@openrig/cli 0.5.12 → 0.5.14

package/daemon/docs/reference/health-diagnosis.md

@@ -8,6 +8,12 @@ not declare a pathology or perform corrective actions.
 
 ## Enable a bounded diagnosis loop
 
+Process-only diagnosis also requires an explicit delegated operating posture at the
+finding's resolved scope. Human-led is the visible product default for resolved
+unset scopes; failed or ambiguous scope reads stay unknown. Findings remain
+inspectable in either case. See [scoped operating posture](scoped-operating-posture.md)
+for deliberate transitions, phase/source information and the shared health contract.
+
 ```sh
 rig health policy --json > effective-policy.json
 jq '.policy' effective-policy.json > health-policy.json
@@ -74,7 +80,7 @@ and 99. CLI/TUI finding explanations show the policy version used.
 
 Ordinary queue activity can admit a diagnosis without a health checkpoint.
 The source discovers declared handoff families touched in the observation window,
-uses their explicit `mission:` / `slice:` tags, and collects exact transition IDs,
+uses their explicit `project:` / `mission:` / `slice:` tags and workflow membership, and collects exact transition IDs,
 normal project/mission/slice authority, progress and proof references, and workflow
 closure evidence. It never interprets Markdown or counts proof files, approvals,
 C1 pairing, commits, tests, or terminal rows as accepted product outcomes.
@@ -125,13 +131,15 @@ traffic in the same family starts a new episode. Repeated reads never advance
 these boundaries. One occurrence and the existing owner cooldown apply to each
 episode; a disposition stops repeated requests.
 
-This bounded source covers explicitly tagged mission work: at most 2,000 touched
+This bounded source covers explicitly linked project or mission work: at most 2,000 touched
 qitems, 200 roots, 1,000 members / 10,000 transitions per family, 200 workflow
 receipts, 200 declared slices, and 100 proof files per selected slice. Overflow
 refuses visibly. Context files are bounded to 64 KiB. A lineage beginning before
 the retained window remains indeterminate, with the missing interval named.
-Untagged or ambiguously mission-tagged work is outside this source's coverage;
-absence is not health. The packet includes missing context references so an agent
+Project planning does not require a successor mission: an explicit project identity
+resolves its current context, with mission and phase absent unless evidenced.
+Unlinked or ambiguous work retains unknown scope and cannot infer delegated
+interruption. Absence is not health. The packet includes missing context references so an agent
 can name or repair its own knowledge gap without manufacturing source truth.
 
 ## Optional outcome-boundary checkpoint
@@ -215,7 +223,7 @@ indeterminate source truth and cannot admit a diagnosis. Availability is checked
 again on every projection; presence does not certify the artifact's meaning.
 This authority assessment is distinct from the
 project/mission/slice documents supplied to the diagnosing agent. Embedded
-context is limited to canonical `SPEC.md` and project/mission/slice YAML files
+authority is limited to canonical `SPEC.md` and project/mission/slice YAML files
 at their corresponding work-tree nodes, at most 64 KiB each. Other paths and
 symlink aliases are reported unavailable without embedding their contents.
 Each entry retains its authority level. Project files must be at the configured
@@ -225,6 +233,46 @@ mission when declared). A sibling slice or another mission is unavailable even
 when its filename is canonical. Without mission/slice scope, those authority
 levels remain unavailable.
 
+## Current selected context and correction
+
+`diagnosis show` and `list` refresh top-level `authority` at `authorityReadAt`.
+The original `packet.authority` and presentation receipts remain historical
+snapshots. Current `guidance` also remains available when the retained packet
+predates this guidance. Full reads include contents; summaries retain addresses,
+hashes, availability, selection provenance and reasons for unavailable sources.
+
+The reader reuses `project.yaml`'s `install.context` and the selected
+`lifecycle.profiles[profile].workflow.context_refs`, plus the current mission's
+`lifecycle.workflow.context_refs`. Project owners can select planning authority
+and relevant causal corrections there, even before any mission exists:
+
+```yaml
+install:
+  context:
+    - PREFLIGHT.md#current-authority
+    - evidence/process-correction.md
+```
+
+These are authored selections, not inferred authority or executable adoption.
+Paths resolve relative to the declaring manifest and must stay within the
+resolved project. Local `file.md#h2/h3` addresses use the existing Markdown
+reader. Missing/ambiguous sections, aliases, unsupported addresses, unknown scope
+and missing selections' files remain unavailable. No links are followed
+recursively and no successor mission is guessed. The reader accepts at most 32
+selected addresses, each source file at most 64 KiB, with 128 KiB of selected
+content in total; exceeded limits are visible as unavailable references. A hash
+for a section covers exactly the returned section bytes. Bare library refs and
+remote URLs are not fetched by this local reader.
+
+Authority and current usefulness are separate questions. An incomplete global
+outcome census cannot justify retaining a particular restriction whose premise
+was disproved. Read current corrections before interpreting historical
+dispositions, preserve unrelated valid boundaries such as publication authority,
+and distinguish automatic wake/receipt bookkeeping from useful owner action.
+Normal interactive planning is not itself pathology. State the relevance and
+cost of the interruption in the assessment; do not turn the signal into a
+recurring self-audit or require a universal outside reviewer.
+
 Checkpoints are audited under `health/checkpoints/history/`; replaying identical
 bytes writes nothing. Later censuses advance observation time. High-to-high
 observations retain episode identity; a clearing checkpoint and later recurrence
@@ -245,7 +293,7 @@ not a closed evidence set.
 {
   "verdict": "insufficient evidence",
   "causalStart": null,
-  "steering": "Inspect the product-outcome census before changing work.",
+  "steering": "Inspect the missing outcome evidence; apply separately established corrections within current authority.",
   "uncertainty": "The cited artifact does not yet establish the denominator.",
   "evidenceRefs": ["<inspected-evidence-path>"]
 }
@@ -263,6 +311,35 @@ it does not close or alter the underlying product work. Changed dispositions
 retain earlier testimony; exact replay is a no-op. A detector clearing is
 recorded separately from an agent declaring the problem resolved.
 
+An optional `correction` keeps the causal judgment, proposed or taken action,
+and later behavioral effect distinct. It does not require a complete `progress`
+census. For example, a retained-case assessment can record:
+
+```json
+{
+  "applicability": "The retired emergency restriction no longer applies; publication still needs its separate decision.",
+  "causalJudgment": "The retained trace attributes persistence of the restriction to a disproved premise.",
+  "action": {"state": "taken", "summary": "The authorized restriction was retired in the retained case.", "evidenceRefs": ["evidence/correction-action.md"]},
+  "effect": {"state": "unobserved", "summary": "No later natural opportunity has been observed.", "evidenceRefs": []}
+}
+```
+
+Put this object beside `verdict`, `causalStart`, `steering`, `uncertainty` and
+`evidenceRefs` in the existing disposition. Action states are `proposed` or
+`taken`; effect states are `unobserved` or `observed`. Every referenced artifact
+must be available locally; `taken` and `observed` each require evidence. These
+checks establish availability, not causal truth. The receipt retains evidence
+hashes and `assessment` identifies the actual queue actor, time and transition.
+`behavioralEffect` is the latest owner's reported effect, defaulting to
+`unobserved` for legacy dispositions. It is not an independent certification.
+A later owner submission preserves previous testimony. Record an observed
+effect only from a real later opportunity, with its next decision, useful work,
+recurrence and interruption burden; a scripted replay proves mechanics only.
+Closing a row, changing a prompt or clearing a numerical signal never supplies
+that evidence automatically. No opportunity means unobserved, with the release
+claim left to its decision owner. This guidance neither re-enables diagnosis nor
+assigns corrective work.
+
 ## Human delivery
 
 An assigned agent may explicitly request human escalation:

package/daemon/docs/reference/project-workspace.md

@@ -73,6 +73,29 @@ ownership receipt. A later seat start with no project-world input preserves it;
 an explicit install whose `install.skills` is empty clears it. This keeps
 "project not supplied" distinct from "project deliberately selects no skills."
 
+## TUI project selection
+
+Open **PROJECTS** (or enter `projects`) to choose an ID and root from the
+configured workspace catalog. `project <id>` selects an exact catalog entry;
+`mission <directory>` then opens that project's execution view. The historical
+`scopes` machine section ID remains valid. Project selection and its canonical
+root travel through mission, slice, source-file and Back navigation. Changing a
+catalog root requires selecting it again. Missing or malformed sources remain
+unavailable; another project's matching work ID is never a fallback.
+
+`source` opens the current project, mission or slice's actual source through the
+existing file-reader allowlist. Catalog membership does not grant file-read or
+execution permission. These views only read; they do not select a lifecycle
+operation or activate a mission. Execution and slice queue membership require
+an exact `project:<id>` tag; lifecycle instances use their authored project
+identity. Unscoped historical queue rows and global review artifacts without
+project binding are excluded from project-specific claims.
+
+The read API adds `GET /api/scopes/projects` and optional `project` and
+`projectRoot` parameters to scopes, execution and slice-detail reads. Slice
+detail also requires the selected mission directory. Existing reads without a
+project parameter keep their legacy contract.
+
 ## UI Mapping
 
 - `workspace.root` maps to the Project workspace.

package/daemon/docs/reference/scoped-operating-posture.md

@@ -0,0 +1,95 @@
+# Scoped operating posture
+
+Human-led work is quiet by default for process-only diagnosis. Delegated work can
+receive oversight during planning as well as implementation. This preference does
+not grant execution authority or change permissions, work phase, workflow reminders,
+context/continuity health, or health policy.
+
+## Inspect and choose
+
+Use the existing `rig mode` surface. Give an exact rig or authored work scope:
+
+```sh
+rig mode effective --rig my-rig --json
+rig mode effective --project my-project --mission release-1 --json
+rig mode effective --qitem my-packet --json
+rig mode set delegated --scope mission --qualifier my-project/release-1 --evidence "Operator delegated this outcome"
+# The proposal above exits 2 without writing. Apply the deliberate choice:
+rig mode set delegated --scope mission --qualifier my-project/release-1 --evidence "Operator delegated this outcome" --confirm
+rig mode set human-led --scope mission --qualifier my-project/release-1 --evidence "Return to interactive planning" --confirm
+rig mode unset mission my-project/release-1
+```
+
+Unsetting reveals the next applicable explicit choice, or the visible human-led
+product default. A new, resolved rig with no binding reports `human-led`,
+`source: product-default`, and `binding: null`. Missing scope identity, conflicting
+linkage, unavailable storage or malformed authored context reports `unknown` with
+a reason. Calling `effective` without a scope does not select a rig implicitly.
+The existing operator bearer requirement still applies. `set` requires `--confirm`;
+`unset` is an explicit deletion command and applies immediately.
+
+## One scope and phase contract
+
+`GET /api/rig-mode/effective` accepts `rig`, `project`, `mission`, `workstream`, and
+`qitem`. Its additive `operatingPosture` object is also attached to health records
+and diagnosis findings. CLI explanation and TUI health detail display the same data.
+Consumers of posture, phase, and health should use this object rather than invent
+another preference store or infer delegation from workflow existence or activity.
+
+| Field | Meaning |
+| --- | --- |
+| `posture` | `human-led`, `delegated`, or `unknown` |
+| `source` | `product-default`, `binding`, or `unknown` |
+| `context` | Resolved rig/project/mission/workstream/qitem IDs, source addresses, canonical authored paths and phase; null if scope resolution failed |
+| `context.phase` | `{value, source}` from an explicit workflow packet step, otherwise slice stage/status, otherwise mission release phase/status; null fields when unavailable |
+| `binding` | Winning binding ID, scope, timestamp and evidence citation; null for default/unknown |
+| `reason` | Explanation of the result or the missing/conflicting fact |
+| `grantsAuthority` | Always `false` |
+| `members` | For queue-backed findings, each member's qitem, posture, source and binding ID; differing or unknown member postures yield unknown aggregate posture |
+
+The existing SQLite mode-binding table remains the only preference store. Matching
+posture bindings resolve in this order: qitem, workstream, mission, project, rig,
+global host. The qualifiers are respectively a qitem ID, `project/mission/slice-id`,
+`project/mission`, project ID, canonical rig ID, and null. Rig names resolve to IDs.
+The workstream is an existing authored slice, found by its directory or SPEC ID;
+the returned identity uses its SPEC ID and project/mission qualification.
+
+Project selection reads `workspace.yaml`'s declared `projects: [{id, root}]`
+catalog, or the workspace's own `project.yaml` when no catalog exists. Multiple
+projects require an explicit project selection. A sole project may be derived.
+The project manifest validates identity and supplies `missions.root` (default
+`missions`). Mission and slice identities come from those authored work nodes;
+missing, duplicate or conflicting identities remain unknown. The selected work
+must stay inside its canonical project root.
+
+Qitem reads join explicit `project:`, `mission:`, `slice:`/`workstream:` tags,
+destination rig, and the existing workflow packet binding. Workflow lifecycle
+project/mission identity must agree with the tags and requested scope. The bound
+packet's exact step is the phase source; phase names are not classified by guess.
+An unlinked qitem does not silently inherit the default. Scope reads are observational.
+
+Legacy ergonomic modes (`sleep`, `desk`, `mobile`, `away`, `focus`, `debug`) retain
+their bindings and ten-field records. They do not imply either operating posture.
+Only human-led/delegated bindings participate in posture precedence. The legacy
+`effective` and `posture: known|unknown_posture` fields remain for compatibility;
+`unknown_posture` there means no legacy mode binding and does not override the
+new `operatingPosture.source: product-default` result. Setting another mode at the
+same scope replaces that row; inspect effective posture after any mode change.
+
+## Diagnosis effects
+
+Process-category findings remain visible under human-led or unknown posture, but
+new diagnosis presentations, re-presentations and human notifications require
+explicit delegated posture. Retained occurrences are not canceled or rewritten
+when posture changes. Their current finding is refreshed for inspection and
+notification; unavailable current findings cannot reuse old delegated posture.
+Notification admission is rechecked after readiness I/O.
+
+Delegation is necessary for process interruptions and is insufficient by itself:
+enabled diagnosis policy, detector selection, source freshness, custody, cooldown,
+recurrence limits and human delivery readiness still apply. Other health categories
+and ordinary queue/workflow reminders retain their existing behavior. The automatic
+ceremony source reads declared catalog projects through the same resolver; unresolved
+lineages remain visible with unknown scope instead of acquiring invented authority.
+
+See [health diagnosis](health-diagnosis.md) for policy, evidence and disposition.

package/daemon/specs/agents/shared/skills/core/messaging-the-human/SKILL.md

@@ -42,16 +42,44 @@ Check readiness: configured, enabled, active, ready, reason, and next action.
 `indeterminate` is not ready. Follow the reported next inspection; do not enable
 or reconfigure a connector merely to make the check pass.
 
-Write the decision, evidence, and continuation in a body file. The sole outbound
-human-message primitive is:
+Author for the person reading on a phone: a short subject in `--summary`, then
+one complete brief in `--body-file`. State why it matters, your recommendation
+and material tradeoff, the bounded action if approved, and the choice requested.
+For an update, state the user-visible outcome and “No action needed.” Aim for
+roughly 100–150 words; this is guidance, not a semantic validator. Keep technical
+continuation, exact candidate/revision and evidence on the owning agent row and
+in the durable artifact behind `--evidence-ref`. A local path is not a phone link
+and Markdown evidence files are not automatically attached.
+
+For example, a synthetic brief could say:
+
+> The repaired status view is ready. I recommend updating this instance; live
+> status will briefly pause. Sessions will be preserved. Approve this instance
+> update, or hold? Supporting test detail follows in this thread.
+
+This example grants no authority. Choose `--human-intent decision` for a request
+or `--human-intent update` for a quiet FYI. Omission retains legacy decision
+behavior; words such as “FYI” and tags do not change intent.
+
+The sole outbound human-message primitive is:
 
 ```bash
 rig queue create --destination <entityId>@external \
-  --summary "<decision or update>" --body-file <packet-file> \
+  --human-intent decision --summary "<short subject>" --body-file <brief-file> \
   --evidence-ref <durable-evidence> --verify --json
 ```
 
-If an existing agent-owned row must wait, block it on the **new live qitem ID**
+An optional `--human-detail-file <path>` supplies one coherent supplemental
+reply in the same thread. Announce its purpose in the brief; the product also
+marks that a detail reply follows. The primary must already contain the complete
+scope, options and action. Do not split an agent dump blindly or move the essential
+choice into overflow. Rendering checks every part and its accessibility fallback
+before posting; an oversized request is refused with a field-specific correction,
+never silently clipped. Shorten the brief or related detail as directed. Inspect
+the failed row, then deliberately cancel/replace the authored request if its
+content needs correction; a timeout alone is never a reason to replace it.
+
+If an existing agent-owned row must wait for a **decision**, block it on the **new live qitem ID**
 (`rig queue block <work-id> --on <human-qitem-id> ...`), not on the human address.
 Completion of the human qitem resumes its dependants. Blocking on the human as
 well would issue another notification for the same decision.
@@ -66,7 +94,14 @@ or blindly resend because verification timed out.
 rig queue transitions <qitem-id>
 ```
 
-A correlated reply binds to that exact human and qitem and records the resolution
+For `update`, confirmed complete delivery may close the delivery obligation.
+It creates no approval obligation and cannot be used as a decision blocker.
+Delivered updates remain queryable for Feed; a failure or ambiguous send stays
+separate. A root message alone does not prove supplemental delivery. Retries
+reconcile stable part identities and send only missing parts. An FYI reply is
+not a human decision.
+
+For a decision, a correlated reply binds to that exact human and qitem and records the resolution
 that resumes the owner. Check the recorded result before claiming the decision
 arrived; a delivery receipt alone is not acceptance.
 

package/dist/build-info.js

@@ -1,9 +1,9 @@
 // GENERATED by scripts/build-package.sh — the packaged build-identity stamp.
 export const BUILD_INFO = {
-  semver: "0.5.12",
-  commit: "b6c8d8f0444bc721d0ba4062a7384d25601c1c6f",
+  semver: "0.5.14",
+  commit: "cc75efdd17fb967bde7cff6c5805791986af78d8",
   dirty: false,
-  builtAt: "2026-09-09T12:31:47Z",
+  builtAt: "2026-09-14T22:11:49Z",
 };
 export function stampFields(info = BUILD_INFO) {
   if (!info.commit) return {};

package/dist/commands/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/commands/context.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqT9C,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAypBjE"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/commands/context.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAyL9C,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAysBjE"}

package/dist/commands/context.js

@@ -10,11 +10,12 @@
 // $OPENRIG_HOME/context/<name>/ — host-symlink-free contract,
 // matches `rig specs add` shape (regular files only; no symlinks).
 import { Command } from "commander";
-import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
-import { basename, extname, isAbsolute, join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
-import { ATOM_TAXONOMIES, TAXONOMY_TEACHING } from "@openrig/daemon/context-pack-taxonomy";
+import { assertSafeInstallRef, assertTreeHasNoSymlinks, assertDestinationNamespaceContained, validateContextPackManifestForInstall } from "../lib/context-install.js";
+import { addGitContext, inspectGitContext, updateGitContext } from "../lib/context-git.js";
 import { ConfigStore } from "../config-store.js";
 import { DaemonClient } from "../client.js";
 import { enumArg } from "../cli-error.js";
@@ -41,129 +42,15 @@ function printWorkInstallSelectors(result, topologySkills) {
     console.log(`skills  topology=${selectedIds(topologySkills, "(none)")}`);
     console.log(`skills  project=${selectedIds(result.skills, "(none)")}`);
 }
-// Slice-03 Atom 2 — mirror the daemon's per-segment ref contract at the
-// local install boundary. This must run before creating the context store.
 const SAFE_REF_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-// Slice-03 lineage repair (R2 HIGH-2): the install boundary mirrors the daemon
-// bounded, delimiter-free version token (ref-safety.SAFE_VERSION) so an unsafe
-// version is rejected BEFORE any local write — matching the per-segment ref
-// mirror above.
-const SAFE_INSTALL_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,31}$/;
-function assertSafeInstallRef(ref) {
-    const safe = ref.length > 0 &&
-        ref.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && SAFE_REF_SEGMENT.test(segment));
-    if (!safe) {
-        throw new Error(`unsafe install ref '${ref}' — a ref must be one or more '/'-separated segments, each matching ` +
-            `[A-Za-z0-9][A-Za-z0-9._-]{0,63} (no '.'/'..', no absolute path, no empty segment, no ` +
-            `whitespace or injection), so packs stay inside the context store root.`);
-    }
-}
 function assertSafeTopologySegment(kind, value) {
     if (value === "." || value === ".." || !SAFE_REF_SEGMENT.test(value)) {
         throw new Error(`unsafe ${kind} segment '${value}' — topology addresses require one bounded path segment`);
     }
 }
-function assertTreeHasNoSymlinks(root) {
-    const stack = [root];
-    while (stack.length > 0) {
-        const current = stack.pop();
-        for (const entry of readdirSync(current, { withFileTypes: true })) {
-            const absPath = join(current, entry.name);
-            if (entry.isSymbolicLink()) {
-                throw new Error(`Context pack directories must not contain symlinks: ${absPath}`);
-            }
-            if (entry.isDirectory())
-                stack.push(absPath);
-        }
-    }
-}
-// Slice-03 lineage repair (R2 HIGH-1): a lexically-safe path-like install ref
-// can still escape the store if one of its parent namespace segments is a
-// symlink (or a non-directory). Walk every ANCESTOR segment under the store root
-// and reject before the copy — the FS-canonical containment the lexical ref
-// check alone cannot give, mirroring the daemon compose namespace walk
-// (context-pack-library-service.ts). A not-yet-created segment (ENOENT) is safe:
-// cpSync will materialize it as a real directory.
-function assertDestinationNamespaceContained(targetRoot, installName) {
-    const segments = installName.split("/");
-    let cursor = targetRoot;
-    for (const segment of segments.slice(0, -1)) {
-        cursor = join(cursor, segment);
-        let stat;
-        try {
-            stat = lstatSync(cursor);
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                break;
-            throw err;
-        }
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            throw new Error(`unsafe install ref '${installName}' — its namespace segment '${cursor}' is a symlink or non-directory, ` +
-                `so the copy would escape the context store root. Remove it or install under a different --name.`);
-        }
-    }
-}
-// Kept in lockstep with the daemon parser's ALLOWED_FILE_SUFFIXES (manifest-parser.ts).
-// OPR.0.5.3.7 R2 added .sh/.ts (skill helper assets, served as text); the install
-// validator must accept what the daemon will serve.
-const ALLOWED_CONTEXT_PACK_SUFFIXES = new Set([".md", ".markdown", ".yaml", ".yml", ".txt", ".sh", ".ts"]);
-function validateContextPackManifestForInstall(manifestPath) {
-    let parsed;
-    try {
-        parsed = parseYaml(readFileSync(manifestPath, "utf-8"));
-    }
-    catch (err) {
-        throw new Error(`manifest at ${manifestPath} is not valid YAML: ${err.message}`);
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new Error(`manifest at ${manifestPath} must be a YAML object at the root`);
-    }
-    const obj = parsed;
-    if (typeof obj["name"] !== "string" || obj["name"].length === 0) {
-        throw new Error(`manifest at ${manifestPath} is missing required field 'name' (string)`);
-    }
-    if (obj["version"] === undefined || obj["version"] === null) {
-        throw new Error(`manifest at ${manifestPath} is missing required field 'version'`);
-    }
-    const versionStr = String(obj["version"]);
-    if (!SAFE_INSTALL_VERSION.test(versionStr)) {
-        throw new Error(`manifest at ${manifestPath} has an invalid version '${versionStr}' — a version must be a single bounded ` +
-            `token [A-Za-z0-9][A-Za-z0-9._+-]{0,31} (no ':' or separator, no whitespace, ≤32 chars).`);
-    }
-    // OPR.0.5.6.10 — teach the classification refusal at ADD time, not first
-    // daemon scan (desk ruling T2). Enum + teaching text imported from the
-    // daemon's one definition site; never a second value list here.
-    const taxonomy = obj["taxonomy"];
-    if (taxonomy === undefined || taxonomy === null) {
-        throw new Error(`manifest at ${manifestPath} is missing required field 'taxonomy' — every context pack declares what kind of context it is. ${TAXONOMY_TEACHING}`);
-    }
-    if (typeof taxonomy !== "string" || !ATOM_TAXONOMIES.includes(taxonomy)) {
-        throw new Error(`manifest at ${manifestPath} has invalid taxonomy ${JSON.stringify(taxonomy)}. ${TAXONOMY_TEACHING}`);
-    }
-    const files = obj["files"];
-    if (!Array.isArray(files)) {
-        throw new Error(`manifest at ${manifestPath} must declare 'files: [...]'`);
-    }
-    for (let i = 0; i < files.length; i++) {
-        const entry = files[i];
-        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-            throw new Error(`manifest at ${manifestPath} has malformed entry at files[${i}]`);
-        }
-        const file = entry;
-        const relPath = file["path"];
-        if (typeof relPath !== "string" || relPath.length === 0) {
-            throw new Error(`manifest at ${manifestPath} files[${i}] missing 'path' (string)`);
-        }
-        if (relPath.includes("..") || isAbsolute(relPath) || relPath.startsWith("\\")) {
-            throw new Error(`manifest at ${manifestPath} files[${i}].path '${relPath}' must be a relative path inside the pack (no '..' segments, no leading '/')`);
-        }
-        if (!ALLOWED_CONTEXT_PACK_SUFFIXES.has(extname(relPath))) {
-            throw new Error(`manifest at ${manifestPath} files[${i}].path '${relPath}' has an unsupported suffix; allowed: ${Array.from(ALLOWED_CONTEXT_PACK_SUFFIXES).join(", ")}`);
-        }
-        if (typeof file["role"] !== "string" || file["role"].length === 0) {
-            throw new Error(`manifest at ${manifestPath} files[${i}] missing 'role' (string)`);
-        }
+function assertLocalGitClient(client) {
+    if (!["127.0.0.1", "localhost", "[::1]"].includes(new URL(client.baseUrl).hostname)) {
+        throw new Error("Run Git source selection/inspection/update on the daemon host through its loopback URL; these commands use local Git and filesystem paths.");
     }
 }
 function isHttpUrl(source) {
@@ -842,9 +729,12 @@ Examples:
         }
     });
     cmd.command("add")
-        .argument("<source>", "Local directory OR http(s):// URL of a context pack (manifest.yaml + files)")
-        .description("Install a context pack from a local directory or a URL into the configured context library")
+        .argument("<source>", "Pack directory/manifest URL, or Git repository path/URL with --git")
+        .description("Install a pack; --git discovers a pack in a Git repository and retains its update relationship")
         .option("--name <name>", "Override the install name (defaults to the manifest name / source basename)")
+        .option("--git", "Clone a Git repository path/URL with existing Git credentials; select a pack snapshot")
+        .option("--checkout", "With --git, select an existing checkout instead of cloning; updates may merge in it")
+        .option("--pack <path>", "With --git, select a repository-relative pack; default discovers manifest.yaml or .openrig/context-packs")
         .option("--json", "JSON output")
         .action(async (source, opts) => {
         try {
@@ -852,7 +742,15 @@ Examples:
             // never a hardcoded ~/.openrig literal; the daemon resolves the same key.
             const targetRoot = new ConfigStore().resolve().context.root;
             let targetDir;
-            if (isHttpUrl(source)) {
+            let gitSelection;
+            if ((opts.pack || opts.checkout) && !opts.git)
+                throw new Error("--pack and --checkout require --git.");
+            if (opts.git) {
+                const gitClient = await getClient();
+                assertLocalGitClient(gitClient);
+                ({ installedAt: targetDir, selected: gitSelection } = addGitContext(source, opts, targetRoot));
+            }
+            else if (isHttpUrl(source)) {
                 // R4 — URL install: fetch → validate → atomic stage+rename (no partial pack).
                 ({ targetDir } = await installPackFromUrl(source, opts.name, targetRoot));
             }
@@ -914,11 +812,16 @@ Examples:
             if (syncError) {
                 throw new Error(`Installed at ${targetDir}, but daemon rejected the pack during sync: ${syncError.error}`);
             }
+            if (gitSelection && !syncRes.data.entries.some((entry) => resolve(entry.sourcePath) === resolve(targetDir))) {
+                throw new Error(`Git selection retained at ${targetDir}, but this daemon does not serve it. Check context.root and workspace ref precedence before using it.`);
+            }
             if (opts.json) {
-                console.log(JSON.stringify({ installedAt: targetDir, count: syncRes.data.count }, null, 2));
+                console.log(JSON.stringify({ installedAt: targetDir, count: syncRes.data.count, ...(gitSelection ? { gitSource: gitSelection } : {}) }, null, 2));
             }
             else {
                 console.log(`Installed at ${targetDir}. Library now has ${syncRes.data.count} context pack(s).`);
+                if (gitSelection)
+                    console.log(`Git ${gitSelection.revision} from ${gitSelection.checkout}; inspect/update with rig context source.`);
             }
         }
         catch (err) {
@@ -926,6 +829,45 @@ Examples:
             process.exitCode = 1;
         }
     });
+    const source = cmd.command("source")
+        .description("Inspect Git checkout vs served context, or explicitly fetch/merge and select an update")
+        .addHelpText("after", "\nStart: rig context add <repository-path-or-URL> --git [--pack path]\nEdit/commit in the reported checkout with ordinary Git. Updates never push or reset.\nConflicts retain the old selection; resolve/commit or abort in the checkout before retrying.\nSelection does not prove agent consumption; use context get and check the actual consumer.\n");
+    for (const operation of ["inspect", "update"]) {
+        source.command(operation)
+            .argument("<ref>", "Selected Git-backed context pack ref")
+            .description(operation === "inspect"
+            ? "Read local revision, edits, conflicts and selection; no fetch or consumption claim"
+            : "Explicitly fetch/merge the upstream, then select the clean pack; refuse local selection edits")
+            .option("--json", "JSON output")
+            .action(async (ref, opts) => {
+            try {
+                const client = await getClient();
+                assertLocalGitClient(client);
+                const entry = await resolvePack(client, ref);
+                const localRoot = new ConfigStore().resolve().context.root;
+                if (resolve(entry.sourcePath) !== resolve(localRoot, entry.relativePath))
+                    throw new Error("This pack is not in the locally configured context library. Run Git source commands on its owning instance.");
+                if (entry.sourceType === "builtin")
+                    throw new Error("Builtin context is not a writable Git selection.");
+                const result = operation === "inspect" ? inspectGitContext(entry.sourcePath) : updateGitContext(entry.sourcePath);
+                if (operation === "update") {
+                    const sync = await client.post("/api/context-packs/library/sync");
+                    if (sync.status !== 200)
+                        throw new Error(`Selection updated, but library sync failed (HTTP ${sync.status}); run rig context sync.`);
+                    if (!sync.data.entries.some((candidate) => resolve(candidate.sourcePath) === resolve(entry.sourcePath)))
+                        throw new Error(`Selection retained, but the daemon cannot serve it: ${sync.data.errors?.map((error) => error.error).join("; ") || "check context root and ref precedence"}`);
+                }
+                // Structured output keeps checkout/selected bytes/consumption distinct
+                // in both terminal and machine use, without a second status renderer.
+                console.log(JSON.stringify(result, null, 2));
+            }
+            catch (err) {
+                const message = err.message;
+                console.error(opts.json ? JSON.stringify({ error: message }) : message);
+                process.exitCode = 1;
+            }
+        });
+    }
     cmd.command("rm")
         .argument("<ref>", "Path-like ref of the context pack to remove (e.g. packs/compaction-restore)")
         .description("Remove a context pack from the library by its path-like ref")