@oevery/rsp 3.3.0 → 4.0.0

package/skills/rsp/references/control-outcome.md

@@ -1,31 +1,5 @@
-# Control outcome
+# Optional control outcome
 
-Load this reference whenever Core returns or composes the current phase result. `ControlOutcome` is the single outer response receipt for one current WorkRef. Its default session rendering is localized labeled natural language, not a required YAML or JSON object, durable workflow state, or a second status store. Use JSON only for an explicitly identified machine consumer, encode the same semantics, and do not emit a duplicate JSON copy by default.
+Load only when a real technical consumer needs Core's phase-result rendering. This is response-only, never persisted controller state or an inter-Skill protocol. Normal responses answer the current request with outcome, necessary evidence and material limits in the requested language, without a mandatory schema or duplicated evidence. Include a next action only when work or a user decision remains.
 
-## Compose the outer receipt
-
-Use these contextual fields, localize their labels, and omit empty optional fields:
-
-```text
-Work: <current WorkRef>
-Mode: <solo | delegated | coordinated>
-Status: <running | waiting | completed>
-Phase: <current control or execution phase>
-Result: <phase-specific result>
-Stop: <phase-specific StopDisposition and reason>
-Evidence: <decisive evidence>
-Changed artifacts: <changed artifacts>
-Next owner: <NextOwner>
-Next action: <next action>
-Recovery: <bounded recovery guidance>
-```
-
-Exactly one of Result or Stop applies. Evidence, Changed artifacts, and Recovery appear only when present. Next owner and Next action form one transition and must not contradict the phase result or stop. The contextual labels shorten and localize the response form; canonical domain concepts such as `ControlOutcome`, `WorkRef`, `NextOwner`, and `StopDisposition` retain their precise names.
-
-## Preserve one status flow
-
-Outer status transitions are only `running -> waiting | completed` and `waiting -> running | completed`. Failure, cancellation, rerouting, verification blocking, and capability loss use the phase-specific `stop`; they never create peer outer status values. Route, dispatch, topology, lane result, acceptance, and closeout remain nested phase details or gates.
-
-The canonical fields retain `mode: solo | delegated | coordinated` and `status: running | waiting | completed`. Use `solo` when no worker participates, including selected Manage execution through a bounded local Discipline; use `delegated` when one worker participates; use `coordinated` when multiple workers participate or acceptance requires a separate verifier. Raw worker messages, host events, retry chronology, and unaccepted evidence never appear as outer receipt fields.
-
-Core composes this receipt from the selected phase result. Shape, Disciplines, and Manage return only their owned bounded result and evidence; they may name this invoking contract but never redefine its complete form. A `ControlOutcome` is response-only, not durable workflow state.
+When a machine consumer needs it, preserve the established values mode: solo | delegated | coordinated and status: running | waiting | completed, with route, dispatch, acceptance and closeout nested. Solo means no worker participated; delegated one worker; coordinated multiple workers or a required separate verifier. Identity and independence come from host observations, never worker prose. A Change WorkOwner uses its WorkRef; a Group uses its Group reference. State is presentation, not lifecycle. Do not emit duplicate JSON by default or include raw worker messages, host events, retry chronology or unaccepted evidence.

package/skills/rsp/references/coordination-recovery.md

@@ -0,0 +1,25 @@
+# Coordinated interruption and recovery
+
+Load this reference only for a progress or status inquiry, explicit pause, an environment or verification stop, or resume from continuation pointers.
+
+Reread the complete owner and authority only on a real invalidation, recovery, cross-session continuation, or closeout boundary.
+
+Answer status inquiries with current evidence and continuing intent, then continue while authority, verification and blockers permit. Status inquiries do not pause work. Host liveness and elapsed time neither change a Discipline result nor justify cancelling healthy work.
+
+For an explicit pause, interrupt through the host and confirm active workers or owned background processes have stopped before acknowledging it. Until then, start no conflicting mutation or verification. A cancelled wait, terminal message or partial output proves no stop.
+
+Preserve the focused owner (`WorkOwner`) and focused child WorkRef when applicable during ordinary pause or blockers. Only an explicit release or unfocus request, archive, or another authorized lifecycle action changes selection. Update the Change only with accepted outcomes, decisive verification, and durable blockers.
+
+When work needs a durable recovery snapshot, a Focus Capsule needs inspection or replacement, or a portable continuation handoff is required, read [focus and continuation recovery](focus-continuation.md). Same-session worker continuation alone does not require that reference. The capsule is a recovery pointer, never worker coordination, authority or acceptance.
+
+## Resume from effects, not tool status
+
+On same-session resume, reopen pointers to authority and owned artifacts, inspect drift and replay safety, and reassess decisive evidence applicability; rerun only missing or invalidated checks, not merely because work resumed.
+
+Inspect actual effects before replay. An idempotent action may repeat after boundary inspection. An inspection-dependent action must first check prior effects; a non-repeatable action stops for recovery or owner input. Exit codes or partial results do not prove that nothing happened. Unknown mutation blocks replay; safe read-only observation may continue.
+
+A permitted method change preserves authority, owner, scope, baseline and required evidence. Named checks, provenance and required independence remain binding. Once effects and host facts are established, [worker coordination](coordination.md) owns reuse or fresh dispatch; preserve the existing correction-loop counts and accepted outcomes across recovery.
+
+For cross-session or cross-device recovery, distrust transient worker and liveness claims. Before mutation or delegation, reread current authority, selected owner, applicable tracking status, Git index, checkout diff, dirty paths, conflicting resources, blockers and execution location. Revalidate the selected handoff, decisive evidence and required verification against those facts; re-establish coordination qualification and host evidence for worker attribution or independence. Host completion without an attributable required worker result keeps acceptance incomplete. Current authority always wins.
+
+For incomplete archived acceptance, read [reopen recovery](reopen-recovery.md) before any lifecycle mutation. It requires separate explicit lifecycle authority and owns exact archive selection and the closed-Group-before-child sequence. Restore neither children nor dependents implicitly.

package/skills/rsp/references/coordination-review.md

@@ -0,0 +1,15 @@
+# Core-owned correction and review convergence
+
+Load for a required correction/re-review loop or an evidenced failure in already delegated work. Core coordinates the existing authorized request; loading this method grants no worker dispatch, automatic closeout or new worker authority. Direct capability use needs no full Core entry: when the request includes correction and review, its caller applies this same loop rather than starting a capability-local copy.
+
+## One owner, bounded passes
+
+Core retains the original scope, authority, comparison, required evidence and transient pass counts. Implement supplies one bounded correction with finding dispositions, changed paths, checks and limits. Review supplies a fresh fixed-scope judgment of the actual corrected target and its impact. Implement never certifies review-clean. Required independent Verify or Review still needs a distinct worker proved by host observations.
+
+1. Correlate the returned result with the requested boundary and actual effects. An `accepted` finding can proceed only within existing correction authority; `rejected` needs evidence, and `needs-clarification` returns the material decision to its owner.
+2. Batch compatible accepted findings into one Implement correction with affected checks; preserve separate owners and incompatible writer boundaries. Continue ordinary same-scope repair without asking the user to repeat permission. A capability transition creates no extra worker or test phase by itself.
+3. Consume that result, preserve findings and limits, then obtain the required read-only Review of finding resolution and risks introduced by the fix diff. Unrelated improvements do not extend this loop. Reuse applicable test evidence, but never reuse an earlier review verdict for changed behavior. Continue only for remaining accepted findings with improving evidence; clean review is evidence for this boundary, not overall completion or delivery permission.
+
+Only Core counts repeated cross-capability passes. Preserve the existing ceilings: at most three worker correction passes for an evidenced same-scope failure, and separately at most three finding-resolution passes per Change or bounded direct request. Stop when the same finding survives two completed corrections. Returning through a capability, resuming a worker or changing tools resets neither count. Counts and chronology stay transient; do not add a controller record.
+
+Stop earlier for repeated evidence, non-convergence, changed scope/authority, unsafe or unknown effects, an unavailable required capability, unverifiable correction or missing decisive evidence. Seek owner input for a material product/interface choice or a real-host, provider or network run outside existing authority. Report the unresolved finding, gap or decision. Limits leave work incomplete; they waive no acceptance gate. Continue eligible in-scope corrections without another generic continuation request.

package/skills/rsp/references/coordination.md

@@ -0,0 +1,59 @@
+# Worker delegation and resource evidence
+
+Load for actual workers, dependencies/shared-resource arbitration or required independent acceptance. Work shape and worker count are independent. Explicit worker requests or binding worker requirements permit bounded dispatch; otherwise use the validated workflow.delegation setting (off by default, auto when enabled). Recovery and ordinary continuation do not enable delegation.
+
+Core decides none, preferred or required from the actual obligation. Keep tightly coupled work local; prefer independently executable slices only when delegation is allowed. Required dispatch needs attributable host execution; required independence needs a distinct worker. The main agent or user chooses worker count without RSP tiers or limits; host resource limits still apply. No setting grants product, Git or lifecycle authority. Missing optional delegation falls back locally; missing required workers leave acceptance incomplete.
+
+## Delegate one bounded task
+
+For grouped or dependent work, use [groups and dependencies](groups-dependencies.md) and the current `rsp status --json` plan. Only children in the first non-empty `plan.waves` wave are eligible; a prerequisite in `plan.blocked` prevents dispatch. Recheck dependencies and integrated evidence before the next wave. Child passes alone do not satisfy Group integration.
+
+Before parallel work, check write boundaries and shared resources: generated outputs, manifests/lockfiles, Git index, test services, databases, browsers and hardware. Different filenames prove neither interface compatibility nor isolation. Require host-proven isolation or run serially. Unknown required isolation blocks concurrency; otherwise safe serial work may continue.
+
+Send one independently executable vertical slice. Tell the recipient it is already dispatched and must not rerun parent routing or delegate further. Include only what it needs to act safely:
+
+```text
+Work: <exact WorkRef>
+Objective: <bounded outcome or review target and comparison>
+Authority: <exact owner sections or paths>
+Read: <needed sources and supporting references within the allowed boundary>
+Write: <allowed write boundary>
+Verify: <required verification boundary>
+Known facts: <only decisive current facts>
+Prohibited actions: <explicit denials>
+Stop conditions: <when to return without continuing>
+Replay caution: <only when repeating effects may be unsafe>
+```
+
+For direct work, identify the bounded request instead of inventing a WorkRef. Supply source locations and decisive facts, not copied method bodies. Distinguish the review target from supporting references. Workers load their methods and inspect actual sources and applicable instructions; Core retains result validation.
+
+Omit empty optional fields. Do not attach host lifecycle schemas, correlation identifiers, JSON transport contracts, evaluator instructions, token targets, or acceptance fields. Workers receive no implied focus, lifecycle, Git, publication, deployment, approval, or nested-delegation authority. Nested delegation is prohibited unless the task explicitly grants a bounded descendant role and the parent remains responsible for its work and result.
+
+Reuse a host-resumable worker only while goal, role, authority, writer boundary and evidence remain compatible; otherwise send a complete fresh task. Pass changed facts explicitly, never hidden inheritance as authority. After interruption use [recovery](coordination-recovery.md) to inspect effects and re-establish host facts before dispatch.
+
+Each delegated Discipline owns its own result:
+
+- **Diagnose:** `rsp-implement` read-only diagnosis mode; `confirmed | unresolved` with cause evidence and scope impact.
+- **Inspect:** Core-owned read-only evidence packet.
+- **Fix:** `rsp-implement`; `changed | no-change` with changed paths, verification, omissions, and any scope issue.
+- **Verify:** `rsp-verify`; `pass | fail | unavailable` with named checks, evidence delta, omissions, and any scope issue.
+
+One worker may return both the Fix and ordinary Verify results for the same Change when independent verification is not required. The combined result is implementation evidence, not self-certified acceptance.
+
+Fixed-scope review remains owned by `rsp-review`, including a required independent reviewer. Core adds no universal worker receipt and never asks a worker to self-report identity, independence, settlement, or acceptance.
+
+## Validate results and host facts
+
+Treat three evidence sources separately:
+
+- the worker-authored Discipline result states what the worker did and observed;
+- host observations, when available, establish dispatch, attribution, activity, cancellation, completion, and whether different workers participated;
+- Core validates authority, actual changed paths, local diff, declared verification, omissions, and current acceptance.
+
+Derive host facts from observations, not prose, handles, elapsed time, topology or passing tests. Missing observations remain unavailable. Host facts create no RSP domain objects. Workers cannot certify their own identity, independence, resource release, evidence validity or acceptance.
+
+For required delegation, Core must have an attributable worker-authored result covering the assigned boundary. For required independent Verify or Review, host observations must establish distinct workers from the accepted implementation. If not, acceptance remains `incomplete`. Core cannot author or substitute the missing result.
+
+When one worker owns Fix and ordinary checks, Core validates the result before deriving `evidence-complete`. Reuse applicable observations and checks; required Review still independently judges the actual target. Integration or changed inputs require affected checks. Archive and commit keep separate gates. Corrections return through [Core review convergence](coordination-review.md), not a worker-local loop.
+
+Host completion, transport shape or passing tests alone cannot establish acceptance; use the actual result and host facts above.

package/skills/rsp/references/durable-review.md

@@ -1,16 +1,40 @@
 # Durable writeback decision
 
-Load this reference only after required Tasks and implementation verification pass, or when auditing archive readiness.
+Load for a necessary stable-knowledge update or preparation/audit of lifecycle or terminal delivery. Passing Tasks/checks or resuming work alone does not activate it. An evidence-only Tasks/Verify refresh with accurate scope, contract, design and stable knowledge stays in Core's direct path; it neither establishes closeout eligibility nor skips separately required Review.
 
-This operation is the durable writeback decision, not implementation verification and not fixed-scope change review. Implementation verification supplies fresh evidence after mutation. Fixed-scope change review is a report-only comparison owned by Review and is required only when explicitly requested, required by nearer authority or risk, or needed to derive managed `review-clean`; it is not automatically required for every tiny direct action. The durable writeback decision is always required before archive and independently decides current-fact and Decision Record updates. It never substitutes for fixed-scope change review.
+## Establish the evidence boundary
 
-Run `rsp check --focused` and `rsp show --focused --json`, or `rsp ready <name> --json` for an explicit Change. Treat `durableReview.factCandidateTargets` and `decisionRecordsPath` as routing advice, not permission. Spec delta markers are planning aids and are never promoted automatically.
+For routine writeback, establish the relevant facts, update justified knowledge using the methods below, reconcile only affected Change sections when tracked, and check those edits. Preserve ongoing plans and unfinished work; this does not trigger final whole-Change convergence, readiness or closure. Before archive, current-fact and Decision Record decisions are both required. Keep these evidence owners separate:
 
-If `rsp show --focused --json` or `rsp ready <name> --json` reports only `RSP project requires an update` after required Tasks and implementation verification already passed, and update mutation is not explicitly authorized, do not run `rsp update`. Preserve the passed implementation verification and `first_fix_result`; report the durable writeback decision and readiness as incomplete because migration evidence is unavailable, and keep archive and commit blocked. This exception never converts a failed declared implementation or independent verification check into success, and other inspection failures remain unresolved.
+- Implementation verification supplies applicable evidence for the final content, reusing unchanged coverage and rerunning affected checks after mutation.
+- Review owns fixed-scope, report-only comparison. Use it when explicitly requested, required by nearer authority or risk, or needed by the selected acceptance; tiny direct actions do not automatically need it.
+- Durable writeback decides what belongs in current facts or lasting rationale. It never substitutes for implementation checks or a required Review.
 
-Choose current facts and rationale independently. Use no update when there is no stable fact or lasting rationale worth rereading.
+Inspect existing evidence and the selected Change when tracked. Use `rsp ready <name> --json` when current readiness or durable target advice is needed; obtain fresh readiness immediately before an authorized archive. Do not query readiness twice merely for separate writing and delivery roles. Treat `durableReview.factCandidateTargets` and `decisionRecordsPath` as routing advice, not permission. Spec delta markers are planning aids and are never promoted automatically.
 
-Return the durable decision in this semantic field order. Localize headings and labels while preserving the canonical values:
+When a diagnostic tool fails, inspect its cause and effects. Use another permitted read/search method for the same authoritative artifacts. Do not replace named required checks, infer readiness from manual reading or mutate protected RSP files to obtain a gate. Missing decisive migration, structural or verification evidence leaves dependent closeout incomplete.
+
+If inspection reports only `RSP project requires an update` without update authority, do not run `rsp update`. Preserve supported implementation and verification outcomes; report affected knowledge, readiness or delivery gaps. Archive requires current readiness. Commit may assess a separately authorized checkpoint against its exact boundary and required evidence; it stops if that evidence is affected or unavailable. Other inspection failures and required checks remain unresolved.
+
+## Close out in order
+
+Apply this sequence only for established final delivery or preparation/audit of closure. Routine knowledge updates use the bounded writeback above.
+
+1. **Verify outcome facts.** Establish the approved delivered result from current implementation, authoritative contracts and decisive evidence. Distinguish passed, failed, unverified and superseded conclusions. This establishes truth, not a preliminary full-document rewrite; plans and recovery notes alone cannot establish current facts.
+2. **Distill Focus as needed.** Integrate only verified outcomes, evidence applicability or material limits missing from Change; no useful addition means no edit. Recovery state alone supplies no required acceptance evidence.
+3. **Write back knowledge as needed.** Using the verified result and Change delta, decide current facts and lasting rationale independently using the methods below. Update existing owners only when justified. No stable change means no edit; a delivered contract that leaves its authoritative Spec stale requires correction before closeout. Do not copy the whole Change or its verification history into knowledge documents.
+4. **Converge the whole Change.** After necessary writeback, use `rsp-doc` and its artifact-lenses method when available to reconcile all six sections as one final document. Retain the delivered delta, relevant design, task outcomes, candidate-bound verification, material failures/limits and knowledge-update references; leave already-converged text unchanged. Reconcile superseded, misplaced or duplicate content. Keep process history in its report or conversation, Group integration conclusions in the Brief, and transient operation permissions distinct from product boundaries. Without Doc, perform the same bounded convergence locally without installation or replacing required Review.
+5. **Check final consistency, then archive when authorized.** Compare the final Change and knowledge owners with the verified result; an earlier review of another revision or a passing readiness command proves no text quality. Reuse applicable implementation/test evidence, check new knowledge/document edits, and fill only missing or invalidated coverage. Document-only writeback and archive preparation do not themselves invalidate code checks. Complete separately required Review before the archive gate below. Fix prose defects in scope, but return material contract or implementation contradictions to the decision, implementation or verification owner. Unresolved Required failures still block closeout.
+
+These are dependency constraints, not persisted phases or mandatory separate tool calls. Edit only what needs writeback; required updates cannot be waived. Resolve stale statements from verified outcomes. Preserve settled planning, unrelated style and original evidence/verdict owners; add no no-op reports. Author checks establish no independent review.
+
+Observe acceptance-critical commands separately by default. A batch must stop on failure and expose every result and exit status; trailing success proves no earlier pass. For a missing result, re-observe only that read-only or proven repeat-safe check by its declared method. Inspect effects before repeating mutations. Keep dependent lifecycle actions incomplete until required checks pass. Use existing document/link checks or known-path inspection instead of improvised general Markdown regex parsing. Ordinary reads may be batched.
+
+## Decide current facts and lasting rationale
+
+Use no update when there is no stable fact or lasting rationale worth rereading.
+
+Report actual knowledge updates, unresolved decisions and requested readiness conclusions concisely. Current-fact and Decision Record decisions remain independently required before archive, but routine no-op fields need not appear in the response. Include exact targets and decisive rationale when needed; a readiness report retains `yes | no`, gate evidence and blockers. Use the complete rendering below only for an explicit request or real technical consumer. Localize headings and labels while preserving the canonical values:
 
 ```md
 ## <localized Durable Decision heading>
@@ -23,14 +47,38 @@ Return the durable decision in this semantic field order. Localize headings and
 - <localized Archive ready label>: <yes | no>
 ```
 
-Response-only Continuation and Durable Decision labels are not canonical artifact headings. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone.
+This is a response-only decision summary, not a block to paste into Change or archive. Persist actual knowledge updates and material decisions in the appropriate existing sections; omit empty targets, transient readiness and authorization receipts unless a declared consumer requires them. In Chinese, for example, use `## 持久化决策`, `决策记录（Decision Record）`, and `可归档（Archive ready）`, not English labels alone. Compact presentation changes no decision or closeout gate.
+
+## Write current facts to their owner
+
+Write only a changed stable fact that future maintainers need. Select the smallest existing owner; summarize and link rather than maintain the same rule twice:
+
+- `README` owns introduction, usage and starting points, not duplicate specifications.
+- `AGENTS.md` owns scoped operating rules, authority and checks, not product behavior.
+- Authorized root or local `CONTEXT.md` owns canonical vocabulary, domain relationships and navigation, not implementation notes or session history. Define a term once in its domain and link it elsewhere.
+- Specs own current capabilities, collaboration contracts, boundaries and necessary constraints, not code inventories or future plans. Domain contracts use their relevant Spec; project-wide architecture uses `.rsp/specs/design.md`. Keep design references when they define normative evidence.
+- Change owns this outcome's delta, design, work and evidence, not a full baseline copy. Decision Records own significant choices, alternatives and consequences, not another current-contract definition. Archives retain historical evidence, not current authority.
+
+Create a Spec only for reusable truth with no suitable existing owner.
+
+For substantial authorized writeback, use `rsp-doc` when available. A partial or older installation may instead apply these local checks; neither method replaces required Review:
+
+- State consumers/value, handoffs, observable behavior, invariants and limits that survive replaceable internals.
+- New domain Specs may use Purpose, Boundaries, Contracts, Scenarios and Constraints as a scaffold. Domain headings and normative design references remain valid; neither table shape nor template conformity selects ownership.
+- Include only useful discriminating scenarios; Given/When/Then is optional. Plain-prose hints may stay, but requirements and limits remain visible.
+- Link rationale to its Decision Record and verification to the Change. Resolve Spec/code discrepancies before choosing the correction owner; code alone supplies no new promise.
+- Check that the future reader can find and use grounded facts, understand conditions and unknowns, and follow valid references. Preserve meaning; do not rewrite existing Specs merely for matching headings.
+
+## Write lasting rationale when needed
+
+Create or update a Decision Record only for a hard-to-reverse or surprising choice with a real tradeoff. It owns rationale, alternatives, tradeoffs and consequences, not duplicated current facts. Choose one exact file under `durableReview.decisionRecordsPath`, not the directory itself.
 
-Write a current-fact update only when implementation changed a stable behavior, boundary, default, or constraint that future maintainers need. Prefer the smallest existing domain Spec, `.rsp/specs/design.md` for project-wide boundaries/navigation, or an explicitly authorized scoped `CONTEXT.md`/`AGENTS.md`; create a new Spec only for reusable project-level truth that fits nowhere existing.
+Never use generated indexes, archives, or the managed RSP block as ordinary writeback targets. Keep narrative history, debugging notes, task chronology, and transient evidence out of Specs and Decisions.
 
-Create or update a Decision Record only for a hard-to-reverse or surprising choice with a real tradeoff. It owns rationale, alternatives, tradeoffs, and consequences—not duplicated current facts. Choose one exact file under `durableReview.decisionRecordsPath`, not the directory itself.
+## Prepare the Change for archive
 
-Never use generated indexes, archives, `.rsp/rsp-rules.md`, or the managed RSP block as ordinary writeback targets. Keep narrative history, debugging notes, task chronology, and transient evidence out of Specs and Decisions.
+Before archive, require the converged final Change, completed or unnecessary knowledge writeback, applicable passing verification, current readiness and every separately required Review clean. Authorized archive preserves Change and clears its Focus marker; clearing the Capsule cannot substitute for writeback. Archive grants no local commit authority.
 
-Before archive, compress the Change to current design, completed outcomes, decisive evidence, omissions, remaining risks, and blockers. Archive only after required writeback is complete or explicitly unnecessary and every separately required fixed-scope change review is clean. Ordinary work needs later explicit Git authority for one independently reviewable logical commit. A `manage.closeout` preset applies only when Core selected and qualified Manage for the current continuation; declined, unavailable, or unselected Manage leaves Core advisory and configuration executes neither archive nor commit. In a qualified managed continuation, lifecycle closeout is independent from Git and follows the effective ceiling: `manual` leaves archive advisory, while `lifecycle` or `local` permits `rsp archive <change-work-ref>` after the durable writeback decision unless nearer authority narrows it. For a shallow Group with lifecycle closeout, make the durable writeback decision and archive each child independently, re-derive completion, and run `rsp group close <group>` only after every child and Group gate passes. Inspect each complete lifecycle diff before deciding Git separately. `manual` and `lifecycle` grant no commit; `local` may justify recovery checkpoints and, after lifecycle closeout, requires one `rsp-commit` invocation for a terminal non-small Change or Group when owner, paths, fresh decisive verification, and a clean exact boundary are known and no nearer denial exists. Terminal small work defaults to no commit; ambiguous, mixed, stale, or denied boundaries stop without staging. A separately authorized release operation may use a dedicated release commit. Push remains separate and requires the user to mention it explicitly.
+## Deliver with explicit boundaries
 
-When commit eligibility and authority exist, give `rsp-commit` one envelope containing the `change`, `group`, or `release` owner variant, exact allowed paths, decisive evidence, applicable lifecycle or release-boundary evidence, and current authority. Only if that Skill is unavailable, perform the same bounded manual action: reread nearest authority and owner; inspect staged, unstaged, and untracked paths, the cached diff, and recent non-merge messages; stop without staging on ambiguity or stale evidence; stage only allowed paths; re-inspect the complete cached boundary; derive a repository-consistent Conventional subject plus a proportionate body and truthful owner-derived trailers; create one local commit; then observe its complete message, paths, remaining worktree, and remote safety without amending or performing any external action. An available Commit Skill that rejects its envelope returns the missing condition and does not authorize manual reimplementation.
+[Delivery closeout](closeout.md) owns checkpoint/final classification, the ask/auto/manual closure decision, Group-close sequence and exact Git handoff. Ordinary completion leaves work open. Apply the selected policy and current gates regardless of delegation. Git delivery separately needs explicit authority for one independently reviewable logical commit; closure grants none. Reuse applicable evidence.

package/skills/rsp/references/focus-continuation.md

@@ -1,9 +1,13 @@
 # Focus and continuation recovery
 
-Load this reference only when a Focus Capsule exists, is inspected or mutated, reports warnings, accepted work needs a continuation, or a continuation resumes.
+Load when tracked work needs a recovery snapshot, a Capsule needs inspection or replacement, or a portable continuation handoff is required. Same-session worker continuation alone uses [coordinated interruption and recovery](coordination-recovery.md), not this format. Short direct tasks need no new WorkRef or Capsule.
 
-The optional bounded Markdown Focus Capsule is a Manager-owned recovery pointer, never selection, authority, acceptance, worker transport, or host runtime state. A portable commit-safe v1 capsule permits only one leading version comment, blank lines, exactly one non-empty single-line `Current`, `Evidence`, and `Next`, and at most one non-empty single-line `Resume check`; unknown non-empty lines or fields are invalid. It excludes worker identity, handles, machine-specific paths, raw worker messages, chronology, topology, authority, acceptance, logs, diffs, and duplicated Tasks.
+Core owns the selected WorkRef's replaceable recovery snapshot. At a pause, handoff or recovery-relevant checkpoint, update it only when the Change, evidence and existing snapshot are insufficient for safe continuation. Retain the minimum current state, evidence pointers, next action and resume conditions. Ordinary same-session progress needs no update. Use `rsp focus <work-ref> --capsule-file <path|->` to replace, not append. Respect nearer mutation restrictions. For Group work use the selected child's Capsule, not a Group marker. Empty markers remain valid.
 
-When accepted work remains, return a localized continuation with these semantic fields in order: `WorkRef`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. Preserve technical values; the continuation is not a second state store.
+The existing v1 format is bounded to 4096 UTF-8 bytes: one leading `<!-- rsp-focus:v1 -->`, blank lines, exactly one non-empty single-line `Current`, `Evidence`, `Next`, and at most one non-empty single-line `Resume check`. No other non-empty lines are valid. Keep raw logs/diffs, runtime identifiers, host paths, credentials and execution history out. The marker path selects work; its notes grant no authority or acceptance and are never worker transport or controller state.
 
-On same-session resume, reopen its pointers to authority and owned artifacts, inspect drift and replay safety, and refresh decisive evidence. On cross-session or cross-device resume, distrust transient worker and liveness claims and rederive authority, focus, baseline, dirty state, conflicting resources, blockers, evidence freshness, route, and Manage qualification before mutation.
+Before closeout, use the [durable-writeback sequence](durable-review.md): verify outcome facts, distill useful Focus facts and update stable knowledge as needed, then converge the whole Change and check final consistency before authorized archive. No useful Focus addition requires no edit; it waives neither necessary knowledge correction nor final Change convergence. Detailed evidence stays with its existing owner, never solely in the Capsule.
+
+When accepted work remains, return a localized continuation with these semantic fields in order: `WorkOwner`, `Authority`, `Current state`, `Changed artifacts`, `Fresh verification`, `Blockers`, `Next action`. A Change WorkOwner uses its WorkRef; a Group WorkOwner uses its Group reference and direct child Changes. Preserve technical values; the continuation is not a second state store.
+
+For same-session, cross-session or cross-device resume, follow [interruption and recovery](coordination-recovery.md#resume-from-effects-not-tool-status) before continuing from this snapshot. That method owns drift, evidence applicability, replay safety and re-establishing current authority and host facts.

package/skills/rsp/references/groups-dependencies.md

@@ -1,12 +1,14 @@
 # Groups and dependencies
 
 Load this reference before creating, focusing, planning, or closing grouped or dependent work.
+Use the same selected CLI throughout; `rsp` below denotes that invocation, not a request to fetch or install a package.
 
-- Executable WorkRefs are `<change>` or one direct `<group>/<change>` child. Deeper paths are unsupported.
-- Use a Change Group only for at least two independently executable Changes sharing a goal or completion contract. Create it with `npx -y @oevery/rsp group create <group> [goal]`, replace placeholders, and declare each direct child under `Slices` before creating it.
-- `<group>/brief`, stored as `<group>/00-brief.md`, is not executable or focusable. Read it before a selected child. Its declaration order guides navigation and its blockers are inherited as external blockers, not graph edges.
+- Use the [shared work model](work-model.md) for Group and child identities when those definitions are missing from the current context.
+- Use a Change Group only for at least two independently acceptable/deliverable Changes with dependencies or an integration obligation. Create it with `rsp group create <group> [goal]`, replace placeholders, and declare each direct child under `Slices` before creating it.
+- The Brief is not focusable. Read it before a selected child. Its declaration order guides navigation and its blockers are inherited as external blockers, not graph edges.
+- Group-level integration obligations belong in the Brief's `Completion Conditions`. Use a named `Integration:` condition for the durable boundary and record fresh integration evidence before marking it complete. A boundary supplied only by the current request is transient and cannot complete Group closeout until it is written back.
 - Declare an exact prerequisite only as `- requires \`<change-work-ref>\`: <reason>` under the dependent Change's `Blockers`. Targets must be executable Changes.
-- Use `rsp status --json` as the derived dependency view. `plan.nodes`, `ready`, `edges`, `blocked`, and `waves` are authoritative for the current inspection. Each edge means “change requires prerequisite”; filtered plans retain transitive prerequisite context.
+- Use plain `rsp status` for the default semantic view and `rsp status --json` when exact dependency fields are needed. In the default JSON projection, `plan.nodes`, `plan.edges`, `plan.blocked`, and `plan.waves` are authoritative; the first non-empty wave is the current ready work. Each edge means “change requires prerequisite”; filtered plans retain transitive prerequisite context.
 - Do not infer nested ownership from the human dependency forest, create a parallel graph, or copy live delivery state into a Group Brief. Archived prerequisites resolve without rewriting dependents; incomplete inspection fails closed.
 - Archive children independently. Close the brief with `rsp group close <group>` only after every direct child and group completion gate passes.
 - Closed Group recovery never reuses its identity through `rsp group create` and never cascades into children or dependents. Core's direct reopen-recovery procedure owns the lifecycle sequence and exact retained-archive selection.

package/skills/rsp/references/response-language.md

@@ -8,4 +8,6 @@ Durable artifact prose is repository-owned. For a new authorized artifact: expli
 
 Commit-message prose: explicit current instruction → configured effective commit language → nearest repository authority → clear recent non-merge history.
 
+When precedence needs configured RSP language, use the same selected CLI's successful `rsp config --json` summary, optionally `--compact`; the CLI resolves defaults and inheritance. Reuse it until relevant configuration changes or recovery requires refresh. Raw YAML and status do not resolve effective language. On failed or unavailable projection, diagnose without inventing values or silently dropping configured precedence. Only the dependent choice waits; existing-file preservation, explicit overrides and independently authorized work needing no unresolved setting may continue. Other configuration systems retain their own readers.
+
 Preserve canonical headings, paths, commands, identifiers, WorkRefs, Conventional Commit types and scopes, trailers, severity labels, and machine values. Language and locale never rename or translate an existing WorkRef. Persistent prose belongs to the domain, system, user, or operator; mention AI or agents only when they are actual product actors or constraints.

package/skills/rsp/references/setup-repair.md

@@ -1,11 +1,41 @@
 # Setup and repair
 
-Load this reference only before initializing, auditing, migrating, or repairing RSP-managed state.
+Load before initializing, inspecting or updating RSP-managed assets.
 
-1. Initialize with `npx -y @oevery/rsp init [--agents-mode managed|print] [--with-project-setup]`.
-2. `--with-project-setup` creates and focuses `changes/project-setup.md`. Without it, create that Change only when explicit bootstrap tracking is still needed.
-3. Put project-wide boundaries in `.rsp/specs/design.md`, use `rsp specs` for direct current-file navigation and bounded literal discovery, put cohesive reusable facts in the smallest domain Spec, and keep stable operating instructions in the nearest project-owned `AGENTS.md` outside its managed block.
-4. Diagnose with `npx -y @oevery/rsp doctor`. Apply only deterministic repository repairs with `doctor --fix` or `rsp update`; `fixed` entries are real filesystem mutations, while an empty list means nothing changed.
-5. Do not use repair commands to decide stale focus, semantic durable updates, or archive readiness.
+Use the runtime selected in AGENTS: an exact package pin in .rsp/version for
+consumer projects, or this checkout's built CLI when .rsp/source explicitly
+selects source mode. The two markers are mutually exclusive. An authorized package
+upgrade deliberately selects its exact target CLI; source update keeps the local
+selection. Never silently resolve @latest; package fetching requires separate authority.
 
-For manual audit, require `.rsp/`, managed roots, and nested Spec parents to be real directories. Require the project `AGENTS.md`, managed markers, fallback/config files, `specs/design.md`, placeholders, and any reserved generated-index compatibility path to be regular files. Confirm the managed block, direct Specs query, configured Decision Record exclusion, valid group briefs and direct children, supported path depth, and focus markers matching executable Changes. Symlinks, special files, incomplete inspection, unrecognized reserved indexes, and file/directory identity collisions fail closed. Fresh initialization and Spec creation never generate indexes. `rsp update` removes only a root `INDEX.md` or any `00-index.md` with exact generated Specs metadata, using complete preflight, quarantine, direct-query postcheck, and rollback; owner-controlled reserved content is preserved for explicit review.
+- **Initialize:** rsp init [--agents-mode managed|print] [--with-project-setup] creates missing scaffolding and the complete core suite. Existing user files remain unchanged. Retry an incomplete init with the same target; repeated init cannot adopt a different pinned version. Retired Rules require update instead.
+- **Update:** rsp update replaces the selected package's owned assets; optional --dry-run previews without writes. No separate installation or migration switches are needed.
+- **Inspect:** rsp doctor and rsp skills list are read-only. Only explicit doctor --check-updates queries stable metadata. Reports and notices grant no mutation authority.
+
+## Ownership and failure
+
+Core Skill installation directories and exact retired Skill/Rules names are
+package-owned: replace or delete them, including local changes. Preserve needed
+customizations beforehand. Unknown Skills, config, Specs, work, archives, Decision
+Records and Focus are user-owned; update does not rewrite or repair them. Missing
+config values use read-time defaults. AGENTS changes are confined to its managed
+block; write a consumer pin last, and never create one in source mode. Preserve
+canonical maintainer links to package sources.
+
+Only metadata-recognized generated indexes may be deleted from user knowledge
+directories. Stop for owner-controlled reserved paths, invalid config, unexpected
+symlinks or unsupported targets. Do not bypass validation or downgrade the pin.
+
+Failure stops without whole-update rollback or recovery copies. Completed steps
+remain applied. Inspect the reported failure, fix its cause and rerun the same exact
+target command; do not infer completion or switch to the old pin's CLI midway.
+Concurrent external edits and crash recovery are unsupported. No recovery entry exists.
+
+## Project knowledge
+
+Keep architecture in .rsp/specs/design.md, contracts in domain Specs, navigation in
+CONTEXT and scoped instructions outside the managed AGENTS block. Use rsp specs to
+query knowledge. A legacy context map selects [context migration](context-migration.md);
+discovery alone grants no merge or deletion. Semantic writeback and archive decisions
+remain outside deterministic setup. Missing required Skills stop dependent work;
+never fall back to retired Rules or install implicitly.

package/skills/rsp/references/work-model.md

@@ -0,0 +1,27 @@
+# Shared work model
+
+Read when selecting, reporting or operating a tracked RSP owner and these definitions are not already available in the current context. Direct untracked work needs no RSP identity. This file defines identities, not a requirement to execute Core.
+
+## Work shapes
+
+Direct work is a clear bounded request without durable continuity needs. Change retains one acceptance/delivery boundary for sustained work or recovery. Group coordinates independently acceptable/deliverable child Changes with dependencies or integration obligations. Complexity, file count and worker count alone select neither Group nor delegation. Agent topology is a separate execution choice.
+
+Ordinary completion and checkpoint commits leave a Change open. Final delivery or an explicit close request uses the closeout policy; reopen is exceptional recovery, not the normal iteration path.
+
+## Identity and ownership
+
+A WorkOwner is the selected owner of the requested work: a Change, or a Group for its coordination boundary. A direct untracked request retains its explicit scope without inventing a Change, Group or WorkRef.
+
+A Change WorkRef is its logical name: `<change>` for an ungrouped Change, or `<group>/<change>` for a grouped child. Use that identity in commands, reports and ownership trailers. Its Markdown file is `.rsp/changes/<work-ref>.md`: a location for reading or evidence, never the WorkRef value. For example, `checkout/cache-ttl` identifies the child whose file is `.rsp/changes/checkout/cache-ttl.md`. Evidence may cite a file and line separately.
+
+A Group reference is `<group>/brief` and resolves to `.rsp/changes/<group>/00-brief.md`; it names the Group, not an executable child Change. Identities are shallow; deeper nesting is invalid. Read its Brief for shared scope and dependencies, then select the actual child before child work. Do not substitute a Group reference, Brief path or directory for a child WorkRef. A Group-level judgment retains its Group reference and identifies the included direct child Changes.
+
+An explicit user-selected owner wins over default focus discovery. Focus markers locate open-work candidates; multiple candidates alone are not a blocker. Resolve intent and relevant state rather than guessing ownership. Preserve existing work and its owner when changing scope.
+
+## Authority and evidence
+
+Identity, focus, readiness, dependency state and capability availability grant no action authority. A Group Brief supplies context, not permission to implement every child. A completed check proves only its tested boundary; neither it nor a review report grants lifecycle completion, Git delivery, publication or approval. Each capability retains its own action and stop conditions.
+
+In a Change's Blockers, record only unresolved dependencies or decisions preventing required work. Write standalone `None` when none remain; keep non-blocking verification limits in Verify. Exact prerequisites use ``- requires `<work-ref>`: <reason>``. Other prose, including an explanation after `None`, remains an external blocker declaration.
+
+Use only the selected owner's relevant artifacts and authoritative project context. Installed files are shared across the suite, but separate workers do not inherit one another's loaded instructions. Reuse applicable definitions in the same context; obtain this file before depending on missing definitions. If the shared resource is unavailable, report an incomplete suite and stop identity-dependent actions rather than inventing a substitute or installing implicitly.