@openrig/cli 0.5.11 → 0.5.13

package/daemon/docs/reference/legacy-topology-migration.md

@@ -2,8 +2,7 @@
 
 For rigs whose hand-authored context predates the chain-file convention and
 lives at the legacy location (`~/.openrig/shared-docs/rigs/<rig>/`, or
-`$OPENRIG_SHARED_DOCS_ROOT/rigs/<rig>/`). The parent-host reconciliation
-campaign is the first consumer of this path. Nothing here is destructive: the
+`$OPENRIG_SHARED_DOCS_ROOT/rigs/<rig>/`). Nothing here is destructive: the
 legacy tree is left in place, reads keep working throughout (the walker's
 advisory-emitting fallback), and every copy is no-clobber.
 

package/daemon/docs/reference/mission-install.md

@@ -3,18 +3,12 @@ doc: reference
 title: The mission install — the project half of agent onboarding
 stage: established
 warrant: >-
-  Minted 2026-08-28 from three lived installs run before this convention was written
-  (receipts preserved in the minting slice's proof directory): a full five-layer seat
-  rebuild with a verified correction round, a release-boundary re-prime of a whole team
-  at two depths, and a successor install composed entirely from a mission's own
-  artifacts. Confirmed by a three-leg research round: the anatomy maps 1:1 onto the
-  shipped three-source composition contract, push-composition is convergent practice in
-  independent agent systems, and the only measured causal evidence available supports
-  composing authored artifacts over generating summaries.
+  Compose project context from authored, addressable artifacts so a joining agent
+  can recover purpose, source precedence, current responsibility and facts to derive.
+  Paced delivery and a checked delta make consumption and unresolved facts visible.
 sources:
-  - the minting slice's SPEC design-contract block (recorded direction, decisions, prototypes)
-  - the minting slice's research synthesis (machinery table, tensions, evidence weights)
-  - docs/reference/sdlc-conventions.md (the build conventions this composes with)
+  - docs/reference/sdlc-conventions.md
+  - docs/reference/product-journey-sdlc.md
 ---
 
 # The mission install

package/daemon/docs/reference/planning-dial.md

@@ -1,10 +1,9 @@
 # The planning dial — how much rigor a plan gets, chosen per piece
 
-Planning is a spectrum, not a binary. The build phase prices its care by wave
-composition; planning needs the same flexibility, or every piece gets one protocol —
-over-working the trivial and under-working the hard. Graduated 2026-08-28 from the
-working SOP that ran a full release; the lived examples behind each rung stay in the
-originating team's playbook.
+Planning is a spectrum, not a binary. When the wave model is selected, build care
+varies by wave composition; planning needs the same flexibility, or every piece gets
+one protocol — over-working the trivial and under-working the hard. Choose the rung
+from the work's uncertainty and consequences.
 
 ## The rungs — dial up by what the piece is
 
@@ -42,14 +41,13 @@ substrate where a plausible, self-consistent plan would ship the exact disease i
 exists to kill. The discriminator is "would a wrong plan be expensive, hard to undo,
 and invisible from inside" — never "is this piece central." Importance without an
 unclosable unknown or an author-blind failure mode stays at P1. Planning is text-only
-work, so the dial's cost stays proportional: a targeted P2 can take minutes; a full
-P3 an hour or two — cheap against a wrong plan built.
+work; keep its scope proportional to the unresolved question and the cost of a wrong
+plan, rather than assuming a fixed duration for a rung.
 
-## Cost calibration (dated observations from the graduating team, 2026-08)
+## Cost calibration
 
-A P2+P3 pass on the most load-bearing piece of a release took about two hours end to
-end and produced the most-attacked spec in the release before a line of its code
-existed. A P3 alone ran ~70 minutes and returned six findings, two behavior-changing.
-A targeted P2 resolved a feasibility door in ~5 minutes against primary sources and
-caught two defects in an already-in-flight candidate. The recurring lesson the rungs
-carry: run the research BEFORE the build dispatches, not during.
+Scope research to the unknown that could change the plan; scope an adversarial
+pass to the failure modes the author may miss. Record the questions resolved and
+the resulting design changes so the owner can judge the value of the selected
+rung. Run planned research before build dispatch, while its answers can still
+shape the spec.

package/daemon/docs/reference/project-release-profile.yaml

@@ -19,6 +19,10 @@ lifecycle:
         - release-boundary
       workflow:
         entry: { role: orchestrator }
+        # Entry/ordinary custody and exception selection are separate decisions.
+        # Replace the example target with a declared member (rig ps --nodes --json).
+        # Inspect with workflow compile/show; adopt later corrections with workflow revise.
+        exception_routing: { orchestrator_role: orchestrator }
         roles:
           orchestrator: { preferred_targets: [orch@example] }
         steps:

package/daemon/docs/reference/project-workspace.md

@@ -73,6 +73,29 @@ ownership receipt. A later seat start with no project-world input preserves it;
 an explicit install whose `install.skills` is empty clears it. This keeps
 "project not supplied" distinct from "project deliberately selects no skills."
 
+## TUI project selection
+
+Open **PROJECTS** (or enter `projects`) to choose an ID and root from the
+configured workspace catalog. `project <id>` selects an exact catalog entry;
+`mission <directory>` then opens that project's execution view. The historical
+`scopes` machine section ID remains valid. Project selection and its canonical
+root travel through mission, slice, source-file and Back navigation. Changing a
+catalog root requires selecting it again. Missing or malformed sources remain
+unavailable; another project's matching work ID is never a fallback.
+
+`source` opens the current project, mission or slice's actual source through the
+existing file-reader allowlist. Catalog membership does not grant file-read or
+execution permission. These views only read; they do not select a lifecycle
+operation or activate a mission. Execution and slice queue membership require
+an exact `project:<id>` tag; lifecycle instances use their authored project
+identity. Unscoped historical queue rows and global review artifacts without
+project binding are excluded from project-specific claims.
+
+The read API adds `GET /api/scopes/projects` and optional `project` and
+`projectRoot` parameters to scopes, execution and slice-detail reads. Slice
+detail also requires the selected mission directory. Existing reads without a
+project parameter keep their legacy contract.
+
 ## UI Mapping
 
 - `workspace.root` maps to the Project workspace.

package/daemon/docs/reference/refocus-channel.md

@@ -61,10 +61,7 @@ unset, the existing FILE and generic paths are unchanged.
 Mission-, project-, or box-specific refocus text belongs in a context-library
 entry or one of those FILES on the instance that needs it. **It must never be committed into product
 source** — the shipped default carries no path, seat name, mission, or
-practice that is not generally applicable. (The pre-promotion lab hook had
-exactly this defect: a hardcoded per-box distillation-tool path. The
-promotion removed it; the grep for project residue is part of the slice's
-proof contract.)
+practice that is not generally applicable.
 
 Every delivered refocus pairs its content with the public `refocusing` skill's
 path-only trace. Configure `OPENRIG_REFOCUS_TREES=topology|work|both` and

package/daemon/docs/reference/release-boundary.md

@@ -2,29 +2,27 @@
 
 A CHECKLIST OF JUDGMENT GUIDES, not gates: every item says WHY, most items are one
 act, and anything situational expires at the next boundary. Runs once per release
-fence, after the prior release's ceremony completes. Graduated 2026-08-28 from the
-working SOP; the graduating team's seat-specific ceremony details stay in its
-playbook.
+fence, after the prior release's ceremony completes. The project and seat owners
+select the applicable actions and preserve their reasons in the boundary record.
 
 ## 1. Seats — reset or re-prime, per each seat's continuity needs
 
-- **Builder, QA, and reviewer seats: FRESH GENERATIONS.** Graceful exit with a
-  deposit (recap where provisioned), then relaunch. Why, twice proven: accumulated
-  release context becomes noise that reads as knowledge, and long-running seats
-  carry stale injected catalogs — only a fresh launch carries current skills and
-  canon.
-- **Planning seats: MANAGED COMPACTION + RE-PRIME,** not fresh — planning continuity
-  is the seat's point; the post-compaction restore is exactly the width-restore case
-  the context machinery exists for.
-- **The continuity-bearing orchestration seat: STAYS.** Its memory is the release's
-  memory and the ceremony's custody. Known cost, accepted: its injected catalog
-  stays stale until its own next generation — the capability delta covers the gap by
-  content.
+- **Choose continuity per seat, with its owner.** Fresh launch, managed compaction
+  with re-prime, or retaining the current session serve different needs. Role names
+  alone do not select one. Record the choice, the reason and custody of open work;
+  selecting a procedure does not itself authorize a lifecycle action.
+- **Fresh launch** can clear accumulated context and load current startup guidance.
+  Before an authorized exit, preserve the seat's earned knowledge and continuation
+  (recap where provisioned); verify the new occupant's actual identity and install.
+- **Managed compaction with re-prime** can retain planning continuity while
+  restoring the context needed for the next phase. **Retaining the current session**
+  can preserve ongoing custody. In either case, inspect which guidance is stale and
+  deliver the selected current context; an edit on disk is not delivery to a session.
 - **Re-prime = the world walk + the current capability delta + the mission install**
   per the mission-install convention (`docs/reference/mission-install.md`): the world
   half restores where-you-are; the project half (five layers, two depth profiles,
-  paced pointer-walk) restores what-you-are-doing. Composing the packet by
-  improvisation is the trap this convention closed.
+  paced pointer-walk) restores what-you-are-doing. Composing from named artifacts
+  keeps source precedence visible.
 - **THE CEREMONY IS THE EXPERIMENT.** Every act above runs on the product's own
   primitives, so the ceremony doubles as their live test. Observe passively: what did
   each re-primed seat's first natural turns reach for, and what broke? Findings land
@@ -45,8 +43,8 @@ playbook.
 - Every seat sweeps its DESTINATION for open rows (wakes are unreliable; the sweep
   is the read). Each open row from the finished release gets exactly one of:
   done-with-receipt · carried-to-the-new-mission (re-filed against the new plan,
-  never dragged) · closed-superseded. Ghost obligations accumulate silently without
-  this — the measured specimen was a dozen cold rows against one seat.
+  never dragged) · closed-superseded. The sweep exposes obligations that a missed
+  wake or a stale remembered work list can hide.
 - Verify every closing-paper inheritance has a live intake row with an owner. Zero
   orphans.
 
@@ -79,17 +77,22 @@ playbook.
 ## 6. The capability-delta lifecycle (standing law)
 
 Each release's capability delta is authored at the fence and bound to the exact
-published cut. Its baseline is the canon's actual last-absorbed marker, not an
-assumption that the immediately prior semver was absorbed. When canon is behind, the
-new delta is a cumulative synthesis of every intervening delta, preserving
-supersessions and pivots rather than concatenating old prose.
-
-Canon absorbs the kept public-product truths; the canon header then names the delta,
-which EXPIRES it — verify the expiry fired, and never cite an expired delta. Private
-project topology, host practice, and release ownership go to the versioned project
-world instead of leaking into the public package. The new release's delta obligations
-start at ITS cut. A delta that outlives its absorption is a stale teaching site
-wearing a version number.
+candidate, then reconciled to the published cut. Its baseline is the canon's actual
+last-absorbed marker, not an assumption that the immediately prior semver was
+absorbed. When canon is behind, the new delta is a cumulative synthesis of every
+intervening delta, preserving supersessions and pivots rather than concatenating
+old prose.
+
+Canon absorbs the kept public-product truths. Expiry requires BOTH the canon header
+naming that exact delta AND a distinct successor delta file existing. A header alone
+does not expire it; missing or unreadable inputs remain unknown/live. At the actual
+boundary, verify the event before recording expiry, then stop citing the expired
+delta. Do not create a successor merely to make the condition true. Candidate
+absorption is not proof of publication or served production adoption.
+
+Private project topology, host practice, and release ownership go to the versioned
+project world instead of leaking into the public package. The new release's delta
+obligations start at ITS cut.
 
 ## 7. World absorption and discoverability
 

package/daemon/docs/reference/rig-spec.md

@@ -174,7 +174,7 @@ edges:
 | `name` | string | yes | — | Rig name. Used in session naming (`{pod}-{member}@{name}`), snapshot identification, and spec library lookup. |
 | `summary` | string | no | — | Human-readable description. Shown in spec library, review surfaces, and `rig specs show`. |
 | `culture_file` | string | no | — | Relative path to a rig-wide culture/constitution file. Must be a safe relative path (no `..`, no absolute). |
-| `permission_policy` | string | no | — | Permission policy attached to the rig. Either a built-in (`builtin:locked`, `builtin:standard`, `builtin:open`, `builtin:operator`) or a safe relative path to a custom policy file (resolved from this spec's directory; no `..`, no absolute). Absent leaves the default floor. A member may set its own `permission_policy`, which takes precedence over the rig-level one. See "Attaching a permission policy" below. |
+| `permission_policy` | string | no | — | Permission policy attached to the rig. Either a built-in (`builtin:locked`, `builtin:standard`, `builtin:open`, `builtin:yolo`) or a safe relative path to a custom policy file (resolved from this spec's directory; no `..`, no absolute). Absent leaves the default floor. A member may set its own `permission_policy`, which takes precedence over the rig-level one. See "Attaching a permission policy" below. |
 | `docs` | Doc[] | no | — | Documentation files that should travel with the rig. Included in rig bundles. Each entry has a `path` field (safe relative path). The engine does not consume these — they are for humans and agents setting up the environment before launch. |
 | `startup` | StartupBlock | no | — | Rig-level startup files and actions. Applied to all members via the startup layering model. |
 | `services` | ServicesBlock | no | — | Optional managed services (Docker Compose). When present, services boot before any agent launches. |
@@ -193,7 +193,7 @@ permission_policy: builtin:standard
 permission_policy: policies/my-cautious-dev.policy.md
 ```
 
-Built-in policies (`locked` / `standard` / `open` / `operator`) are read-only and are
+Built-in policies (`locked` / `standard` / `open` / `yolo`) are read-only and are
 referenced as `builtin:<name>`. A custom policy lives in your own project and is
 referenced by a safe relative path (no `..`, no absolute). A shipped example of the
 custom shape is `packages/daemon/policies/examples/my-cautious-dev.policy.md` — copy it
@@ -530,8 +530,8 @@ These are the built-in specs shipped with OpenRig. Read them as worked examples.
 
 | Spec | Location | Pods | Members | Services |
 |------|----------|------|---------|----------|
-| `product-team` | `packages/daemon/specs/rigs/product-team.yaml` | orch, dev, rev | 7 (lead, peer, impl, qa, design, r1, r2) | no |
-| `implementation-pair` | `packages/daemon/specs/rigs/implementation-pair.yaml` | dev | 2 (impl, qa) | no |
-| `adversarial-review` | `packages/daemon/specs/rigs/adversarial-review.yaml` | orch, rev | 3 (lead, r1, r2) | no |
-| `research-team` | `packages/daemon/specs/rigs/research-team.yaml` | orch, research | 3 (lead, analyst, synthesizer) | no |
+| `product-team` | `packages/daemon/specs/rigs/preview/product-team/rig.yaml` | orch1, dev1, rev1 | 7 (lead, peer, impl, qa, design, r1, r2) | no |
+| `implementation-pair` | `packages/daemon/specs/rigs/launch/implementation-pair/rig.yaml` | dev | 2 (impl, qa) | no |
+| `adversarial-review` | `packages/daemon/specs/rigs/focused/adversarial-review/rig.yaml` | orch, review | 3 (lead, r1, r2) | no |
+| `research-team` | `packages/daemon/specs/rigs/focused/research-team/rig.yaml` | orch, research | 3 (lead, analyst, synthesizer) | no |
 | `secrets-manager` | `packages/daemon/specs/rigs/launch/secrets-manager/rig.yaml` | vault | 1 (specialist) | yes (Vault) |

package/daemon/docs/reference/scoped-operating-posture.md

@@ -0,0 +1,95 @@
+# Scoped operating posture
+
+Human-led work is quiet by default for process-only diagnosis. Delegated work can
+receive oversight during planning as well as implementation. This preference does
+not grant execution authority or change permissions, work phase, workflow reminders,
+context/continuity health, or health policy.
+
+## Inspect and choose
+
+Use the existing `rig mode` surface. Give an exact rig or authored work scope:
+
+```sh
+rig mode effective --rig my-rig --json
+rig mode effective --project my-project --mission release-1 --json
+rig mode effective --qitem my-packet --json
+rig mode set delegated --scope mission --qualifier my-project/release-1 --evidence "Operator delegated this outcome"
+# The proposal above exits 2 without writing. Apply the deliberate choice:
+rig mode set delegated --scope mission --qualifier my-project/release-1 --evidence "Operator delegated this outcome" --confirm
+rig mode set human-led --scope mission --qualifier my-project/release-1 --evidence "Return to interactive planning" --confirm
+rig mode unset mission my-project/release-1
+```
+
+Unsetting reveals the next applicable explicit choice, or the visible human-led
+product default. A new, resolved rig with no binding reports `human-led`,
+`source: product-default`, and `binding: null`. Missing scope identity, conflicting
+linkage, unavailable storage or malformed authored context reports `unknown` with
+a reason. Calling `effective` without a scope does not select a rig implicitly.
+The existing operator bearer requirement still applies. `set` requires `--confirm`;
+`unset` is an explicit deletion command and applies immediately.
+
+## One scope and phase contract
+
+`GET /api/rig-mode/effective` accepts `rig`, `project`, `mission`, `workstream`, and
+`qitem`. Its additive `operatingPosture` object is also attached to health records
+and diagnosis findings. CLI explanation and TUI health detail display the same data.
+Consumers of posture, phase, and health should use this object rather than invent
+another preference store or infer delegation from workflow existence or activity.
+
+| Field | Meaning |
+| --- | --- |
+| `posture` | `human-led`, `delegated`, or `unknown` |
+| `source` | `product-default`, `binding`, or `unknown` |
+| `context` | Resolved rig/project/mission/workstream/qitem IDs, source addresses, canonical authored paths and phase; null if scope resolution failed |
+| `context.phase` | `{value, source}` from an explicit workflow packet step, otherwise slice stage/status, otherwise mission release phase/status; null fields when unavailable |
+| `binding` | Winning binding ID, scope, timestamp and evidence citation; null for default/unknown |
+| `reason` | Explanation of the result or the missing/conflicting fact |
+| `grantsAuthority` | Always `false` |
+| `members` | For queue-backed findings, each member's qitem, posture, source and binding ID; differing or unknown member postures yield unknown aggregate posture |
+
+The existing SQLite mode-binding table remains the only preference store. Matching
+posture bindings resolve in this order: qitem, workstream, mission, project, rig,
+global host. The qualifiers are respectively a qitem ID, `project/mission/slice-id`,
+`project/mission`, project ID, canonical rig ID, and null. Rig names resolve to IDs.
+The workstream is an existing authored slice, found by its directory or SPEC ID;
+the returned identity uses its SPEC ID and project/mission qualification.
+
+Project selection reads `workspace.yaml`'s declared `projects: [{id, root}]`
+catalog, or the workspace's own `project.yaml` when no catalog exists. Multiple
+projects require an explicit project selection. A sole project may be derived.
+The project manifest validates identity and supplies `missions.root` (default
+`missions`). Mission and slice identities come from those authored work nodes;
+missing, duplicate or conflicting identities remain unknown. The selected work
+must stay inside its canonical project root.
+
+Qitem reads join explicit `project:`, `mission:`, `slice:`/`workstream:` tags,
+destination rig, and the existing workflow packet binding. Workflow lifecycle
+project/mission identity must agree with the tags and requested scope. The bound
+packet's exact step is the phase source; phase names are not classified by guess.
+An unlinked qitem does not silently inherit the default. Scope reads are observational.
+
+Legacy ergonomic modes (`sleep`, `desk`, `mobile`, `away`, `focus`, `debug`) retain
+their bindings and ten-field records. They do not imply either operating posture.
+Only human-led/delegated bindings participate in posture precedence. The legacy
+`effective` and `posture: known|unknown_posture` fields remain for compatibility;
+`unknown_posture` there means no legacy mode binding and does not override the
+new `operatingPosture.source: product-default` result. Setting another mode at the
+same scope replaces that row; inspect effective posture after any mode change.
+
+## Diagnosis effects
+
+Process-category findings remain visible under human-led or unknown posture, but
+new diagnosis presentations, re-presentations and human notifications require
+explicit delegated posture. Retained occurrences are not canceled or rewritten
+when posture changes. Their current finding is refreshed for inspection and
+notification; unavailable current findings cannot reuse old delegated posture.
+Notification admission is rechecked after readiness I/O.
+
+Delegation is necessary for process interruptions and is insufficient by itself:
+enabled diagnosis policy, detector selection, source freshness, custody, cooldown,
+recurrence limits and human delivery readiness still apply. Other health categories
+and ordinary queue/workflow reminders retain their existing behavior. The automatic
+ceremony source reads declared catalog projects through the same resolver; unresolved
+lineages remain visible with unknown scope instead of acquiring invented authority.
+
+See [health diagnosis](health-diagnosis.md) for policy, evidence and disposition.

package/daemon/docs/reference/sdlc-conventions.md

@@ -7,10 +7,10 @@
 
 OpenRig is a software factory the human steers from a high altitude. The human
 records intent; agents turn intent into a plan, the plan into a build, the
-build into proof. The TUI is a **plain projection of well-formed
-markdown on disk** — agents change the files, the UI re-projects. These
-conventions define "well-formed." Everything here is **advisory / fail-open
-for agents**: nothing below blocks a write; the audit records and advises.
+build into proof. The TUI projects authored work on disk and, where an owning
+proof policy is selected, derives readiness from recorded judgments. These
+authoring conventions are **advisory / fail-open for agents**: the audit
+records and advises; the selected proof policy separately governs who may judge.
 
 
 ## HOW TO READ THIS DOCUMENT — two parts, and only one of them is the default
@@ -38,7 +38,7 @@ one does not deprecate the others. Nothing below deletes or overrides an existin
 | **PLAN** | **The planning dial** — planning rigor is a spectrum chosen per piece: P0 mini-requirements and pointers (simple, reversible work) · P1 an authored spec with a proof contract (the default) · P2 plus a research round before the spec freezes, run BEFORE build dispatch · P3 plus an adversarial pass by a non-author, judged against product goals, landing amendments with proof-contract teeth · P4 plus a blind from-scratch design diffed against priors before proceeding. Dial up by what the piece is, exactly as build care is priced below. Full reference: `planning-dial.md`. |
 | **BUILD** | **Part A, the simple flow** (below — the default) · **product-journey components** — a mission-selectable menu for greenfield work, drift recovery, public journey probes, one evidence-gated look at the layer below, minimal repair, independent QA/review, integration, and installed smoke; compose only what the work needs in mission/slice YAML, never as a new mode or mandatory pipeline. Full reference: `product-journey-sdlc.md` · **the wave model** — slices build in parallel in disjoint file territories, an integrator merges serially, and independent review fires once per wave (two reviewers with different vantages, never the writers; fix rounds re-earn verdicts at one final revision; per-slice discipline stays failing-test-first and verify-by-effect). The wave IS the care dial: what shares a wave decides how much review each piece gets · **Part B, the rigorous overlay** (below — only when assigned). These combine: a wave can carry one Part-B piece. Full wave reference: `wave-sdlc.md`. |
 | **DISPATCH DATA** | **The execution-data conventions (S27)** — three tiny data disciplines that make execution state derivable instead of hand-tabulated, consumed by `rig view show execution`. **EC-1, edges in frontmatter:** every open slice carries its hard edges in `depends_on:` (an inline JSON array; an explicit `[]` is a statement, absence is INDETERMINATE); soft/serialization edges are one machine-readable Territory line, exactly `SOFT-AFTER: [ids] — reason`. **EC-2, wave-as-data:** wave composition + review model live on a durable queue row tagged `wave-map` + `format:wave-map-v1` whose body carries one fenced ```json block (`{format:"wave-map-v1", mission, waves:[{id, slices, serialized_order?, review_model?}]}`) — composition only, never status labels (status derives at read time); the planning dial recorded at lock surfaces as the frontmatter field `approved-spec-dial:` beside the approve stamp. **EC-3, dispatch names the worktree:** build batons carry the exact body line `worktree_path=<path>` from dispatch onward — it is Q1's join key; batons without it join by naming only and the view marks them `fragile_join`. Existing batons are never rewritten. |
-| **RELEASE** | The release ceremony conventions (publication identity, honest release notes) and the CAPABILITY-DELTA LIFECYCLE LAW: each release's delta is authored at the fence, bound to the exact published cut; canon absorbs its named items; the canon header then names the delta, which expires it — verify the expiry fired, and never cite an expired delta. Full statement: `release-boundary.md` §6. |
+| **RELEASE** | The release ceremony conventions (publication identity, honest release notes) and the CAPABILITY-DELTA LIFECYCLE LAW: each release's delta is authored at the fence and bound to the exact candidate, then reconciled to the published cut. Expiry requires both the canon header naming the absorbed delta and a distinct successor delta existing; a draft header alone is insufficient. Verify the actual boundary event and stop citing an expired delta. Full statement: `release-boundary.md` §6. |
 | **BOUNDARY** | **The release boundary** — housekeeping run once per fence so the next release starts clean: seats reset or re-primed per their continuity needs, memory distilled (keep what changed a decision recently), every queue swept by destination and dispositioned, substrate torn down, boards frozen as records, a clean-box baseline captured. A checklist of judgment guides, not gates. Full reference: `release-boundary.md`. |
 
 > Full reference documents for each component (graduated 2026-08-28): the
@@ -112,6 +112,17 @@ Legacy `README.md`, `IMPLEMENTATION-PRD.md`, and pre-convention trees remain
 readable indefinitely. New scaffolds do not create or mirror them, and repair
 is additive: it never deletes, renames, or rewrites legacy bytes.
 
+When the owning scope selects `proofPolicy.judges`, use `rig proof judge` to
+record an attributed accept, reject or withdraw decision on a contract item,
+and `rig proof show` to read derived readiness up through slice, mission and
+project. The nearest slice, mission or project policy selects authorized judges;
+`rig proof --help` describes setup, selectors and evidence requirements. A
+correction preserves history and unrelated judgments without editing ancestor
+status checklists. An artifact can identify non-code work without a fabricated
+commit. Evidence capture (`proof add`), policy acceptance, higher outcome
+judgment and publication are distinct. This optional component does not select
+Part B or add a mandatory review gate.
+
 The three sections project into the UI's one review structure: a vertical
 stack of **INTENT → PLAN → DELIVERED**. A slice missing a section still
 renders (the projection degrades to a muted "—", never invents content) —

package/daemon/docs/reference/wave-sdlc.md

@@ -1,9 +1,9 @@
 # The wave SDLC — parallel build, wave-level review, composition as the care dial
 
-Graduated 2026-08-28 from the working playbook of the team that proved it live; the
-team-specific custody mechanics stay in that team's playbook. Lock stamps in this
-model are ADDITIVE: approval appends metadata and never rewrites authored bytes, so
-a candidate's identity survives its own approval.
+This is a selectable build and review model from `sdlc-conventions.md`'s component
+menu. The mission owner decides whether it fits the work. Lock stamps in this model
+are ADDITIVE: approval appends metadata and never rewrites authored bytes, so a
+candidate's identity survives its own approval.
 
 ## The model in one paragraph
 
@@ -87,7 +87,7 @@ design session first). Anything irreversible within the hour (publish, cutover,
 destructive operations) — that is the heavy path. And when no independent non-writing
 reviewers exist: nothing ever self-reviews; without them the wave gate is theater.
 
-## Failure modes, with the mitigations that worked (dated observations, 2026-08)
+## Failure modes and mitigations
 
 - **Freeze-merge races:** a candidate freezes seconds before a merge moves the tip.
   Mitigation: zero-overlap restack with content-identity proof (stable patch-id) in
@@ -100,14 +100,3 @@ reviewers exist: nothing ever self-reviews; without them the wave gate is theate
   line still prints. Rule: pin the ABSENCE of the false claim in every encoding.
 - **Phantom checkout status:** merge-by-reference leaves a shared checkout's index
   stale. Never build or commit from a shared checkout; sync its index at fences.
-
-## Measured outcome from the proving run (dated, one team, 2026-08)
-
-Eight slices plus five fix candidates plus two addenda built and merged in ~2.5 hours
-across five writing seats; two wave passes plus three fix-round passes replaced ~20
-per-slice review rounds. Defect yield went UP: the reviewers' findings never
-overlapped once across three consecutive verdicts, and the builders' green suites had
-missed every one of them — wave-level review sees cross-slice seams per-slice review
-structurally cannot. Correction latency: one live defect went found→root-caused→
-specced→locked→built→merged in 24 minutes, because no review round stood between a
-locked spec and a building seat.

package/daemon/docs/reference/worktree-builds.md

@@ -21,11 +21,11 @@ A worktree can therefore report green against code it does not contain.
 
 ## Rules
 
-1. **Run `npm install` in each worktree** (~4s, one time). It is not the slow path; it is the
-   only path that resolves workspace packages to the worktree's own source.
+1. **Run `npm install` in each worktree** so workspace packages resolve to the
+   worktree's own source.
 2. **Never symlink `node_modules` from the primary checkout.** It appears to work — builds pass,
    typechecks pass — which is exactly the danger.
-3. **`npx tsc` with no `node_modules` installs an unrelated 12-year-old `tsc` package** and prints
+3. **`npx tsc` with no `node_modules` installs an unrelated `tsc` package** and prints
    "This is not the tsc command you are looking for". That message means *no install*, not a
    TypeScript error.
 4. **Build `@openrig/daemon` before typechecking `@openrig/cli`** in a fresh worktree: cli imports

package/daemon/policies/examples/my-cautious-dev.policy.md

@@ -35,6 +35,6 @@ permission_policy: policies/my-cautious-dev.policy.md
 ```
 
 Copy it, rename it, and edit the lists to taste — it's yours to change. The built-in
-policies (locked / standard / open / operator) stay read-only and are referenced as
+policies (locked / standard / open / yolo) stay read-only and are referenced as
 `builtin:<name>`; a custom policy like this one lives in your project and is referenced
 by path.

package/daemon/specs/rigs/launch/kernel/agents/operator/agent/guidance/role.md

@@ -19,11 +19,11 @@ human channel; a terminal attachment is not a person's address.
 ## What you do
 
 - Bring rigs up and down (`rig up <spec>`, `rig down <rigId>`).
-- Restart work after a reboot. **The kernel is the only auto-start
-  rig**; other rigs require explicit operator-initiated restart.
+- Restart selected work after a reboot. Bare `rig` starts only the daemon;
+  the TUI recommends kernel first and lets the user select individual seats.
   When the user says "bring my rigs back online":
   1. List rigs that were running pre-reboot using daemon persisted
-     state (`rig ps --json`) and any operator-saved roster.
+     state (`rig ps --json`), then inspect actual selected seat state.
   2. Confirm with the user which subset to restart.
   3. Restart each via `rig up <spec>` (or `rig restore <snapshot>`
      if a snapshot exists).

package/daemon/specs/rigs/launch/kernel/agents/operator/agent/startup/context.md

@@ -22,14 +22,12 @@ restart:
    survived (daemon-restart-only, host stayed up) → marked healthy.
    If tmux is gone (host reboot) → marked detached.
 
-If the host rebooted (not just the daemon), the kernel's member
-tmux sessions are gone. You own the agent-restart workflow:
-
-1. `rig ps --nodes --rig kernel --json` shows which kernel members
-   are detached.
-2. Re-launch each detached member via the normal launch path
-   (the canonical commands live in the `openrig-operator` skill).
-3. `rig ps --nodes --rig kernel --json` again to confirm healthy.
+After a host reboot, a person can type bare `rig` to open the same TUI,
+start the daemon only, and select the existing kernel operator or other seats.
+The TUI recommends kernel first without starting every member. Its default
+for a previously occupied seat is to resume the authoritative conversation.
+Missing or ambiguous history needs repair or a separate named fresh-start
+decision; authentication failure is not a reason to replace history.
 
 Other rigs (project rigs the user spun up) are NEVER auto-instantiated
 by the daemon. If the user asks you to bring those back:
@@ -41,13 +39,14 @@ by the daemon. If the user asks you to bring those back:
    <name>` for warm-restore when a snapshot exists.
 4. `rig ps --nodes --rig <name>` to verify healthy.
 
-This is the agent-driven workflow replacing silent auto-restore.
-See the `openrig-operator` skill for the canonical script.
+The TUI is the normal human entry. Explicit CLI automation remains available;
+use the applicable lifecycle help for an authorized agent-driven operation.
 
 ## What's already running
 
-- The kernel rig itself (you, advisor.lead, queue.worker, the shared
-  operator terminal).
+- Your own successful startup does not prove the other kernel seats are
+  running. Read actual state before routing work to a peer; the user may
+  have selected only this operator.
 - Whatever non-kernel rigs were running before the daemon restarted
   have their rig records persisted in SQLite (the daemon does NOT
   cull rigs on restart) but their member sessions are likely

package/dist/bin-wrapper.d.ts

@@ -2,5 +2,6 @@
 export declare function resolveBinEntry(invokedPath?: string | undefined, moduleUrl?: string): string;
 export declare function isDirectRun(argv1?: string | undefined, moduleUrl?: string): boolean;
 export declare function resolveNodeReexecBinary(currentExecPath?: string, invokedPath?: string | undefined, env?: NodeJS.ProcessEnv, exists?: (candidate: string) => boolean, realpath?: (candidate: string) => string): string | null;
+export declare function canLoadInstalledNative(node: string, wrapper: string): boolean;
 export declare function run(argv?: string[]): Promise<void>;
 //# sourceMappingURL=bin-wrapper.d.ts.map

package/dist/bin-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bin-wrapper.d.ts","sourceRoot":"","sources":["../src/bin-wrapper.ts"],"names":[],"mappings":";AASA,wBAAgB,eAAe,CAAC,WAAW,qBAAkB,EAAE,SAAS,SAAkB,GAAG,MAAM,CAIlG;AAED,wBAAgB,WAAW,CAAC,KAAK,qBAAkB,EAAE,SAAS,SAAkB,GAAG,OAAO,CAOzF;AAED,wBAAgB,uBAAuB,CACrC,eAAe,SAAmB,EAClC,WAAW,qBAAkB,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAoB,EACnD,QAAQ,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAqB,GACrD,MAAM,GAAG,IAAI,CAiBf;AAsBD,wBAAsB,GAAG,CAAC,IAAI,WAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5D"}
+{"version":3,"file":"bin-wrapper.d.ts","sourceRoot":"","sources":["../src/bin-wrapper.ts"],"names":[],"mappings":";AASA,wBAAgB,eAAe,CAAC,WAAW,qBAAkB,EAAE,SAAS,SAAkB,GAAG,MAAM,CAIlG;AAED,wBAAgB,WAAW,CAAC,KAAK,qBAAkB,EAAE,SAAS,SAAkB,GAAG,OAAO,CAOzF;AAED,wBAAgB,uBAAuB,CACrC,eAAe,SAAmB,EAClC,WAAW,qBAAkB,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAoB,EACnD,QAAQ,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAqB,GACrD,MAAM,GAAG,IAAI,CAiBf;AA0BD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAM7E;AAED,wBAAsB,GAAG,CAAC,IAAI,WAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5D"}

package/dist/bin-wrapper.js

@@ -44,6 +44,12 @@ function maybeReexecWithSiblingNode(argv = process.argv) {
     if (!preferredNode)
         return;
     const scriptPath = argv[1] ? realpathSync(argv[1]) : fileURLToPath(import.meta.url);
+    // An alias is not runtime authority. Keep a working interpreter; only switch
+    // when the installed native dependency actually loads under the alternative.
+    if (canLoadInstalledNative(process.execPath, scriptPath))
+        return;
+    if (!canLoadInstalledNative(preferredNode, scriptPath))
+        return;
     const result = spawnSync(preferredNode, [scriptPath, ...argv.slice(2)], {
         stdio: "inherit",
         env: {
@@ -56,6 +62,13 @@ function maybeReexecWithSiblingNode(argv = process.argv) {
     }
     process.exit(result.status ?? 0);
 }
+export function canLoadInstalledNative(node, wrapper) {
+    const probe = spawnSync(node, ["--input-type=module", "-e",
+        "import {createRequire} from 'node:module'; const require=createRequire(process.argv[1]); const D=require('better-sqlite3'); new D(':memory:').close();",
+        wrapper,
+    ], { encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "pipe"] });
+    return probe.status === 0;
+}
 export async function run(argv = process.argv) {
     const normalizedArgv = [...argv];
     if (normalizedArgv[1]) {

package/dist/bin-wrapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin-wrapper.js","sourceRoot":"","sources":["../src/bin-wrapper.ts"],"names":[],"mappings":";AAEA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,MAAM,UAAU,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG;IACxF,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG;IAC9E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,eAAe,GAAG,OAAO,CAAC,QAAQ,EAClC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC7B,MAAyB,OAAO,CAAC,GAAG,EACpC,SAAyC,UAAU,EACnD,WAA0C,YAAY;IAEtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,qBAAqB,KAAK,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAEjE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IACrD,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACtE,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,CAAC,gBAAgB,CAAC,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IAC3C,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,cAAc,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAIhC,CAAC;IACF,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,IAAI,KAAK;QAAE,OAAO;IAClB,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAClB,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"bin-wrapper.js","sourceRoot":"","sources":["../src/bin-wrapper.ts"],"names":[],"mappings":";AAEA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,MAAM,UAAU,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG;IACxF,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACrG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG;IAC9E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,eAAe,GAAG,OAAO,CAAC,QAAQ,EAClC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC7B,MAAyB,OAAO,CAAC,GAAG,EACpC,SAAyC,UAAU,EACnD,WAA0C,YAAY;IAEtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,qBAAqB,KAAK,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAEjE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IACrD,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IACjE,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,UAAU,CAAC;QAAE,OAAO;IAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACtE,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,CAAC,gBAAgB,CAAC,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,OAAe;IAClE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,qBAAqB,EAAE,IAAI;QACxD,wJAAwJ;QACxJ,OAAO;KACR,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IAC3C,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,cAAc,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAIhC,CAAC;IACF,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,IAAI,KAAK;QAAE,OAAO;IAClB,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,WAAW,EAAE,EAAE,CAAC;IAClB,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/build-info.js

@@ -1,9 +1,9 @@
 // GENERATED by scripts/build-package.sh — the packaged build-identity stamp.
 export const BUILD_INFO = {
-  semver: "0.5.11",
-  commit: "ffd5ac1dd71367561ed8357bc42d5131821ee5f2",
+  semver: "0.5.13",
+  commit: "bda26cb90def54b844260f12a63ce9cabc50509c",
   dirty: false,
-  builtAt: "2026-09-07T18:39:28Z",
+  builtAt: "2026-09-10T04:59:45Z",
 };
 export function stampFields(info = BUILD_INFO) {
   if (!info.commit) return {};

package/dist/commands/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/commands/context.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqT9C,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAypBjE"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/commands/context.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAyL9C,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAysBjE"}