--json]` for the exact local execution step. The command reads the prepared message file, rejects unintended literal `\n` sequences, and invokes `git commit --cleanup=verbatim -F -` through Node's direct child-process API. It operates only on the existing staged boundary; it never stages paths itself.
+
+Create one local commit with the prepared subject, optional body, and trailers. Do not cherry-pick, clean another checkout, push, tag, publish, amend, rebase, or force-push. Afterward observe exact before and after `HEAD`, the raw complete committed message, committed paths, remaining worktree paths, and remote refs when required. Confirm that committed paths equal the reviewed staged boundary. Compare the observed stored message with the prepared message exactly, allowing only one terminal LF difference in either direction for Git's message-file boundary. A successful commit is still a post-commit mismatch when either paths or message differ; report the complete observed receipt and stop without inferring amend or second-commit authority. If the command is unavailable, use a safely prepared message file with a direct non-shell Git invocation and retain the same preflight and post-commit checks.
 
 ## Return the receipt
 
-Return the commit SHA, owner and included WorkRefs, committed paths, parsed subject/body/trailers, remaining worktree paths, and explicit omissions. Report a stop before staging, commit failure, or post-commit mismatch truthfully; never silently amend or create a second commit to repair the first.
+Return before and after `HEAD`, the commit SHA, owner kind and identity, included WorkRefs when present, the complete stored message with parsed subject/body/trailers, committed paths, remaining worktree paths, and explicit omissions. Report a stop before staging, commit failure, receipt-observation failure, or post-commit path or message mismatch truthfully; never silently amend or create a second commit to repair the first. An available Commit Skill that rejects an invalid envelope returns that stop; manual fallback is only for capability unavailability.