@oevery/rsp 3.2.0 → 4.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oevery/rsp",
   "type": "module",
-  "version": "3.2.0",
+  "version": "4.0.0",
   "description": "RSP (Reliable Software Practice), a repository-native engineering workflow for humans and AI agents",
   "author": "oevery",
   "license": "MIT",
@@ -29,7 +29,6 @@
   "files": [
     "bin/",
     "dist/",
-    "rules/",
     "skills/"
   ],
   "engines": {
@@ -37,11 +36,10 @@
   },
   "scripts": {
     "prepare": "pnpm run build",
-    "release:check": "pnpm run release:metadata-check && pnpm run docs:check && pnpm run docs:build && pnpm run build && pnpm run typecheck && pnpm run lint && pnpm run test && pnpm run release:package-check",
-    "release:candidate-check": "node scripts/release-candidate-check.mjs && pnpm run release:check",
-    "release:metadata-check": "node scripts/release-metadata-check.mjs",
-    "release:package-check": "node scripts/clean-install-check.mjs",
-    "prepublishOnly": "pnpm run release:candidate-check",
+    "skills:security-check": "node scripts/skill-security-preflight.mjs",
+    "skills:package-check": "node scripts/skill-package-check.mjs",
+    "prepublishOnly": "pnpm run release:check",
+    "release": "release-it",
     "build": "tsup",
     "dev": "tsup --watch",
     "docs:build": "vitepress build docs",
@@ -52,26 +50,41 @@
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest"
+    "test": "pnpm run build && pnpm run test:code",
+    "test:code": "vitest run --no-file-parallelism",
+    "test:diagnostics": "vitest run --config tests/diagnostics/vitest.config.ts",
+    "test:pack": "node tests/code/package/package-check.mjs",
+    "test:skills": "uv run --frozen --project tests/skills python tests/skills/evaluate.py",
+    "release:check": "pnpm run build && pnpm run typecheck && pnpm run lint && pnpm run test:code && pnpm run test:skills check && pnpm run skills:security-check && pnpm run docs:check"
   },
   "dependencies": {
     "citty": "^0.2.2",
-    "ink": "~7.1.1",
+    "hast-util-from-html": "^2.0.3",
+    "ink": "~8.0.0",
+    "mdast-util-from-markdown": "^2.1.0",
+    "mdast-util-frontmatter": "^2.0.1",
+    "mdast-util-gfm": "^3.1.0",
+    "micromark-extension-frontmatter": "^2.0.0",
+    "micromark-extension-gfm": "^3.0.0",
     "picocolors": "^1.1.1",
-    "react": "~19.2.8",
-    "yaml": "^2.9.0"
+    "react": "~19.3.1",
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^9.2.0",
+    "@antfu/eslint-config": "^9.5.1",
+    "@release-it/conventional-changelog": "12.0.2",
+    "@types/hast": "^3.0.5",
+    "@types/mdast": "^4.0.4",
     "@types/node": "^22.20.1",
-    "@types/react": "19.2.17",
-    "eslint": "^10.8.0",
-    "ink-testing-library": "4.0.0",
-    "tsup": "^8.5.1",
+    "@types/react": "^19.3.0",
+    "eslint": "^10.13.0",
+    "ink-testing-library": "^4.0.0",
+    "release-it": "21.1.1",
+    "smol-toml": "^1.9.1",
+    "tsup": "^9.0.0",
     "typescript": "^5.9.3",
     "vitepress": "^1.6.4",
-    "vitest": "^4.1.10",
-    "wrangler": "^4.114.0"
+    "vitest": "^5.0.5",
+    "wrangler": "^4.151.3"
   }
 }

package/skills/rsp/SKILL.md

@@ -1,104 +1,78 @@
 ---
 name: rsp
-description: Use this skill when initializing RSP, operating an existing .rsp project, auditing or repairing .rsp state, or deciding whether a change needs durable updates before archive.
+description: Coordinate authorized direct, Change or Group work; select capabilities and accept results while executors load their methods. Retain recovery and evidence and prepare delivery without treating completion as closure.
 license: MIT
 metadata:
   author: oevery
-  version: "2026.08.05.2"
+  version: "2026.10.22.4"
 ---
 
-# RSP Skill
+# RSP Core
 
-Use RSP to derive one current action from project authority and durable work artifacts. This Skill is the preferred operational guide; `.rsp/rsp-rules.md` is the runtime fallback when the Skill is unavailable.
+Carry the authorized request through execution, applicable evidence and needed knowledge updates. Core owns the goal, boundary, capability selection, cross-capability decisions and result acceptance. Capabilities own their methods and may be invoked directly. Skills are the only workflow. A missing or unusable required Skill stops dependent work; report the incomplete installation without reading retired Rules or installing implicitly.
 
-Nearest project instructions and relevant `CONTEXT.md` remain authoritative. Keep response language user/session-owned and durable project language repository-owned. Response prose follows an explicit current response language, user/host personal instructions, then conversation language; project `.rsp/config.yaml` never selects it. Every user-visible RSP progress update, phase or stage description, control result, worker receipt, stop reason, and handoff uses natural-language narration selected by that precedence. When exact identity matters, retain a canonical technical value unchanged in parentheses or code formatting; when its language differs from the response language, it must not stand alone as the human-facing label. This response-only rule does not change persisted artifact language or host-owned hidden reasoning summaries. A new authorized artifact follows an explicit artifact language, then the configured effective artifact language, artifact-scoped project instructions, and conversation language; an existing artifact keeps its established language unless translation is explicitly authorized. Configuration changes never rewrite existing artifacts. Commit-message prose follows an explicit current commit-language instruction, configured effective commit language, nearest repository commit authority, then clear recent non-merge history. Preserve canonical headings, paths, commands, identifiers, Conventional Commit types/scopes, trailers, and machine values. WorkRefs are stable identities independent from artifact, commit, response, host locale, and TUI language settings. Existing identities are never renamed by later language or naming guidance; when a new WorkRef must be inferred, Shape owns its naming policy. Write persistent artifacts in domain, system, user, or operator language; mention AI or agents only when they are actual product actors or constraints.
+## Select the work and responsibility
 
-## Scope
+Before mutation, read nearest instructions and relevant CONTEXT; establish intent, authority and the existing owner from evidence. Use known paths and discover missing context as needed. An explicit WorkRef wins; multiple focus markers alone do not block work. Preserve dirty work and its owner. Before switching owners, check overlapping product and knowledge paths; overlap transfers no authority.
 
-Use this Skill for RSP setup or repair, focused `.rsp/` work, and the durable-update decision before archive. Do not use it for unrelated coding or create a Change for a simple session task unless the user explicitly requests tracking.
+- **Direct:** a clear bounded request needing no durable continuity. Create no Change and run no tracking preflight merely to execute it.
+- **Change:** one delivery/acceptance boundary needing sustained work or cross-session recovery. Read its six sections and relevant Specs; Focus is only a sparse recovery pointer.
+- **Group:** independently acceptable/deliverable child Changes with dependencies or integration obligations. Read the Brief then select a child; the Brief is not executable work. File count, complexity and agent count alone do not create a Group.
 
-## Derive one next action
+Load the [work model](references/work-model.md) when tracked identities are missing from context; required tracking cannot be bypassed by relabelling work Direct. Use rsp status for needed owner, dependency or recovery facts, and JSON for exact dependency data. Required dependency checks and fresh archive readiness still apply.
 
-Read user intent, nearest authority, `rsp status --json`, the selected Change and its readiness, fresh verification evidence, and blockers. Stages are derived guidance, never persisted state.
+Use the CLI invocation selected by the project AGENTS entry: consumer projects pin an exact package in `.rsp/version`; an explicit `.rsp/source` selects the RSP development checkout's own built CLI. `rsp` in these Skills denotes that selection, never `@latest`, a version range, or an unverified global binary. Do not substitute a published package for source mode because version strings match. Only an authorized upgrade selects another exact package target and runs its `update` command for the complete environment; source-mode update retains the local source selection. Upgrade notices grant no migration authority. Resolve needed settings through the selected CLI's successful rsp config --json summary. Reuse it until relevant drift or recovery; raw YAML is diagnostic only. Projection failure blocks choices depending on unknown settings, while independent authorized work continues.
 
-Represent each current decision as one response-only transient `ControlOutcome`: phase, phase-specific disposition, decisive evidence, next owner, required input when any, and the rule for resuming or rederiving. Never persist it in a Change, Group Brief, Spec, Decision Record, archive, registry, or generated projection.
+Select capabilities from their descriptions and the task contract. Executors load applicable methods and inspect sources; Core consults method details when needed for its own work or a concrete coordination question. Select the responsibility needed now:
 
-Core's `RouteDisposition` is exactly `specialist`, `direct`, `managed`, `shape`, or `stop`:
+- rsp-shape: bounded read-only design or authorized planning; reopen planning only for material unresolved choices.
+- rsp-implement: diagnosis, authorized implementation or accepted-finding correction, including ordinary own checks.
+- rsp-doc: substantive document/Skill writing, needed knowledge writeback and final Change reconciliation.
+- rsp-verify: a requested declared-evidence result or a separately required verification obligation; ordinary implementation checks stay with Implement.
+- rsp-review: fixed-scope read-only judgment or explicitly bounded structural discovery. Supporting checks remain within that review.
+- rsp-commit: separately authorized exact local delivery; required for Git execution, with no Core substitute if unavailable.
 
-- `specialist`: one bounded Discipline result; the Discipline does not become a completion controller.
-- `direct`: one non-managed completion or continuation, one decisive verification, no WorkerEnvelope, and at most one Discipline executor.
-- `managed`: one selected shape-ready owner and bounded goal handed to Manage; only this route composes worker lanes and review convergence.
-- `shape`: unclear owned work returned to Shape.
-- `stop`: no further action until one `StopDisposition` resume contract succeeds.
+Continue authorized same-scope work without another continuation request. A phase, role or method change alone requires no tool call, worker, review or test run. Required review, independent execution and protected operations still apply. For ownerless release checks, establish the exact candidate, check contract, baseline and effects authority; invent no Change or Verify owner.
 
-Core may directly mutate only RSP control-plane state; product mutation belongs to Implement or the same bounded manual Discipline action. `StopDisposition` is exactly `ask-owner`, `return-to-shape`, `reroute`, `retry-with-evidence`, `environment-blocked`, `verification-blocked`, or `capability-unavailable`. No stop disposition permits worker dispatch, product mutation, lifecycle closeout, or Git action before its resume contract succeeds.
+## Execute and reconcile evidence
 
-Apply these routes in order:
+Implement owns ordinary self-checks. Main-agent inspection can assess results, but an implementation participant cannot certify required independent review. Select extra Verify/Review only when requested, required or supported by concrete risk, not per task or per worker automatically.
 
-Before later-turn mutation under a direct report, design, tiny, or small route, rederive from the newly authorized objective and prospective work. Cross-module implementation, multiple acceptance surfaces, repeated production-path correction, real-host validation, bounded review convergence, lifecycle delivery, or a clear ready successor requires the smallest sufficient WorkRef plus fresh owner preflight and Manage qualification before mutation. Unchanged tiny/small follow-ups remain direct. Elapsed time and message count alone never escalate work.
+Reuse traceable observations, checks and reviews while their target, acceptance boundary and relevant inputs still apply. Changed code, dependencies, configuration, tools or environment invalidate affected evidence; role changes and delivery-scope confirmation alone do not. Include excluded worktree inputs when assessing a staged slice, and recognize behavior changes in normative Specs or executable Skills even when stored as Markdown.
 
-1. Route an explicit report-only review with fixed scope to `rsp-review` when available, otherwise perform the same read-only review manually.
-2. Route an explicit release-documentation, finalization, publication, or reconciliation operation to `rsp-release-docs` when available; otherwise read [release operations](references/release-operations.md) for the manual fallback. Do this before ordinary Change routing.
-3. Route one explicit isolated material domain, module/seam, or evidence-seeking design question to installed `rsp-design`; never manually emulate it. Without a selected Change, use report-only Pre-Change Design for an already bounded question without inventing a WorkRef or artifact. Tracked Design returns to its selected WorkRef. Only when unavailable, its manual fallback stays with the same question and performs no implementation or durable-truth mutation.
-4. Return tiny settled work directly only when it satisfies the complete small-work exclusion: one owner, one local seam, one mutation pass, one decisive check, no managed lifecycle coordination, and no ready successor. Report `RouteDisposition: direct`. Perform no Manage handoff or WorkerEnvelope, and rederive before further mutation if prospective work expands beyond any condition.
-5. For every other requested completion or continuation, Core resolves whether one unambiguous shape-ready Change or shallow Group is the `WorkOwner`. Missing or non-ready ownership reports `RouteDisposition: shape`; Core invokes Shape only with independently granted planning-artifact authority, then re-reads status and freshly derives ownership and routing from the returned ready WorkOwner. Material product or authority questions stop for their `DecisionOwner`; invalid WorkOwner, topology, dirty-path, route, scope, or authority stops with `StopDisposition: reroute`.
-6. With one ready owner, read [managed routing](references/managed-routing.md). It solely owns initial qualification and the `selected | declined` result: under `auto`, consider non-small completion or continuation; under `explicit`, qualify only an explicitly managed request. On selection, hand `rsp-manage` the goal, WorkRef, authority envelope, decisive qualification evidence, closeout ceiling, and return boundaries. Manage validates current handoff evidence without repeating eligibility. Once selected, Manage solely owns same-goal revalidation, interruption and resume, review convergence, acceptance, lifecycle closeout, and commit eligibility and orchestration; `rsp-commit` retains exact Git execution. Return to Core only for changed owner identity, topology, requested route, behavior, acceptance, public interface, scope, mutation authority, or external-action authority. Automatic activation selects a controller but grants no planning, product mutation, lifecycle, Git, or external authority.
-7. If Manage is not selected, stop only when authority or selection is actually ambiguous, then return the one required input and its `DecisionOwner`. With no selected Change, name one ready WorkRef and direct focus action. Otherwise preserve ordinary routing under the clear ready WorkOwner and continue to Implementation evidence or the durable decision as applicable; `manage.activation: explicit` without an explicitly managed request is not itself a stop signal.
-8. For incomplete implementation or stale, missing, or failed verification, use [Implementation evidence](#implementation-evidence). This is implementation verification.
-9. When Tasks and required verification pass without blockers, perform the durable writeback decision. A fixed-scope change review remains a separate report-only gate: require it only when explicitly requested, required by nearer authority or risk, or needed for managed `review-clean`; do not impose it automatically on every tiny direct action. Do not infer a release operation from Change completion.
+Check paths, diff, outcomes, omissions and evidence applicability. Reuse executor checks when applicable. Independent semantic review may use implementer test evidence; required independent execution must run. Keep commands, results, tested boundaries and decisive sources with their existing owner, including failures, unavailable checks and superseded results. Add no evidence ledger.
 
-State the `ControlOutcome`, derived stage, one next action, required input, returned owner, decisive evidence, and resume or rederivation rule. `ask-owner` asks one highest-impact owner question and resumes through fresh Core derivation after the answer; `return-to-shape` resumes only after Shape confirms a ready owner; `reroute` requires a valid owner or authority boundary. Other stops name the evidence, environment, verification, or capability condition that must change.
+For required correction/re-review, load [review convergence](references/coordination-review.md). Batch compatible findings into one correction, run covering checks, then review finding resolution and new risks in the correction. Stop for changed scope/authority, unsafe replay, missing required capability, non-convergence or no new discriminating evidence. Required failures remain incomplete.
 
-For managed evaluation, state `selected` or `declined` with the decisive qualification signal or complete direct-work exclusion; when dispatch applies, state why it is parallel or sequential. Name at most one optional Discipline Skill, only when it is the next action and appears in the host's loaded Skill inventory. A missing optional Discipline Skill does not invalidate RSP: use its bounded manual fallback against the same owner. This fallback never substitutes for a required managed worker or required independent Verify: keep acceptance incomplete and stop with `capability-unavailable` or the more specific evidenced `StopDisposition`. For an authorized exact local commit boundary, route exact staging, structured message construction, local commit execution, and post-commit observation to `rsp-commit`; if unavailable, use the durable-decision manual fallback. Do not preload, enumerate, or recursively invoke optional capabilities.
+Dependent writes require successful prerequisites; observe each required result rather than relying on a batch's final exit status. Recover tool failures within unchanged authority, inspecting uncertain effects before safe replay. Named checks and Commit's one-attempt rule remain binding.
 
-### Implementation evidence
+## Coordinate only when needed and allowed
 
-- **Diagnosis first:** diagnosis takes precedence over TDD for an evidenced but unexplained, conflicting, intermittent, or multi-layer failure. Use `rsp-diagnose` when available; its manual fallback reproduces, locates, and tests the smallest discriminating hypothesis. Do not encode an unexplained symptom as a guessed regression test.
-- **TDD when justified:** use `rsp-tdd` only when test-first is explicitly required by the user, Change, or project instructions, or when a concrete changed risk makes a pre-mutation RED materially safer. Public contracts, persisted data, security or money, concurrency, complex transitions, and escaped defects qualify; mere testability or being a fix does not. Its manual fallback observes the focused RED, makes the minimum GREEN change, and refactors only while green.
-- **Ordinary implementation by default:** use `rsp-implement`, or the equivalent bounded edit and verification, once the behavior, cause, and owner are sufficiently evidenced.
+Work shape does not choose agent topology. Automatic delegation defaults off. An explicit worker request or binding independent-worker requirement permits that bounded dispatch; otherwise resolve workflow.delegation before automatic delegation. When auto is enabled, the user or main agent chooses zero, one or multiple execution workers. RSP has no worker-count tiers or maximum; host constraints still apply.
 
-All branches return evidence, Tasks, Verify updates, and blockers to the same Change. Fresh verification is required, but a new test is only one option; use the cheapest decisive check that covers the changed risk.
+Load [worker coordination](references/coordination.md) for actual dispatch, dependencies/shared-resource arbitration or required independent workers. Keep tightly coupled work local; never simulate missing worker identity or independence. Workers do not delegate further by default. Main retains integration and result acceptance; child passes do not establish integration coverage.
 
-## Operate the selected Change
+Load [interruption recovery](references/coordination-recovery.md) for pause/resume or unsettled host effects, and [focus continuation](references/focus-continuation.md) for a recovery snapshot. Cross-session continuation refreshes current authority, owner, applicable status, Git index, dirty paths, evidence applicability and replay safety. Cancelling a wait does not stop workers or release resources.
 
-Before focusing or mutating a different WorkRef, compare dirty product or durable-truth paths with the prior owner's declared or observed paths. Overlap never transfers ownership: continue the same open WorkRef, explicitly reopen archived acceptance when authorized and applicable, use an explicitly authorized integration owner, or stop for boundary resolution. Disjoint authorized work may proceed without staging or forcing a commit; insufficient evidence stops the transition.
+## Maintain records and prepare delivery
 
-Read the focused Change, its sibling Group Brief when grouped, and only the relevant Specs and Decision Records before implementation. Use generated local `.rsp/specs/**/00-index.md` files only as direct-child navigation; never treat them as durable owners. Run `npx -y @oevery/rsp check --focused` before treating it as ready. Only `focus.d/` markers select current work; open filenames do not. Preserve one explicit `kind` and the canonical Proposal, Spec, Design, Tasks, Verify, and Blockers sections.
+During execution update Tasks/Verify directly for actual outcomes when scope, contract, design and knowledge remain accurate. Consolidate repeated conclusions for the same scope and candidate; retain distinct inputs, outcomes, material failures and evidence references. When changing Blockers, use the [shared work-model syntax](references/work-model.md). Passing checks or recovery alone adds no whole-document rewrite. Routine narration stays in the conversation; retained execution evidence stays with its existing owner. Focus is replaceable recovery guidance, never acceptance or authority.
 
-Keep the Change a convergent snapshot of the current plan and final decisive evidence. Replace superseded content; keep routine attempts, RED/GREEN chronology, temporary probes, and command transcripts in the response. Update Tasks, Verify, and any invalidated Proposal, Spec, or Design in the same session.
+Ordinary completion and checkpoint commits leave Change open; a generic commit request does not establish final delivery. At established final delivery or an explicit close request, load [delivery closeout](references/closeout.md). workflow.closeout is ask (default), auto or manual; no setting grants Git, push, publication, deployment, approval or human acceptance authority.
 
-Persist only `open` and `archived`; derive readiness, blockers, stage, and next actions. Do not infer implementation, review, Git, publication, or approval authority from focus, readiness, routing, or capability availability.
+For necessary stable-knowledge updates, load [durable writeback](references/durable-review.md) to establish facts, update their owners and reconcile affected records. Final delivery or closure additionally requires whole-Change convergence and consistency checks. Reuse applicable evidence and fill missing or invalidated coverage and separately required review. Already-accurate records need no edit; current readiness is a lifecycle observation, not semantic acceptance.
 
-When fresh evidence shows that archived acceptance was incomplete, keep the correction under the same owner and read [reopen recovery](references/reopen-recovery.md) before any lifecycle mutation. Reopen requires explicit lifecycle authority and grants no Git or external authority; genuinely new or independently delivered scope uses a new corrective owner.
+Operate command-owned state through RSP commands. Persist only open and archived; derive readiness and routing. A complete Task list never closes work. Reopen is exceptional recovery requiring explicit authority: load [reopen recovery](references/reopen-recovery.md) only when actually needed.
 
-Load detailed procedures only when their path is active:
+Other conditional procedures:
 
-- Read [setup and repair](references/setup-repair.md) before initializing, auditing, migrating, or repairing RSP state.
-- Read [groups and dependencies](references/groups-dependencies.md) before creating, focusing, planning, or closing grouped/dependent work.
-- Read [conflict handling](references/conflict-handling.md) only when an active merge, rebase, or cherry-pick conflict intersects authorized work.
-- Read [durable writeback decision](references/durable-review.md) only after required Tasks and implementation verification pass, or when auditing archive readiness.
+- [Setup and repair](references/setup-repair.md) for initialization, audit or repair.
+- [Groups and dependencies](references/groups-dependencies.md) for grouped work.
+- [Context migration](references/context-migration.md) when a root/relevant legacy CONTEXT-MAP.md is found or migration requested; preserve context, discovery alone grants no migration.
+- [Conflict handling](references/conflict-handling.md) for an intersecting Git operation.
 
-## Ownership and safety
+## Return the result
 
-Route planned design to the selected Change; stable implemented facts to the smallest relevant Spec or authorized scoped instruction; lasting rationale to one exact Decision Record; stable navigation to project-owned `CONTEXT.md`; stable operating rules to project-owned `AGENTS.md`; and temporary continuation to the response. Never write planned state as current truth or duplicate facts into rationale.
+Follow explicit response language, personal instructions, then conversation language. Existing artifacts retain their language; new artifacts follow explicit instruction, effective project settings, scoped instructions, then conversation language. Keep identifiers and machine values exact; load [language details](references/response-language.md) only for contested choices.
 
-Use RSP commands for managed setup, focus, repair, indexes, archive, and reopen. Do not directly create command-owned files, edit generated indexes or `.rsp/rsp-rules.md` as durable truth, or modify the managed RSP block. Preserve unrelated work. Core recommends explicit archive only after the durable decision; it does not execute archive or grant staging, commit, push, publication, deletion, deployment, approval, or human-acceptance authority. A configured `manage.closeout` preset remains dormant unless Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory even under `lifecycle` or `local`. Core also does not execute reopen without explicit lifecycle authority. During a qualified managed run, `rsp-manage` solely owns interruption and resume, convergence, lifecycle closeout, and commit eligibility and orchestration; `rsp-commit` owns exact Git execution. Those procedures create no persisted controller state or additional authority.
-
-When accepted work remains, return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values. The continuation points to existing owners, is not a second state store, and must not be persisted without explicit path authority. On resume, reopen its pointers, inspect drift, and refresh decisive evidence.
-
-## Durable decision output
-
-After loading [durable writeback decision](references/durable-review.md), choose current facts and rationale independently. Localize headings and labels, but preserve the canonical values below:
-
-```md
-## <localized Durable Decision heading>
-- <localized Current facts label>: <No current-fact update needed | Update existing spec or scoped instruction | Create a new durable spec>
-- <localized Current-fact target label>: <exact file path or N/A>
-- <localized Facts to write label>: <durable facts or none>
-- <localized Decision Record label>: <No Decision Record needed | Create or update a Decision Record>
-- <localized Decision Record target label>: <exact file path or N/A>
-- <localized Rationale to write label>: <lasting rationale or none>
-- <localized Archive ready label>: <yes | no>
-```
-
-Response-only Continuation and Durable Decision labels are not canonical artifact headings. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone. A required unwritten update or real blocker makes archive readiness `no`; CLI `archiveReady: judgment` is advisory, not approval.
+Report the outcome, decisive evidence, material limits and needed next action. Distinguish observed effects, checks, review and acceptance; unverified claims stay unverified. Missing Required evidence blocks only dependent completion. No mandatory phase receipts or repeated logs. Load [control outcome](references/control-outcome.md) only for a consumer needing its technical rendering. For unfinished work retain only the owner, authority, evidence, blocker and safe continuation needed by the next actor.

package/skills/rsp/references/closeout.md

@@ -0,0 +1,38 @@
+# Final delivery and lifecycle closeout
+
+Load for an established final-delivery boundary, an explicit close request, or a delivery question requiring checkpoint classification. Ordinary completion never activates closeout. A generic commit request defaults to a checkpoint unless final delivery is already established; checkpoints keep Change open and require only the authorized slice and applicable evidence.
+
+## Decide closure independently of Git
+
+Use the validated workflow.closeout setting from rsp config --json:
+
+- ask (default): prepare a concrete final boundary, applicable evidence and required knowledge/Change updates, then ask whether to close before terminal staging. Reuse explicit closure authority already granted; do not ask twice.
+- auto: close eligible work at established final delivery without another closure request, subject to nearer denial.
+- manual: close only on an explicit close request. Authorized final commits may leave work open and must report that fact.
+
+Explicit refusal keeps work open. A decision to leave it open does not block an otherwise authorized commit. Neither policy, readiness nor archive grants Git authority. An explicit standalone close request can close eligible work without a commit. Do not interpret finishing implementation, a pass, a successor task or elapsed time as final delivery.
+
+## Reconcile the final boundary
+
+1. Confirm exact delivery scope and inspect existing evidence for that boundary.
+2. Apply [durable writeback](durable-review.md): necessary stable knowledge first, final Change reconciliation second. These can be one operation with no edits when already current.
+3. Fill missing or invalidated checks and separately required review. Reuse applicable results; ordinary record cleanup does not invalidate code tests. Changed normative contracts and executable Skills need affected checks/judgment. Fresh independent review is not a universal closeout prerequisite.
+4. For each Change to close, obtain current rsp ready <work-ref> --json with completionGate: pass and archiveReady: yes. Also require accurate final records, completed or unnecessary knowledge updates, applicable Required evidence and every separately required review. Readiness alone does not establish semantic acceptance.
+
+Missing Required evidence, active blockers or contradictory contracts prevent closure. Optional omissions remain visible. Fresh authority, owner and exact Git/lifecycle observations remain necessary even when tests are reused.
+
+## Close only when authorized
+
+Run rsp archive <work-ref>. Inspect the resulting archive and entire lifecycle diff, including Focus removal and cleanup warnings. Use the returned filename in the selected WorkRef's archive directory: .rsp/archives/ for an ungrouped Change, .rsp/archives/<group>/ for a child. Do not guess dates, suffixes or directories. Expand read-only discovery only for incomplete or contradictory output/effects; do not replay the mutation.
+
+For a Group, archive eligible authorized children independently, reconcile the Brief and integrated evidence, then run rsp group close <group> after every child and Group gate passes. Request-only integration conditions must first be recorded in the Brief; child passes alone do not prove integration.
+
+Never delete or copy lifecycle files to bypass commands. If archive succeeds but commit fails, report the archived, uncommitted state. Do not automatically reopen, rewrite history or repeat uncertain mutations.
+
+## Route exact delivery separately
+
+With explicit local commit authority, route to rsp-commit with the delivery kind (direct, change, integration, group or release), purpose (checkpoint or terminal), real owner/WorkRefs, exact paths, applicable verification and lifecycle evidence only when applicable. No transport schema or duplicate receipt is required.
+
+Integration requires at least two real WorkRefs and one shared delivery boundary but creates no Group. Ambiguous, mixed, stale or denied boundaries stop before staging. Missing Commit capability has no Core fallback. Commit audits the exact index and owns Git execution.
+
+Push requires explicit authority and an unambiguous remote, branch and milestone. Never infer it from commit or closure; no force push or automatic publication. Remote failure preserves local commits and stops at that boundary.

package/skills/rsp/references/context-migration.md

@@ -0,0 +1,22 @@
+# Context migration
+
+Load when a legacy CONTEXT-MAP.md is found, CLI reports it, or the user requests context migration. This is a conditional Core method, not a separate Skill or a mandatory project phase. CONTEXT.md remains the target model for vocabulary, domain relationships, and navigation.
+
+## Inspect without migrating
+
+Read the relevant legacy map, existing root/local CONTEXT files, scoped instructions, and incoming references. File presence is a migration signal, not proof that its content is obsolete or that an existing CONTEXT already contains it. Resolve overlapping or contradictory definitions with their owner; do not choose a winner from the filename.
+
+Without migration authority, preserve files and use the legacy content relevant to the current task alongside current context. Report the pending migration without repeatedly demanding it or blocking unrelated work. Stop only work that depends on an unresolved meaning or authority conflict. Do not follow unsafe or out-of-scope paths merely because a legacy map points to them.
+
+## Migrate within explicit scope
+
+Establish authorized source files, target owners, reference updates, and whether retiring the old file is included. Reuse the selected WorkRef when tracked; bounded direct migration needs no new work record.
+
+1. Map useful terms, relationships, and navigation to their root/local CONTEXT owners. Keep contracts and operating rules with their existing Spec/AGENTS owners, using links instead of parallel definitions. Resolve material conflicts before changing their meaning.
+2. Merge into existing context without overwriting unrelated content or renaming concepts for consistency alone. For substantial writing use Doc when available; otherwise preserve meaning and verify the reader's navigation directly. Doc supplies the writing method, not migration or deletion authority.
+3. Update active references and entry instructions. Check both lost meaning and broken paths; historical snapshots need not be rewritten.
+4. Retire the old map only after checking preserved meaning, active references, and explicit retirement authority. If any gate is missing, keep it and report the remaining work.
+
+`rsp update` and `rsp doctor` only detect the root legacy path and provide guidance; they do not compare semantics, merge context, or retire project files. A successful command is not migration acceptance.
+
+Return the source-to-owner result, changed files, checks, and unresolved conflicts or permissions. Migration completion derives from inspected documents and references, not a new marker or stored lifecycle state.

package/skills/rsp/references/control-outcome.md

@@ -0,0 +1,5 @@
+# Optional control outcome
+
+Load only when a real technical consumer needs Core's phase-result rendering. This is response-only, never persisted controller state or an inter-Skill protocol. Normal responses answer the current request with outcome, necessary evidence and material limits in the requested language, without a mandatory schema or duplicated evidence. Include a next action only when work or a user decision remains.
+
+When a machine consumer needs it, preserve the established values mode: solo | delegated | coordinated and status: running | waiting | completed, with route, dispatch, acceptance and closeout nested. Solo means no worker participated; delegated one worker; coordinated multiple workers or a required separate verifier. Identity and independence come from host observations, never worker prose. A Change WorkOwner uses its WorkRef; a Group uses its Group reference. State is presentation, not lifecycle. Do not emit duplicate JSON by default or include raw worker messages, host events, retry chronology or unaccepted evidence.

package/skills/rsp/references/coordination-recovery.md

@@ -0,0 +1,25 @@
+# Coordinated interruption and recovery
+
+Load this reference only for a progress or status inquiry, explicit pause, an environment or verification stop, or resume from continuation pointers.
+
+Reread the complete owner and authority only on a real invalidation, recovery, cross-session continuation, or closeout boundary.
+
+Answer status inquiries with current evidence and continuing intent, then continue while authority, verification and blockers permit. Status inquiries do not pause work. Host liveness and elapsed time neither change a Discipline result nor justify cancelling healthy work.
+
+For an explicit pause, interrupt through the host and confirm active workers or owned background processes have stopped before acknowledging it. Until then, start no conflicting mutation or verification. A cancelled wait, terminal message or partial output proves no stop.
+
+Preserve the focused owner (`WorkOwner`) and focused child WorkRef when applicable during ordinary pause or blockers. Only an explicit release or unfocus request, archive, or another authorized lifecycle action changes selection. Update the Change only with accepted outcomes, decisive verification, and durable blockers.
+
+When work needs a durable recovery snapshot, a Focus Capsule needs inspection or replacement, or a portable continuation handoff is required, read [focus and continuation recovery](focus-continuation.md). Same-session worker continuation alone does not require that reference. The capsule is a recovery pointer, never worker coordination, authority or acceptance.
+
+## Resume from effects, not tool status
+
+On same-session resume, reopen pointers to authority and owned artifacts, inspect drift and replay safety, and reassess decisive evidence applicability; rerun only missing or invalidated checks, not merely because work resumed.
+
+Inspect actual effects before replay. An idempotent action may repeat after boundary inspection. An inspection-dependent action must first check prior effects; a non-repeatable action stops for recovery or owner input. Exit codes or partial results do not prove that nothing happened. Unknown mutation blocks replay; safe read-only observation may continue.
+
+A permitted method change preserves authority, owner, scope, baseline and required evidence. Named checks, provenance and required independence remain binding. Once effects and host facts are established, [worker coordination](coordination.md) owns reuse or fresh dispatch; preserve the existing correction-loop counts and accepted outcomes across recovery.
+
+For cross-session or cross-device recovery, distrust transient worker and liveness claims. Before mutation or delegation, reread current authority, selected owner, applicable tracking status, Git index, checkout diff, dirty paths, conflicting resources, blockers and execution location. Revalidate the selected handoff, decisive evidence and required verification against those facts; re-establish coordination qualification and host evidence for worker attribution or independence. Host completion without an attributable required worker result keeps acceptance incomplete. Current authority always wins.
+
+For incomplete archived acceptance, read [reopen recovery](reopen-recovery.md) before any lifecycle mutation. It requires separate explicit lifecycle authority and owns exact archive selection and the closed-Group-before-child sequence. Restore neither children nor dependents implicitly.

package/skills/rsp/references/coordination-review.md

@@ -0,0 +1,15 @@
+# Core-owned correction and review convergence
+
+Load for a required correction/re-review loop or an evidenced failure in already delegated work. Core coordinates the existing authorized request; loading this method grants no worker dispatch, automatic closeout or new worker authority. Direct capability use needs no full Core entry: when the request includes correction and review, its caller applies this same loop rather than starting a capability-local copy.
+
+## One owner, bounded passes
+
+Core retains the original scope, authority, comparison, required evidence and transient pass counts. Implement supplies one bounded correction with finding dispositions, changed paths, checks and limits. Review supplies a fresh fixed-scope judgment of the actual corrected target and its impact. Implement never certifies review-clean. Required independent Verify or Review still needs a distinct worker proved by host observations.
+
+1. Correlate the returned result with the requested boundary and actual effects. An `accepted` finding can proceed only within existing correction authority; `rejected` needs evidence, and `needs-clarification` returns the material decision to its owner.
+2. Batch compatible accepted findings into one Implement correction with affected checks; preserve separate owners and incompatible writer boundaries. Continue ordinary same-scope repair without asking the user to repeat permission. A capability transition creates no extra worker or test phase by itself.
+3. Consume that result, preserve findings and limits, then obtain the required read-only Review of finding resolution and risks introduced by the fix diff. Unrelated improvements do not extend this loop. Reuse applicable test evidence, but never reuse an earlier review verdict for changed behavior. Continue only for remaining accepted findings with improving evidence; clean review is evidence for this boundary, not overall completion or delivery permission.
+
+Only Core counts repeated cross-capability passes. Preserve the existing ceilings: at most three worker correction passes for an evidenced same-scope failure, and separately at most three finding-resolution passes per Change or bounded direct request. Stop when the same finding survives two completed corrections. Returning through a capability, resuming a worker or changing tools resets neither count. Counts and chronology stay transient; do not add a controller record.
+
+Stop earlier for repeated evidence, non-convergence, changed scope/authority, unsafe or unknown effects, an unavailable required capability, unverifiable correction or missing decisive evidence. Seek owner input for a material product/interface choice or a real-host, provider or network run outside existing authority. Report the unresolved finding, gap or decision. Limits leave work incomplete; they waive no acceptance gate. Continue eligible in-scope corrections without another generic continuation request.

package/skills/rsp/references/coordination.md

@@ -0,0 +1,59 @@
+# Worker delegation and resource evidence
+
+Load for actual workers, dependencies/shared-resource arbitration or required independent acceptance. Work shape and worker count are independent. Explicit worker requests or binding worker requirements permit bounded dispatch; otherwise use the validated workflow.delegation setting (off by default, auto when enabled). Recovery and ordinary continuation do not enable delegation.
+
+Core decides none, preferred or required from the actual obligation. Keep tightly coupled work local; prefer independently executable slices only when delegation is allowed. Required dispatch needs attributable host execution; required independence needs a distinct worker. The main agent or user chooses worker count without RSP tiers or limits; host resource limits still apply. No setting grants product, Git or lifecycle authority. Missing optional delegation falls back locally; missing required workers leave acceptance incomplete.
+
+## Delegate one bounded task
+
+For grouped or dependent work, use [groups and dependencies](groups-dependencies.md) and the current `rsp status --json` plan. Only children in the first non-empty `plan.waves` wave are eligible; a prerequisite in `plan.blocked` prevents dispatch. Recheck dependencies and integrated evidence before the next wave. Child passes alone do not satisfy Group integration.
+
+Before parallel work, check write boundaries and shared resources: generated outputs, manifests/lockfiles, Git index, test services, databases, browsers and hardware. Different filenames prove neither interface compatibility nor isolation. Require host-proven isolation or run serially. Unknown required isolation blocks concurrency; otherwise safe serial work may continue.
+
+Send one independently executable vertical slice. Tell the recipient it is already dispatched and must not rerun parent routing or delegate further. Include only what it needs to act safely:
+
+```text
+Work: <exact WorkRef>
+Objective: <bounded outcome or review target and comparison>
+Authority: <exact owner sections or paths>
+Read: <needed sources and supporting references within the allowed boundary>
+Write: <allowed write boundary>
+Verify: <required verification boundary>
+Known facts: <only decisive current facts>
+Prohibited actions: <explicit denials>
+Stop conditions: <when to return without continuing>
+Replay caution: <only when repeating effects may be unsafe>
+```
+
+For direct work, identify the bounded request instead of inventing a WorkRef. Supply source locations and decisive facts, not copied method bodies. Distinguish the review target from supporting references. Workers load their methods and inspect actual sources and applicable instructions; Core retains result validation.
+
+Omit empty optional fields. Do not attach host lifecycle schemas, correlation identifiers, JSON transport contracts, evaluator instructions, token targets, or acceptance fields. Workers receive no implied focus, lifecycle, Git, publication, deployment, approval, or nested-delegation authority. Nested delegation is prohibited unless the task explicitly grants a bounded descendant role and the parent remains responsible for its work and result.
+
+Reuse a host-resumable worker only while goal, role, authority, writer boundary and evidence remain compatible; otherwise send a complete fresh task. Pass changed facts explicitly, never hidden inheritance as authority. After interruption use [recovery](coordination-recovery.md) to inspect effects and re-establish host facts before dispatch.
+
+Each delegated Discipline owns its own result:
+
+- **Diagnose:** `rsp-implement` read-only diagnosis mode; `confirmed | unresolved` with cause evidence and scope impact.
+- **Inspect:** Core-owned read-only evidence packet.
+- **Fix:** `rsp-implement`; `changed | no-change` with changed paths, verification, omissions, and any scope issue.
+- **Verify:** `rsp-verify`; `pass | fail | unavailable` with named checks, evidence delta, omissions, and any scope issue.
+
+One worker may return both the Fix and ordinary Verify results for the same Change when independent verification is not required. The combined result is implementation evidence, not self-certified acceptance.
+
+Fixed-scope review remains owned by `rsp-review`, including a required independent reviewer. Core adds no universal worker receipt and never asks a worker to self-report identity, independence, settlement, or acceptance.
+
+## Validate results and host facts
+
+Treat three evidence sources separately:
+
+- the worker-authored Discipline result states what the worker did and observed;
+- host observations, when available, establish dispatch, attribution, activity, cancellation, completion, and whether different workers participated;
+- Core validates authority, actual changed paths, local diff, declared verification, omissions, and current acceptance.
+
+Derive host facts from observations, not prose, handles, elapsed time, topology or passing tests. Missing observations remain unavailable. Host facts create no RSP domain objects. Workers cannot certify their own identity, independence, resource release, evidence validity or acceptance.
+
+For required delegation, Core must have an attributable worker-authored result covering the assigned boundary. For required independent Verify or Review, host observations must establish distinct workers from the accepted implementation. If not, acceptance remains `incomplete`. Core cannot author or substitute the missing result.
+
+When one worker owns Fix and ordinary checks, Core validates the result before deriving `evidence-complete`. Reuse applicable observations and checks; required Review still independently judges the actual target. Integration or changed inputs require affected checks. Archive and commit keep separate gates. Corrections return through [Core review convergence](coordination-review.md), not a worker-local loop.
+
+Host completion, transport shape or passing tests alone cannot establish acceptance; use the actual result and host facts above.