@openrig/cli 0.4.8 → 0.5.0

package/daemon/assets/claude-statusline-context.cjs

@@ -3,12 +3,13 @@
 // Reads Claude status line JSON from stdin, extracts context window data,
 // and writes atomically to a sidecar file.
 //
-// Usage: node claude-statusline-context.js <sidecar-output-path-or-dir>
+// Usage: node claude-statusline-context.js <context-output-path-or-dir> [provider-usage-dir]
 
 const fs = require("fs");
 const path = require("path");
 
 const outputTarget = process.argv[2];
+const providerUsageTarget = process.argv[3];
 if (!outputTarget) {
   process.exit(0); // No output path — silently exit
 }
@@ -51,14 +52,22 @@ process.stdin.on("end", () => {
       process.exit(0);
     }
 
-    // Atomic write: write to .tmp then rename
-    const tmpPath = outputPath + ".tmp";
-    const dir = path.dirname(outputPath);
-    if (!fs.existsSync(dir)) {
-      fs.mkdirSync(dir, { recursive: true });
+    writeJsonAtomic(outputPath, sample);
+
+    if (providerUsageTarget) {
+      const providerUsagePath = resolveOutputPath(providerUsageTarget, raw);
+      if (!providerUsagePath) {
+        logFailure("could not resolve provider_usage output path from Claude status line payload");
+        process.exit(0);
+      }
+      const rateLimits = normalizeRateLimits(raw.rate_limits);
+      const providerUsage = {
+        seatSession: raw.session_name || raw.session_id,
+        asOf: new Date().toISOString(),
+        ...(rateLimits ? { accountKind: "subscription", rateLimits } : {}),
+      };
+      writeJsonAtomic(providerUsagePath, providerUsage);
     }
-    fs.writeFileSync(tmpPath, JSON.stringify(sample), "utf-8");
-    fs.renameSync(tmpPath, outputPath);
   } catch (error) {
     logFailure("failed to collect Claude context status line", error);
     process.exit(0);
@@ -78,3 +87,26 @@ function resolveOutputPath(target, raw) {
   const safe = String(sessionKey).replace(/[^a-zA-Z0-9@._-]/g, "_");
   return path.join(target, safe + ".json");
 }
+
+function normalizeRateLimits(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const result = {};
+  for (const key of ["five_hour", "seven_day"]) {
+    const window = value[key];
+    if (!window || typeof window !== "object" || Array.isArray(window)) continue;
+    if (typeof window.used_percentage !== "number" || !Number.isFinite(window.used_percentage)
+      || typeof window.resets_at !== "string") continue;
+    result[key] = { usedPercent: window.used_percentage, resetsAt: window.resets_at };
+  }
+  return result.five_hour || result.seven_day ? result : null;
+}
+
+function writeJsonAtomic(outputPath, value) {
+  const tmpPath = outputPath + ".tmp";
+  const dir = path.dirname(outputPath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  fs.writeFileSync(tmpPath, JSON.stringify(value), "utf-8");
+  fs.renameSync(tmpPath, outputPath);
+}

package/daemon/assets/plugins/openrig-core/skills/mission-slice-sop/SKILL.md

@@ -12,7 +12,10 @@ metadata:
 
 # Mission/Slice SOP — how you work a mission & slice
 
-Use this skill to actually **do** mission/slice work the way OpenRig expects: author the convention sections, track on the canonical files, prove on them, hand off through them, and survive compaction on them. **Do the work described here; do not merely explain the protocol.** The deterministic backstop is `rig scope audit` — the audit classifier is the source of truth for adherence. The conventions themselves live in ONE document: **`docs/reference/sdlc-conventions.md`** in the repo, materialized by the daemon at **`$OPENRIG_HOME/reference/sdlc-conventions.md`** (default `~/.openrig/reference/sdlc-conventions.md`) on an installed package — this skill teaches the flow; the SSOT defines the formats.
+Use this skill to actually **do** mission/slice work the way OpenRig expects: author the convention sections, track on the canonical files, prove on them, hand off through them, and survive compaction on them. **Do the work described here; do not merely explain the protocol.** The deterministic backstop is `rig scope audit` — an **advisory, fail-open** check (it records and advises, never blocks a write; see Proportionality below), not an authority you serve. The conventions themselves live in ONE document: **`docs/reference/sdlc-conventions.md`** in the repo, materialized by the daemon at **`$OPENRIG_HOME/reference/sdlc-conventions.md`** (default `~/.openrig/reference/sdlc-conventions.md`) on an installed package — this skill teaches the flow; the SSOT defines the formats.
+
+## Proportionality — this SOP serves shipping; it is not the work itself
+The working product is the deliverable. This bookkeeping exists so the work survives handoff, compaction, and review — nothing more. **Match it to stakes:** OpenRig core = full ceremony; Studio Box / SDK / app slices = pragmatic — the mini-requirements may BE the whole PRD, and a couple of honest, LOOKed proof lines beat an elaborate contract. The `rig scope audit` backstop is **advisory and fail-open** (its own SSOT says so): it never blocks a build and is not a gate you clear before proceeding. If you're spending more time on the convention files or the audit than on the running product, stop and go build. Running the full apparatus on a small change is the letter-worship failure, not diligence.
 
 ## The SDLC flow (intent → proof)
 
@@ -30,7 +33,7 @@ intent → mini-requirements + proof contract → (UI slices: mockups)
    - **PARSER CONTRACT (README AND IMPLEMENTATION-PRD, from first draft — a parser contract, not stylistic):** each doc carries a verbatim, **undecorated** `## Mini-requirements` heading with a **numbered list**, and a verbatim, **undecorated** `## Proof contract` heading whose checkbox (`- [ ]`) lines are **character-identical** across the two files. `rig scope audit` parses the PRD's `## Proof contract`; a prose rollup (e.g. `## Required proof …`) or any renamed/decorated heading trips **`proof_contract_missing_or_malformed`** and forces a post-lock format patch. Never rename or decorate these two headings, and keep the PRD's checkbox lines byte-for-byte equal to the README's.
    - **REFERENCE-NOT-RESTATE (public / runnable examples — an honesty rail, from first draft):** any example that shows output or a value the referenced file/command **derives** — repo/runtime counts, current-state totals, hashes, timestamps — must **reference the source/derivation, omit the volatile value, or pin an explicitly stable fixture**; never hardcode the live count/state in a public or shipped doc. "Illustrative" derived output is a lie on a timer: `OK registry (2 manifests)` goes false the instant an entry lands. Write the invariant form (`OK registry (<N> manifests)`, N = entries in `registry.json`) or name the fixture instead of the momentary number. Restated derivable state in a public doc is a defect `rig scope audit` will not catch — the author owns it.
 3. **Plan-lock**: `rig scope slice approve <slice> --scope spec` — "the PRD matches the intent; THIS artifact set is what gets built." One daemon-side write: frontmatter stamp + append-only audit row.
-   - **PRE-PLAN-LOCK SELF-CHECK (MANDATORY):** before requesting `--scope spec`, run `rig scope audit --mission <mission> --json`, inspect the target slice's entry, and request the lock **only when that slice shows ZERO findings**. Do not carry a format defect (e.g. `proof_contract_missing_or_malformed`) into the lock and force a post-lock correction.
+   - **PRE-PLAN-LOCK SELF-CHECK (advisory, not a gate):** before requesting `--scope spec`, it's worth running `rig scope audit --mission <mission> --json` and clearing any real **format** defect (e.g. `proof_contract_missing_or_malformed`) so the parser can read your proof contract — that's a genuine machine-parsing need, cheap to fix. But the audit is fail-open: findings do NOT block the lock or the build, and you do NOT need a zero-findings score to proceed. Fix what's real, skip what isn't, keep moving.
 4. **Build the locked set** — look at the mockups, not just the spec text.
 5. **QA visual compare**: for each deliverable, load the planned mockup, produce the real artifact in a test/demo environment, visually compare, and record the verdict.
 6. **Drop proof**: `rig proof add <slice> --artifact-type qa --verdict PASS --candidate-sha <tip> --money-evidence "…" --evidences "1,3" --media "walk.webm,panel.png" --self-check "…"` — the C1 header's closed sets validate at drop time; `--evidences` joins the drop to its proof-contract items and `--media` names the curated proof/-relative media the drop stands behind (that pairing + media set is what the UI's DELIVERED section renders).
@@ -44,7 +47,7 @@ intent → mini-requirements + proof contract → (UI slices: mockups)
 
 ## The canonical files (the operating surface)
 
-> The canonical files below are the **operating surface of the work** — you track on them, prove on them, hand off through them, and survive compaction on them. They are NOT side-artifacts to "maintain"; keeping them current *is* the work.
+> The canonical files below are the **operating surface of the work** — you track on them, prove on them, hand off through them, and survive compaction on them. Keep them current because that is what lets the work survive handoff, compaction, and review — but they **serve** the product, they are not the product. If you're polishing these files while the actual thing isn't shipping, you've inverted it: go build, then update them.
 
 - **README.md** (mission + slice) — the overview, OPENING with the convention sections (`## Intent` / `## Mini-requirements` / `## Proof contract`). The **mission README carries this SOP at its bottom.**
 - **IMPLEMENTATION-PRD.md** — the full PRD; opens with the mini-requirements; the `## Proof contract` here is what the UI's DELIVERED pairing joins proof against.
@@ -100,7 +103,7 @@ When you `rig capture` a pane, **greyed / ghost autocomplete suggestions are NOT
 
 ## Moment-of-truth checklist
 
-- **Starting a slice?** → intent recorded verbatim? **PRD carries a verbatim numbered `## Mini-requirements` + a verbatim `## Proof contract` whose `- [ ]` lines are character-identical to the README's** (parser contract)? **no example restates derivable state** — counts/hashes/timestamps referenced, omitted, or pinned to a stable fixture, never hardcoded (reference-not-restate)? mockups attached (UI slices)? **`rig scope audit --mission <m> --json` shows ZERO findings for this slice** BEFORE plan-lock (`--scope spec`)?
+- **Starting a slice?** → intent recorded verbatim? **PRD carries a verbatim numbered `## Mini-requirements` + a verbatim `## Proof contract` whose `- [ ]` lines are character-identical to the README's** (parser contract)? **no example restates derivable state** — counts/hashes/timestamps referenced, omitted, or pinned to a stable fixture, never hardcoded (reference-not-restate)? mockups attached (UI slices)? ran `rig scope audit` and fixed any real **format** defect so the parser reads the proof contract (advisory — a clean score is NOT required to lock)?
 - **Finishing a slice?** → every proof-contract item has curated evidence via `rig proof add … --evidences --media` (C1 drops — never only hand-placed files)? PROGRESS updated? MISSION_NOTES `§1` refreshed? proof locked (`--scope delivery`)? Handed off via queue?
 - **Committing?** → PROGRESS updated?
 - **Compacting?** → filed your state in MISSION_NOTES?

package/daemon/assets/plugins/openrig-core/skills/openrig-user/SKILL.md

@@ -311,7 +311,7 @@ The floor and YOLO are **launch flags** OpenRig sets deterministically; the Lock
 ## v0.3.x Starter, Workspace, And Plugin Surfaces
 
 OpenRig v0.3.0 adds `rig agent-image`, `rig context-pack`, `rig workspace`, and
-`rig config init-workspace`. It also shifts fresh-user starter guidance toward
+`rig config init-workspace`. *(0.5.0: the `rig context-pack` alias is retired — the store + compose library is the single `rig context` noun; see "Context packs and paced delivery (0.5.0)".)* It also shifts fresh-user starter guidance toward
 `product-team` for human-directed work and `conveyor` for workflow-oriented
 work. Treat `demo` as legacy/test content unless a task specifically asks for
 the old demo spec.
@@ -471,14 +471,14 @@ honestly and the UI exposes a one-click open-missing affordance.
 
 v0.4.0 flips the five most frequently invoked read-commands from firehose-by-default to compact-by-default, and `rig queue list` adopts the docker / kubectl read-command grammar. **All defaults preserve breadth and capability — the firehose is one explicit flag away.**
 
-### `rig ps` — current-rig default + compact-by-default + `-A`/`--all-rigs` + `--full`
+### `rig ps` — scope-aware: bare `rig ps` = ALL rigs; `--nodes` = your rig only
 
 ```bash
-rig ps                      # CURRENT-RIG, all-states, compact rig summaries (default)
-rig ps --json               # compact JSON array (TL;DR per node: session, rig, activity, assigned/pending, resumeTokenPresent boolean)
-rig ps -A                   # all-rigs (fleet breadth; was the v0.3.4 default)
-rig ps --rig <name>         # explicit-rig (overrides current-rig default)
-rig ps --nodes              # compact node inventory (current rig)
+rig ps                      # ALL active rigs on the host, one compact row each — RUN FIRST to know the world
+rig ps --rig <name>         # one named rig's summary
+rig ps --nodes --rig <name> # per-node (seat) detail for a NAMED rig — the normal drill-in
+rig ps --nodes              # per-node detail — CURRENT rig ONLY (deliberately narrow; NOT the whole host)
+rig ps --json               # compact JSON (default = a bare array of ALL non-archived rigs)
 rig ps --nodes -A           # cross-rig node inventory (was v0.3.4 default)
 rig ps --nodes --full       # complete record (the v0.3.4 per-node default shape; resumeToken VALUE retained here for downstream consumers)
 rig ps --nodes --session <sess>  # narrow to one canonical session
@@ -486,12 +486,12 @@ rig ps --active             # opt-in active-state filter (does NOT change the al
 ```
 
 **v0.4.0 breadth + projection changes**:
-- **Default breadth is CURRENT-RIG** (derived from `OPENRIG_SESSION_NAME`'s `@<rig>` suffix), not all-rigs. `-A` / `--all-rigs` widens to fleet. Matches the `rig queue list -A` pattern.
+- **Rig-level `rig ps` lists ALL active rigs** (one row each — the cheap "know the world" view). The **`--nodes` (per-seat) view defaults to your CURRENT rig only** (from `OPENRIG_SESSION_NAME`'s `@<rig>` suffix); `--rig <name>` picks another rig, `-A` widens `--nodes` to the whole host (expensive — prefer `--fields`/`--limit`).
 - **Per-node TL;DR projection (compact) is the default**; `--full` returns the raw byte-equivalent passthrough. Daemon-side `recoveryGuidance` relocated to a guidance-by-reference map (no longer duplicated per-node) — even `--full` benefits.
 - **All-states stays default** (different from `rig queue list` which defaults to active-only) — for `ps`, non-running states ARE often the actionable signal.
 - **Resume-token security**: `--full` JSON emits `resumeTokenPresent` (boolean) — the actual `resumeToken` value also remains in `--full` for downstream consumers that legitimately need it, but the compact default never carries it (an orch glance never accidentally leaks token material).
 
-**STOP using `rig ps --nodes --json` as a fleet-wide casual status check assuming the v0.3.4 shape.** The v0.4.0 default is CURRENT-RIG + compact; explicit `-A --full` is the fleet firehose. The ~77,000-token status-glance incident is closed twice over (compact + scope).
+**⚠ SCOPE-AWARENESS — the one that bites:** `rig ps --nodes` (and `--nodes --json`) show ONLY your current rig's seats, by design — the narrow default protects your context window. **Narrow output is not the whole world.** Never conclude "my rig is the only rig on the host" from a `--nodes` read — run bare `rig ps` FIRST (cheap; it lists every rig), then `rig ps --nodes --rig <name>` for the one you need. (`-A` = the expensive whole-host node read; use sparingly. The ~77k-token status-glance incident is closed by compact + scope.)
 
 ### `rig whoami` — compact-by-default + `--full` (`--verbose` alias)
 
@@ -532,16 +532,16 @@ rig restore-check --as <session>  # narrow to one seat
 
 Closes the largest measured bomb (~79,000 → low thousands). Summary correctly identifies EVERY not-ready seat (no false-ready omission); detail is dropped only for ready seats.
 
-### `rig context` — compact summary + `--full`
+### `rig context` — context-window usage viewer (0.4.x; REMOVED in 0.5.0)
 
 ```bash
-rig context                # compact summary
+rig context                # compact summary        (0.4.x only)
 rig context --full         # complete current payload
 rig context --rig <name>   # narrow to one rig
 rig context --threshold 80 # filter to seats at/above 80%
 ```
 
-Lower leverage than the others but keeps the read-command surface compact-by-default after the upgrade.
+Lower leverage than the others; keeps the read-command surface compact-by-default after the 0.4.0 upgrade. **⚠ 0.5.0: this usage viewer is removed entirely and the `rig context` name is reassigned to the context library (store + compose) — see "Context packs and paced delivery (0.5.0)" below. On a 0.5.0 host, bare `rig context` is the library, not this viewer.**
 
 ### Why this matters
 
@@ -701,7 +701,7 @@ JSON form exposes `peersNote` directly for programmatic consumers.
 ## Inventory and Monitoring
 
 ```bash
-rig ps                      # CURRENT-RIG, compact rig summaries (v0.4.0 default)
+rig ps                      # ALL active rigs on the host, one compact row each (run FIRST to know the world)
 rig ps --nodes              # compact node inventory (current rig)
 rig ps -A                   # all-rigs breadth (was the pre-0.4.0 default)
 rig ps --nodes --full       # complete per-node record (the firehose — opt-in)
@@ -759,6 +759,7 @@ rig send <session> "message" --json
 - `--dangerously-interact --reason "<why>"` — the ONLY override of the prompt/permission guard: deliberately drive an interactive prompt/permission block (implies `--raw`, requires `--reason`, audit-logged).
 - `--host <id>` — send on a remote host declared in `~/.openrig/hosts.yaml` (ssh hosts shell out; http hosts go CLI-direct to the remote daemon).
 - `--from <session>` — originating session for the envelope sender/actor (provenance; defaults to `$OPENRIG_SESSION_NAME`, and is plumbed through cross-host sends so the remote envelope names the origin, not the relay).
+- `--context <ref>` **(0.5.0)** — attach a composed context pack/piece by ref (see "Context packs and paced delivery"). Small piece → `send --context`; a real pack → `rig walk`. The noun `rig context` composes the ref; the verb delivers it.
 
 > **Durable work goes to the QUEUE, not `send`.** `rig send` is an *ephemeral* message to a pane — it can be missed, and its delivery status is pane-render, not receipt. If you are **assigning work, or the message is important enough that losing it would be a real bummer**, use `rig queue` (below): it's durable, owned, tracked, and survives compaction and restart. Reach for `send` for a quick conversational nudge; reach for the **queue** for anything that must not get lost. Do not default to `send` for work — that's the most common mistake.
 
@@ -905,6 +906,56 @@ rig auth seats … --runtime codex         # seat -> profile registry (metadata
 
 **Hard secret boundary:** no token value is ever printed, logged, queued, streamed, or committed; status/validate report presence/mode/login-state only; seat labels are metadata, not live-account proof. MVP is `--runtime codex`; other runtimes use the same surface with a different `--runtime`, never a parallel command.
 
+## Context packs and paced delivery (0.5.0)
+
+**Compose context once, hand it to a seat cleanly.** A library primitive plus a set of delivery flags. The rule that keeps the grammar coherent — internalize this one: **the noun stores and composes; the verbs deliver.** `rig context` never sends anything; delivery is only ever `rig send` / `rig broadcast` / `rig walk` / `rig queue`.
+
+> Version note: this is the 0.5.0 surface, pinned to the team-locked spec — not yet on lagging hosts. In 0.4.x, bare `rig context` was a context-window usage viewer (above); in 0.5.0 that viewer is removed and the `rig context` name belongs to the library here.
+
+### `rig context` — the store + compose library (never delivers)
+
+Manage and compose context (any text/markdown) into reusable **packs**. Every piece and pack has a stable, **path-like ref** — you address context the way you address files (`packs/compaction-restore`, `as-built/queue-internals`).
+
+```bash
+rig context list                     # what's in the library
+rig context show <ref>               # read a piece or pack
+rig context add <ref> --from <file>  # put a piece in the store
+rig context rm <ref>
+rig context compose --out packs/<ref> --from <fileA> <fileB> ...   # ordered pieces -> a durable pack
+```
+
+- Sensible default store location; works unconfigured, can be pointed elsewhere later (another folder now; a machine or URL later).
+- `compose` (v1) is honest ordered concatenation of named files into a durable pack with a ref — "here's a file, read a file."
+- **No delivery verb lives on the noun.** To get a pack to a seat, hand its ref to a delivery verb below.
+
+### `rig walk` — paced delivery of a sequence
+
+```bash
+rig walk <seat> --through <ref | file ...> --pace 10s
+```
+
+Walk a seat *through* a pack: each piece is sent into the pane, spaced by `--pace`, so the agent processes between sends (the human paste → wait → paste rhythm). Its own top-level verb, push-direction — the walker leads and does not wait for replies; the spacing does the work. Reach for `walk` on onboarding, repriming, or a fleet update — anything absorbed in order rather than all at once.
+
+### The delivery grammar — send a ref, walk a pack, or attach it to a qitem
+
+| When | Verb |
+|---|---|
+| One thing, now | `rig send <seat> --context <ref>` |
+| One thing, everyone | `rig broadcast --rig <rig> --context <ref>` |
+| A sequence, absorbed | `rig walk <seat> --through <ref> --pace 10s` |
+| Context riding a durable handoff | `rig queue create … --body-context <ref>` |
+
+- **Rule of thumb:** small piece → `send --context`; real pack → `walk`. An oversized `send --context` warns "this is walk-sized" instead of blasting the pane.
+- **`--body-context` snapshot rule:** a qitem built from a ref stores the **resolved content** in its body **plus the ref for provenance** — the handoff carries what was actually sent, and a later library edit never silently rewrites a past handoff's history.
+- **The orchestrator habit — assign work *with* its context attached:**
+  ```bash
+  rig context compose --out packs/qitem-brief --from as-built/queue.md conventions/c1-proof.md
+  rig queue create --destination dev-driver@build --body-context packs/qitem-brief --summary "…"
+  ```
+  The assignee never greps for the as-built; the curated context rides the durable handoff, survives compaction, and is auditable.
+
+**Skills tier vs context tier:** skills are the HOT tier (ambient, finite, always-visible front-matter); context packs are the COLD tier (unbounded, fetched on instruction — "walk yourself through `packs/tui-onboarding`"). Don't overrun the skill layer by using skills as context packs — that's what this primitive is for.
+
 ## Lifecycle
 
 ### Bring a rig up
@@ -1161,13 +1212,13 @@ Verification loop:
 ```bash
 rig discover --json
 rig adopt <fragment.yaml> --bindings-file <bindings.yaml> --target-rig <rigId>
-rig ps --nodes --json
+rig ps --nodes --rig <rigId>   # the target rig's nodes (--nodes alone = your current rig)
 rig export <rigId> -o rig.yaml
 ```
 
 Success looks like:
 - the new sessions stop appearing in `rig discover`
-- the new logical IDs appear in `rig ps --nodes --json`
+- the new logical IDs appear in `rig ps --nodes --rig <rigId>`
 - `rig export` includes the new pod
 
 ### Mixed-origin rigs are allowed
@@ -1185,7 +1236,7 @@ Current safety rule:
 The proven operator pattern is:
 - keep one OpenRig manager session outside the rig it manages
 - address the target by rig name, not cached rig ID
-- resolve the current owner from fresh `rig ps --nodes --json`
+- find the target rig with bare `rig ps` (lists all rigs), then resolve its owner from `rig ps --nodes --rig <target>` (a bare `--nodes` read is your current rig only, not the target's)
 - send the manager the spec path, bindings path, and verification steps with `rig send`
 
 This lets ordinary agents ask the manager for OpenRig help instead of every agent needing to be an OpenRig expert.
@@ -1318,7 +1369,7 @@ Design assumptions that hold in the shipped CLI:
 
 1. `rig whoami --json`
 2. `rig transcript <your-session> --tail 100`
-3. `rig ps --nodes --json`
+3. `rig ps` — lists ALL rigs on the host (know the world FIRST); then `rig ps --nodes --rig <your-rig>` for your seats. ⚠ `rig ps --nodes --json` alone is your CURRENT rig only — do NOT mistake it for the whole host (a freshly-compacted agent has no other context to catch the lie).
 4. `rig chatroom history <rig> --limit 50`
 
 ## Commands That Do Not Exist

package/daemon/assets/plugins/openrig-core/skills/queue-handoff/SKILL.md

@@ -151,6 +151,8 @@ Every qitem carries:
 - `state` — one of: `pending | in-progress | done | blocked | failed | denied | canceled | handed-off`
 - `closure_reason` + `closure_target` — set on terminal closure per hot-potato rule
 
+**(0.5.0) `--body-context <ref>` — context riding the handoff.** `rig queue create … --body-context <ref>` attaches a composed context pack to the qitem. The snapshot rule: the qitem stores the **resolved content** in its body **plus the ref for provenance** — the handoff carries what was actually sent, and a later edit to the library never silently rewrites a past handoff's history. (The `rig context` noun composes the ref; the queue delivers it — the noun has no send.) See `openrig-user` → "Context packs and paced delivery."
+
 The fields are auditable across both `rigx queue` (config-layer) and
 `rig queue` (daemon-shipped) surfaces. Watchdog policies and workflow
 runtime project new owners off these fields.

package/daemon/assets/plugins/openrig-core/skills/seat-continuity-and-handover/SKILL.md

@@ -9,6 +9,7 @@ metadata:
       - mental-model-ha
       - scope-recovery
       - session-compaction-and-restore
+      - retiring-and-inheriting-a-seat
       - agent-startup-and-context-ingestion
       - agent-starters
       - composable-priming-packs
@@ -107,7 +108,7 @@ A seat stays `Stable` even if multiple candidate-occupants were produced and dis
 ## Hard boundaries (do-not list; verbatim)
 
 - **Do NOT collapse `rebuild` and `seat handover` into one primitive.** The design specifically separates them so the system can describe what actually happened.
-- **Do NOT introduce successor-suffix seat names** (`lead2`/`lead3`). Stable seat identity is the architectural goal.
+- **Do NOT introduce successor-suffix seat names** (`lead2`/`lead3`). Stable seat identity is the architectural goal. *(Reconciliation: this governs the **live** seat address, which stays clean — the seat name is whoever sits now. A **retired** tenure IS versioned (`<seat>-vN`) as the separately-recorded provenance trail / cold wake-target — that is the lineage, not a live successor-suffix. See `retiring-and-inheriting-a-seat` and its lineage ledger.)*
 - **Do NOT report `seatBindingOutcome: handed_over`** if the provenance record didn't write durably.
 - **Do NOT auto-rollback a half-completed handover** by re-attaching the old occupant unless detach completed cleanly first.
 

package/daemon/assets/plugins/openrig-core/skills/session-compaction-and-restore/SKILL.md

@@ -15,6 +15,7 @@ metadata:
       - composable-priming-packs
       - session-source-fork
       - seat-continuity-and-handover
+      - retiring-and-inheriting-a-seat
       - claude-compact-in-place
       - pre-maintenance-agent-preservation
 ---

package/daemon/dist/adapters/claude-code-adapter.d.ts

@@ -8,6 +8,10 @@ export interface ClaudeAdapterFsOps {
     mkdirp(path: string): void;
     copyFile(src: string, dest: string): void;
     listFiles?(dirPath: string): string[];
+    /** Source file permission bits (for mode-preserving projection). Optional: mode preservation is a no-op if absent. */
+    statMode?(path: string): number;
+    /** Apply permission bits to a file (for mode-preserving projection). Optional: no-op if absent. */
+    chmod?(path: string, mode: number): void;
     /** List files in a directory (for session token capture). */
     readdir?(dirPath: string): string[];
     /** User home directory (for session file lookup). */
@@ -26,6 +30,8 @@ export declare class ClaudeCodeAdapter implements RuntimeAdapter {
     private stateDir;
     private collectorAssetPath;
     private autoDriveProviderPrompts;
+    private activityRelayPath;
+    private claudeHooksManifestPath;
     constructor(deps: {
         tmux: TmuxAdapter;
         fsOps: ClaudeAdapterFsOps;
@@ -34,6 +40,11 @@ export declare class ClaudeCodeAdapter implements RuntimeAdapter {
         stateDir?: string;
         collectorAssetPath?: string;
         autoDriveProviderPrompts?: boolean;
+        /** DI source of the activity-relay.cjs asset (parity with the Codex adapter). */
+        activityRelayPath?: string;
+        /** DI source of the canonical claude.json hooks manifest — the event vocabulary
+         *  is derived (filtered to relay events) from it, not a parallel constant. */
+        claudeHooksManifestPath?: string;
     });
     listInstalled(binding: NodeBinding): Promise<InstalledResource[]>;
     project(plan: ProjectionPlan, binding: NodeBinding): Promise<ProjectionResult>;
@@ -56,6 +67,14 @@ export declare class ClaudeCodeAdapter implements RuntimeAdapter {
     }): void;
     private verifyResumeLaunch;
     private projectEntry;
+    /**
+     * Reapply the source file's permission bits to the projected dest. Plain
+     * readFile+writeFile (writeFileSync) creates the dest with the process default
+     * mode, dropping executable bits on nested plugin helpers (e.g. the
+     * claude-compaction-restore/scripts/*.mjs 0755 hooks). No-op when the fs adapter
+     * does not expose mode primitives (keeps existing mock-fs callers unaffected).
+     */
+    private preserveMode;
     private pluginAppliesToClaude;
     private resolveTargetDir;
     private applyRuntimeResource;
@@ -96,5 +115,22 @@ export declare class ClaudeCodeAdapter implements RuntimeAdapter {
      * Idempotent: safe to call multiple times (merge preserves existing settings).
      */
     private provisionContextCollector;
+    /**
+     * Reconcile the OpenRig-managed activity-relay hooks in `.claude/settings.local.json`
+     * to the desired `enabled` state, driven ONCE from the always-run `project()` seam.
+     *
+     * ENABLE (only when the relay SOURCE is readable): deliver `activity-relay.cjs` →
+     * `<cwd>/.openrig/hooks/scripts/` (mode preserved, 0755 from the source asset) and upsert
+     * the owned command for each relay event DERIVED from the canonical claude.json manifest
+     * (compaction hooks excluded). If the source is missing, deliver NOTHING (no dangling
+     * commands) and report `sourceMissing` so the caller can surface a warning + not claim
+     * projection. DISABLE: strip owned entries and prune emptied containers.
+     *
+     * Ownership is the EXACT `node <quoted relay path>` command shape, so a stale/changed
+     * absolute prefix is replaced (never duplicated) while a user command that merely CONTAINS
+     * the path is preserved. Fail-closed: a settings file we cannot parse is left byte-for-byte
+     * untouched. Not `mergeJsonFragment` (additive union-by-key can't strip on disable).
+     */
+    private reconcileClaudeActivityHooks;
 }
 //# sourceMappingURL=claude-code-adapter.d.ts.map

package/daemon/dist/adapters/claude-code-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-code-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AAIvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,6DAA6D;IAC7D,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAWD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IACtD,QAAQ,CAAC,OAAO,iBAAiB;IACjC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,gBAAgB,CAAe;IACvC,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,wBAAwB,CAAU;gBAE9B,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;QAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,wBAAwB,CAAC,EAAE,OAAO,CAAC;KACpC;IAUK,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0B9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAsDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IA+EzB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IAqBhE,8FAA8F;IAC9F,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI3F,wFAAwF;IACxF,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;YAM7E,kBAAkB;IAkFhC,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,iBAAiB;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAmBrB;;;;OAIG;IACH;;;;;;OAMG;YACW,kBAAkB;IAehC,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,uBAAuB;IAmB/B,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;CAyBlC"}
+{"version":3,"file":"claude-code-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-code-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAChD,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAC3E,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AAMvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,sHAAsH;IACtH,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,mGAAmG;IACnG,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,6DAA6D;IAC7D,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAWD;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IACtD,QAAQ,CAAC,OAAO,iBAAiB;IACjC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,gBAAgB,CAAe;IACvC,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,wBAAwB,CAAU;IAC1C,OAAO,CAAC,iBAAiB,CAAgB;IACzC,OAAO,CAAC,uBAAuB,CAAgB;gBAEnC,IAAI,EAAE;QAChB,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,kBAAkB,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;QAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,iFAAiF;QACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B;sFAC8E;QAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC;IAYK,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAWjE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmD9E,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAsDlG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,8BAA8B,EAAE,UAAU,CAAA;KAAE,GAC3G,OAAO,CAAC,mBAAmB,CAAC;IA+EzB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IAqBhE,8FAA8F;IAC9F,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAI3F,wFAAwF;IACxF,sBAAsB,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;YAM7E,kBAAkB;IAkFhC,OAAO,CAAC,YAAY;IAuDpB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,iBAAiB;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAmBrB;;;;OAIG;IACH;;;;;;OAMG;YACW,kBAAkB;IAehC,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,uBAAuB;IAmB/B,OAAO,CAAC,wBAAwB;IAUhC,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA2BjC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;CA+ErC"}