@openrig/cli 0.5.16 → 0.6.0

package/daemon/docs/reference/getting-started.md

@@ -5,6 +5,12 @@ Start with a repository and one bounded change you can exercise. The shipped
 an independent checker. It uses your installed Codex executable and login;
 terminal-provider support does not change the harness or account being used.
 
+You need Node.js 22 or 24 and tmux, on macOS or Linux. On a Mac with Apple
+silicon, use Node.js 22 (see the [compatibility
+history](../releases/v0.5.15.md#known-compatibility-limitation)). Native
+Windows is not supported yet, and WSL2 has not been tested. Node 20 is no longer
+supported; Node 26 and other versions are untested.
+
 **Choose permissions before starting the team.** The unchanged starter launches
 Codex with `-s workspace-write`; it leaves approval policy to your native Codex
 configuration. Network access is normally off in that sandbox, including access
@@ -314,11 +320,12 @@ rig up ./openrig-specs/rigs/launch/first-project/rig.yaml --cwd . --plan
 rig up ./openrig-specs/rigs/launch/first-project/rig.yaml --cwd .
 ```
 
-OpenRig's separate `permission_policy: builtin:yolo` setting passes only
-`-s danger-full-access` to Codex, **without an approval flag**, and replaces the
-named-profile argument. It does not mean `approval_policy = "never"`. A standalone
-`codex --yolo` command is not an OpenRig launch setting. Use the profile recipe
-above when you want to choose both controls explicitly.
+OpenRig's `permission_policy: builtin:yolo` setting selects
+`-s danger-full-access -a never` on fresh, resume and fork launches, replacing
+the named-profile argument. The profile recipe above remains useful when you
+want to maintain those choices in native configuration. The legacy
+environment-only `OPENRIG_YOLO=1` path remains sandbox-only when no resolved
+policy is present. A standalone `codex --yolo` command is not an OpenRig setting.
 
 To return to a restricted next launch, change the selected profile to:
 
@@ -330,6 +337,57 @@ approval_policy = "on-request"
 network_access = false
 ```
 
+### Per-seat permission mode
+
+Permission mode is the native execution choice; work posture is project guidance.
+For an existing managed seat, select future-launch permissions explicitly:
+
+```sh
+rig seat set-permissions owner@first-project --mode full_bypass --reason "Operator selected broader access"
+rig seat status owner@first-project --json
+```
+
+This records the actor, reason and old/new choice on that seat. It does not
+relaunch it, alter native history, change sibling seats, or edit permission
+rules/hooks. A later lifecycle action remains a separate decision. The explicit
+seat choice overrides the inherited member/rig policy; `--mode inherit` clears
+it without changing that inherited policy. `floor` selects the existing normal
+launch path (including a Codex named profile when configured); it does not
+rewrite a native profile or force its approval settings.
+
+Codex and Claude accept `floor` and `full_bypass`. Additional Claude native modes,
+including `auto`, require support advertised by the managed executable's help.
+OpenRig resolves the first executable on its managed launch PATH at the seat's
+absolute working directory, then uses that exact path for discovery and launch.
+It does not use interactive shell aliases or a shell's modified PATH. Relative
+PATH entries and a relative `CLAUDE_CONFIG_DIR` resolve from the seat directory.
+
+For these explicit native modes, fresh, resume, fork and legacy restore use the
+same managed environment: PATH, HOME, `CLAUDE_CONFIG_DIR` (default HOME/.claude)
+and the configured classic-renderer setting. Other shell customizations are
+excluded. The existing managed identity and allowlisted provider-auth channel
+is retained by variable name; credentials are not copied into launch commands
+or capability evidence. Help runs without that credential channel. Existing
+login files remain under the managed home. Configure the daemon's managed
+launch environment deliberately before selecting a mode; this is not a probe
+of an arbitrary interactive shell.
+
+Each selection and each later launch checks support again, without a cache.
+A changed node/occupant, binding, cwd, executable or capability environment
+refuses at the next check: after help, before selection/audit mutation, and
+immediately before paste and Enter. A failure after a valid paste is partial
+input, not a successful launch or a claim that earlier input was rolled back.
+An existing explicit selection is retained on refusal; no fallback is chosen.
+Ordinary and inherited launch paths are unchanged. The status response
+distinguishes desired settings, generation-bound
+launch arguments and an unverified native effect. Inspect the native session
+after an authorized launch before claiming its actual permission behavior.
+
+The rig-level verbs are `rig policy permissions list`, `show`, `current` and
+`apply`. Existing `rig policy list/show/current/apply` remain compatibility
+aliases with the same JSON and exit behavior. Pi resource trust and the per-seat
+typing guard are separate controls.
+
 ### Claude Code: a different launch flag
 
 The shipped `first-project` uses Codex. For a user-owned **Claude Code** rig,

package/daemon/docs/reference/rig-spec.md

@@ -203,9 +203,14 @@ into your project and edit it to taste.
 This records a selection, not a live permission change. Flag-surface policies
 select launch flags; config-surface policies still need native configuration
 application and inspection. In particular, `builtin:yolo` selects Codex's
-`danger-full-access` sandbox without forcing its approval policy, and replaces
+`danger-full-access` sandbox and `never` approval policy, and replaces
 any `codex_config_profile` argument. See [practical permission choices](getting-started.md#opt-in-permissive-operation).
 
+An explicit `rig seat set-permissions` choice overrides member/rig policy for
+future managed launches of that stable seat; it does not rewrite this spec or
+its inherited policy provenance. `inherit` removes that override. See
+[per-seat permission mode](getting-started.md#per-seat-permission-mode).
+
 ### Choosing the Claude instruction file
 
 OpenRig writes its instructions for Claude Code members into managed blocks in

package/daemon/docs/reference/slack-app-setup.md

@@ -0,0 +1,90 @@
+# Create your own Slack app for OpenRig (experimental)
+
+> **Experimental in 0.6.0.** The manifest (`rig slack manifest`) and this setup guide are new
+> and have not been confirmed against a real app creation. The Slack connector itself and its
+> `setup`, `verify`, `enable`, `disable` and `status` commands are not experimental. If a step
+> here does not match what Slack shows you, please
+> [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose) or send a pull request
+> ([CONTRIBUTING.md](../../CONTRIBUTING.md)).
+
+OpenRig's Slack connector talks to a Slack app that you create in your own workspace. OpenRig
+ships the app's manifest; it does not host an app, run an install endpoint, or publish anything
+to the Slack Marketplace. The app is a Socket Mode app, so it lives in the one workspace you
+create it in.
+
+`rig slack manifest` prints the manifest. It works offline, before any daemon or token exists:
+
+```bash
+rig slack manifest          # the manifest as YAML
+rig slack manifest --url    # Slack's create-app link with the manifest prefilled
+rig slack manifest --json   # the manifest, its scopes and events, and why each scope is requested
+```
+
+The TUI shows the same link on the Connections page while Slack is not configured. Neither the
+CLI nor the TUI opens a browser, accepts tokens, or creates an app.
+
+## Steps
+
+These are the expected steps, based on Slack's app-manifest documentation. They have not yet
+been confirmed against a real creation run. Slack's form may ask for something the prefill did
+not fill in; if so, follow the form.
+
+1. Open the link from `rig slack manifest --url` in a browser.
+2. Sign in to Slack if asked, pick the workspace, review the prefilled manifest, and click
+   **Create**.
+3. Under **Socket Mode**, confirm it is enabled. Enable it if it is not.
+4. Under **Basic Information → App-Level Tokens**, generate a token with the
+   `connections:write` scope and copy it (it starts with `xapp-`).
+5. Install the app to the workspace and approve the requested scopes.
+6. Under **OAuth & Permissions**, copy the **Bot User OAuth Token** (it starts with `xoxb-`).
+7. Put both tokens in a private env file readable only by you (`chmod 600`):
+
+   ```bash
+   SLACK_BOT_TOKEN=xoxb-...
+   SLACK_APP_TOKEN=xapp-...
+   ```
+
+8. Run `rig slack setup --channel <channel-id> --secrets-env-file <path>`, then
+   `rig slack verify`, then `rig slack enable`.
+9. Invite the bot to the channel you configured (`/invite @OpenRig` in that channel).
+
+## What the app asks for
+
+Run `rig slack manifest --json` for the exact list and the reason for each scope. There are two
+groups:
+
+- **Baseline scopes**: posting messages, reading message history in public channels the app is
+  a member of, and reading channel details.
+  `rig slack verify` checks these.
+- **Feature scopes**: `files:read` (download attachments people send), `files:write` (upload
+  attachments to Slack), and `app_mentions:read` (receive @-mentions of the app). `rig slack verify`
+  does **not** check these, so a READY from verify does not prove attachments or mentions will
+  work.
+
+If a feature scope was not granted, the effect differs by feature:
+
+- **Attachments** (`files:read`, `files:write`): the file download or upload call fails. A
+  message with an attachment that could not be downloaded is still delivered, with the failed
+  file named in it. A post whose attachment could not be uploaded still delivers its text, and
+  the failure appears only in the daemon log (`rig daemon logs`).
+- **Mentions** (`app_mentions:read`): Slack does not deliver `app_mention` events to the app, and
+  nothing in OpenRig reports that they are missing.
+
+So after installing, compare the granted scopes Slack shows for the app with all six scopes that
+`rig slack manifest --json` lists.
+
+The app subscribes to messages in public channels it is a member of (`message.channels`) and to
+mentions of the app (`app_mention`). It does not request direct-message or private-channel access.
+
+## What the connector does with the tokens
+
+The tokens stay in the env file you created. The connector reads them from that file and uses them
+to authenticate to Slack: it opens an outbound Socket Mode connection with the app-level token and
+calls Slack's Web API with the bot token. This connector has no OpenRig-hosted component and
+makes outbound connections only. That statement is about this Slack connector, not about every
+part of OpenRig.
+
+## Next
+
+- `rig slack status` shows what is still missing, without contacting Slack.
+- `rig slack verify` checks the granted baseline scopes and channel membership with Slack.

package/daemon/docs/reference/stream-classifier-worker.md

@@ -0,0 +1,244 @@
+# Occupant-owned stream classification and shadow capture (experimental)
+
+> **Experimental in 0.6.0, optional and off by default.** The Jev classification path and shadow
+> capture may be incomplete or not work, and no accuracy or production-reliability claim is
+> made. OpenRig's delivery, watchdog and routing decisions do not use their output. If they do
+> not behave as described here, please
+> [open an issue](https://github.com/mvschwarz/openrig/issues/new/choose) or send a pull request
+> ([CONTRIBUTING.md](../../CONTRIBUTING.md)).
+
+This source provides a bounded receiver for one real classifier occupant. It does
+not start an agent, register a watchdog job, or enable capture by default.
+Taxonomy, questions and decisions belong to the occupant; the daemon supplies
+source facts and enforces its existing lease, execution and idempotency fences.
+An explicit optional Jev mode supplies advisory decisions through the same worker.
+Experimental labels have no demonstrated accuracy or calibrated confidence and
+do not replace delivery, watchdog, or routing decisions.
+
+## Optional foreground Jev experiment
+
+With no configuration, the experiment is off. Choose an explicit local JSON path
+in an existing private directory; the file contains only enabled state and bounds:
+
+```sh
+rig project experimental status --config ./experiment.json --json
+rig project experimental enable --config ./experiment.json --max-requests 3 --timeout-ms 10000 --json
+rig project experimental disable --config ./experiment.json --json
+```
+
+Enable does not start processing, capture, a daemon or an agent. Status and disable
+make no provider request. The invoking process needs `OPENROUTER_API_KEY` in its
+environment for an enabled run; this entry never searches credential files or
+copies credentials into configuration. Missing credentials fail before attempts
+or provider work. Normal key provisioning remains with the operator.
+
+The selected route is `https://openrouter.ai/api/alpha/decisions`, pinned to
+`typesafe/jev-1.13`, without provider fallback or HTTP redirects. A request declares
+maximum provider prices of $0.05 per million prompt tokens, zero completion and
+request price. These are admission ceilings, not a price quote, spend estimate or
+credential-access claim. Each foreground run allows 1–20 requests (default 3),
+each with a 1–30 second deadline (default 10), 24 KiB request and 256 KiB response
+limits. Failed requests consume their count. Nothing retries in the background.
+
+To process stream items from the actual selected occupant:
+
+```sh
+rig project wake --project PROJECT --taxonomy ./taxonomy.yaml \
+  --classifier-version experimental-jev-1.13 --evidence-epoch OWNER_EPOCH \
+  --limit 3 --experiment ./experiment.json --json
+```
+
+Use the taxonomy format described below. Each criterion must have a nonempty
+string description; `__unknown__` is reserved. Questions stay outside the daemon.
+The request sends the selected item's body, supplied taxonomy questions/criteria,
+canonical scope IDs and current roster destinations to OpenRouter. Select inputs
+appropriate for that external processing. It does not transmit the credential
+in evidence or store it in the classification. The output binds current source,
+taxonomy, candidate version, lease, occupant generation and attempt execution.
+No action or confidence label is inferred. Duplicate judgment remains manual.
+
+The smaller of `--limit` and the configured request maximum bounds the wake.
+Unknown answers remain null; a wholly unknown answer abstains. Invalid model,
+provider, answer keys, choices, probabilities or response bytes reject the whole
+answer. Probability sums retain the strict 0.001 tolerance; there is no rounding
+repair or partial salvage. Unavailable/invalid provider work stops that run with
+no classification write. Inspect the returned attempt state: terminal abstentions
+are not reopened, and failed/unknown daemon writes must be reconciled through the
+existing ledger. Never change the evidence epoch merely to retry an experiment.
+
+Disable is checked before each call and before applying its result. A separate
+disable command cannot cancel an already forwarded remote request; its late
+result is discarded, with the existing deadline bounding the wait. Ctrl-C or
+SIGTERM requests immediate cancellation of the foreground run. An uncooperative
+request remains reported pending and cannot cause a late write or a second call
+in that run. Remote cancellation or refund is not proven by local cancellation.
+The command registers no wake, returns no automatic continuation, and requires
+an explicit later invocation to do more work.
+
+For selected observations from an existing shadow archive:
+
+```sh
+rig project experimental capture --config ./experiment.json \
+  --input ./selected-shadow.jsonl --output ./new-advisory-results.jsonl --json
+```
+
+This reads at most 8 MiB and considers only the first configured maximum number
+of records. It never captures a terminal. The input remains unchanged; output is
+exclusively created at mode 0600. Keep prior output and choose another filename
+only for a deliberately selected new run. It sends captured post-screen text to
+the same provider, and retains the original attempt/node/occupant/pane binding and
+capture hash beside the answer. Missing capture or binding is unavailable and
+makes no provider call. State answers are experimental hints; delivery remains
+`INDETERMINATE` because screen text cannot prove submitted/consumed/effect and the
+archive does not retain the original sent text. No result feeds back into live
+transport or inventory. Failed runs preserve already written output; inspect
+`unavailable`, `remaining`, call count and stop reason rather than treating a file
+as proof of success.
+
+## One bounded wake
+
+From the selected occupant, read candidates using the configured project ID:
+
+```sh
+rig project candidates --project PROJECT --taxonomy /private/taxonomy.yaml \
+  --classifier-version VERSION --evidence-epoch OWNER_EPOCH --limit 20 --json
+```
+
+The result includes eligible stream IDs, authored scope IDs with exact source
+paths/hashes, the current running roster of the occupant's rig, observation time,
+and a candidate version. Taxonomy YAML supplies `version` and
+`fields.{kind,urgency,maturity,area}` with a `question` and `values` mapping. These
+questions are returned to the occupant; draft values are not verified truth.
+Confidence has no selectable values until calibration selects that contract.
+Destination choices are the current roster sessions plus explicit `pool`.
+Null/omitted destination remains unknown; it is not converted into `pool`.
+The candidate hash binds the selectable values as well as source and taxonomy
+hashes. Packets prepared before this pool correction require fresh preparation;
+it does not reopen historical attempts or change the evidence epoch.
+
+Read each eligible item with `rig stream show ITEM --json`. Duplicate candidates
+are the latest 100 nonarchived items with exact body-hash evidence references;
+their preview is capped at 2,000 characters and marked when truncated. Read the
+complete candidate before selecting a duplicate. A retrieval miss means unknown.
+Directory names, issue IDs and bare membership never supply scope IDs. Source
+errors are explicit, and partial source snapshots cause abstention.
+
+Write an occupant-owned decision file (at most 100 unique item IDs, at most 1 MiB):
+
+```json
+{
+  "candidateSetVersion": "sha256:<version returned by candidates>",
+  "decisions": [{
+    "streamItemId": "<eligible ID>",
+    "bodyHash": "sha256:<SHA256 of the exact UTF-8 item body>",
+    "decision": { "kind": "classify", "labels": {
+      "classificationType": "<selected taxonomy value>",
+      "scopeRef": "<selected canonical mission or slice ID>",
+      "needsHuman": null
+    }}
+  }]
+}
+```
+
+An explicit abstention is `{"kind":"abstain","reason":"why unknown"}`. Other
+label keys are `classificationUrgency`, `classificationMaturity`,
+`classificationDestination`, `area`, and `classificationConfidence`. Omitted or
+null labels stay unknown. A duplicate needs both `duplicateOfStreamItemId` and
+the matching `duplicateEvidenceRef` from the candidates, plus occupant judgment
+that it really is a duplicate. An existing item alone is not that judgment.
+
+```sh
+rig project wake --project PROJECT --taxonomy /private/taxonomy.yaml \
+  --classifier-version VERSION --evidence-epoch OWNER_EPOCH --limit 20 \
+  --decisions /private/decisions.json --json
+```
+
+This command actually invokes one `StreamClassificationWorker.wake()` through
+the existing HTTP services. It derives sender identity through `DaemonClient`,
+requires a current running occupant, and carries the captured generation through
+each lease/attempt/classification request. It never invents a daemon holder.
+Existing direct HTTP callers keep their documented sender-provenance behavior.
+
+The command refreshes source candidates before acquiring a lease. Missing or
+stale decision packets return unavailable without starting attempts; refresh
+preparation if the roster, scopes, taxonomy or recent stream changed. During a
+wake, an item with no exact body-bound decision, missing sources, or a selected
+candidate that is unavailable abstains. This is deliberately strict; continuous
+source churn can require repeated preparation and is not a throughput claim.
+
+Each wake processes at most `--limit` items (1–100; default 20), starting with the
+oldest eligible work rather than relying on a lossy notification cursor. Durable
+terminal attempts stay excluded. A new candidate version does **not** authorize
+another pass: only an owner-selected evidence epoch changes that attempt identity.
+Retain the candidates output beside the decisions and result so its version is
+reproducible. The CLI does not keep a second local ledger.
+
+The result carries per-item outcomes, `moreEligible`, `nextWakeAt`, and a watchdog
+`wakeRequest` descriptor with the real session/generation and a receiving
+instruction. `registered:false` is literal. A periodic-reminder message asks the
+occupant to prepare and run this entry; delivery of that message is not execution.
+Registration/placement remains an explicit later action. Honor `nextWakeAt`:
+lease maintenance uses TTL/3 opportunities; lease loss or an unavailable service
+backs off 60 seconds. The daemon's retry/exhaustion ledger remains authoritative.
+The ordinary client bounds each request at five seconds; a timed-out write has
+an unknown outcome until the ledger is read, and is never reported as written.
+
+There is no provider in the manual-decision path. The reusable asynchronous worker has one
+pending classifier slot; timeout requests cancellation but cannot force it. An
+uncooperative classifier blocks further calls in that instance and late results
+cannot write. That in-memory pending slot is not cross-process cancellation.
+
+## Separate bounded shadow drain
+
+The production transport and inventory probes accept the same optional observer.
+They record only captures already taken, with the node, occupant, pane and capture
+target bound before awaits. The ordinary cheap inventory path still takes no
+capture. Retained-no-write is a separate event, never delivery evidence.
+
+Activation requires explicitly supplied `OPENRIG_SHADOW_CAPTURE` JSON at a later
+authorized daemon start. Absence or invalid configuration leaves capture disabled.
+This document supplies no live destination or activation instruction. Required
+fields and engineering ceilings are:
+
+| Field | Meaning | Maximum |
+|---|---|---|
+| `destination` | New absolute JSONL file in a canonical, current-user-owned 0700 directory | Explicit path |
+| `maxRecords` | Total reserved sink records | 100,000 |
+| `maxBytes` | Total reserved sink bytes, including newlines | 1 GiB |
+| `capacity` | Queued observation count | 1,000 |
+| `maxQueuedBytes` | Serialized bytes waiting in the queue | 8 MiB |
+| `maxObservationBytes` | Serialized bytes per observation | 1 MiB |
+
+All numeric fields are required positive safe integers. These are engineering
+capacity limits, not approved corpus sizes or classification thresholds. One
+in-flight drain can hold up to 64 additional observations, bounded by the queue's
+byte allowance; queue plus drain can therefore retain up to twice that allowance.
+The standalone observer defaults are 256 entries, 4 MiB queued and 256 KiB per
+observation; explicit production configuration supplies each value.
+
+`rig project shadow-status` only inspects configuration/counters.
+`rig project shadow-drain` asks the existing HTTP service to drain up to 64 rows;
+it requires an actor and never enables capture. No background drain timer is added.
+`rig project shadow-stop` disables new enqueueing immediately, finishes any active
+drain and the finite retained queue, then closes the sink. Repeated stop is
+idempotent; it cannot enable capture or delete the existing archive. Existing
+quota and sink-failure losses remain counted. A slow disk can leave stop pending;
+inspect status after a client timeout instead of assuming the flush completed.
+Enabling capture again requires a separately authorized daemon start with a new
+destination; enabling the local provider experiment does not enable capture.
+The file is exclusively created with mode 0600. An existing file is refused,
+never overwritten, appended, rotated or deleted. A restart requires a new selected
+destination. Private-file creation currently requires POSIX ownership support.
+
+The hot path only performs bounded synchronous enqueue work; it never awaits disk
+or drain completion. Slow sinks leave one drain pending; concurrent drains do not
+start another writer. Overflow drops new observations. Capacity exhaustion stops
+the sink. Errors stop writes, count losses and preserve any partial file; failed
+batches are not replayed. `reservedRecords/Bytes` include attempted writes, while
+`completedRecords/Bytes` count successful appends. `drained` means removed from
+the observer, not necessarily persisted. Queue count drops, byte-bound drops,
+record errors, missing/unavailable captures and sink failures remain separate.
+
+Live collection, private destination/retention selection, corpus labels, hosted
+calibration, native placement, package/install proof and independent visible /
+submitted / consumed / effect evidence remain outside this source entry.

package/daemon/policies/builtin/yolo.policy.md

@@ -4,16 +4,16 @@ name: yolo
 surface: flag
 launch_posture: full_bypass
 policy_schema_version: 1
-description: Permissive launch opt-in. Claude skips permission prompts; Codex selects danger-full-access but retains native approval policy. Pi enables resource trust.
+description: Permissive launch opt-in. Claude skips permission prompts; Codex selects danger-full-access and never approval policy. Pi enables resource trust.
 ---
 
 # YOLO (built-in policy — flag surface)
 
 This built-in selects Claude `--dangerously-skip-permissions`, Codex
-`-s danger-full-access`, or Pi `--approve` (resource trust). Codex receives no
-approval flag and no named-profile argument on this path: its native approval
-settings still apply. This is not a universal promise that nothing prompts or
-is denied. Use only for work and an environment you deliberately trust.
+`-s danger-full-access -a never`, or Pi `--approve` (resource trust). Codex receives
+no named-profile argument on this path. These are launch arguments; native
+managed restrictions still matter. Use only for work and an environment you
+deliberately trust.
 
 **APPLICATION is deterministic, NOT skill-translated.** YOLO is a `surface: flag`
 policy: it resolves to a stable launch flag and is applied directly by the runtime

package/daemon/specs/rigs/launch/kernel/rig.yaml

@@ -1,6 +1,10 @@
 version: "0.2"
 name: kernel
 summary: >
+  Library preview of the default dual-runtime template, not the running kernel.
+  Automatic first boot selects the Claude-only, Codex-only or dual-runtime variant
+  from available authenticated runtimes. Check the current seats with
+  `rig ps --nodes --rig kernel`; the managed rig's spec shows its selected topology.
   Class-of-one always-on rig: advisor pilots user intent, operator runs
   OpenRig itself, queue worker classifies stream-to-queue substrate.
   Auto-boots on first rig daemon start (V0.3.1 slice 05). On

package/dist/build-info.js

@@ -1,9 +1,9 @@
 // GENERATED by scripts/build-package.sh — the packaged build-identity stamp.
 export const BUILD_INFO = {
-  semver: "0.5.16",
-  commit: "5c5470303518a2142a7cb673b08414c0f73d3d3e",
+  semver: "0.6.0",
+  commit: "57380a250e797c182a336e97afe2e0edb841ba9c",
   dirty: false,
-  builtAt: "2026-09-26T09:11:46Z",
+  builtAt: "2026-09-28T21:18:35Z",
 };
 export function stampFields(info = BUILD_INFO) {
   if (!info.commit) return {};

package/dist/commands/config-init-workspace.js

@@ -1,7 +1,7 @@
 // Public adapter for the S01 project-workspace owner used by S05 instance
 // initialization. The bytes and behavior live in @openrig/daemon.
 import { Command } from "commander";
-import { ensureDefaultWorkspace, workspaceScaffoldDirs, workspaceScaffoldFiles, } from "@openrig/daemon/instance-initialization";
+import { ensureDefaultWorkspace, workspaceScaffoldDirs, workspaceScaffoldFiles, } from "../../daemon/dist/instance-initialization-surface.js";
 import { ConfigStore } from "../config-store.js";
 export { workspaceScaffoldDirs, workspaceScaffoldFiles };
 export function initWorkspaceCommand(configPath) {

package/dist/commands/context.js

@@ -21,7 +21,7 @@ import { DaemonClient } from "../client.js";
 import { enumArg } from "../cli-error.js";
 import { getDaemonStatus, getDaemonUrl, statusGuardMessage } from "../daemon-lifecycle.js";
 import { resolveWorkPosition } from "../lib/work-install.js";
-import { reconcileSkillLoadout, resolveSkillLoadout, } from "@openrig/daemon/skill-loadout";
+import { reconcileSkillLoadout, resolveSkillLoadout, } from "../../daemon/dist/skill-loadout-surface.js";
 import { realDeps } from "./daemon.js";
 const contextRuntimeArg = enumArg(["claude-code", "claude", "codex"]);
 function selectedIds(ids, none) {
@@ -675,7 +675,7 @@ Examples:
         .requiredOption("--file <path>", "Markdown file containing the recap content")
         .action(async (opts) => {
         try {
-            const { writeSeatRecap, validateRecapContract, listRecapChain } = await import("@openrig/daemon/seat-recap-store");
+            const { writeSeatRecap, validateRecapContract, listRecapChain } = await import("../../daemon/dist/seat-recap-store-surface.js");
             const content = readFileSync(opts.file, "utf-8");
             const store = new ConfigStore();
             const topologyRoot = String(store.resolveWithSource("topology.root").value);

package/dist/commands/crash-cart.js

@@ -42,7 +42,7 @@ function existsOrThrow(path) {
  * emit/detector/read cores.
  */
 async function realEmit() {
-    const cc = await import("@openrig/daemon/crash-cart");
+    const cc = await import("../../daemon/dist/crash-cart-surface.js");
     const home = openrigHome();
     const openrigUrl = process.env.OPENRIG_URL;
     const probeClassified = (url) => cc.probeHealthz(url, { fetch: (u, init) => fetch(u, init), timeoutMs: 700 });

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAYjD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC1C,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjF;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CACrE;AAgBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAA;CAAE,CA0MjJ;AAsHD,wBAAgB,aAAa,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CA8DhE"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAajD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC1C,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjF;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CACrE;AAeD,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAA;CAAE,CA4MjJ;AAsHD,wBAAgB,aAAa,CAAC,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CA8DhE"}

package/dist/commands/doctor.js

@@ -9,8 +9,8 @@ import { buildWritableHomeCheck } from "../system-preflight.js";
 import { CMUX_SETTINGS_DISCLOSURE_PATH, isCmuxSocketControlCompatible, readCmuxSocketControlModeFromText, resolveCmuxSettingsPath, } from "../cmux-config.js";
 import { buildTmuxControlFailure, probeTmuxControl } from "../tmux-health.js";
 import { parse as parseYaml } from "yaml";
-import { compareSpecToLive, topologyFromRigSpec, topologyFromLiveLogicalIds } from "@openrig/daemon/spec-conformance";
-const MIN_NODE_MAJOR = 20;
+import { compareSpecToLive, topologyFromRigSpec, topologyFromLiveLogicalIds } from "../../daemon/dist/spec-conformance-surface.js";
+import { classifyNodeVersion } from "../node-support.js";
 const DEFAULT_PORT = 7433;
 function defaultCheckPort(port, host) {
     return new Promise((resolve) => {
@@ -55,17 +55,20 @@ export function runDoctorChecks(deps) {
         });
     }
     // 3. Node version
-    const major = parseInt(process.version.replace(/^v/, ""), 10);
-    if (major >= MIN_NODE_MAJOR) {
+    const nodeSupport = classifyNodeVersion(process.version);
+    if (nodeSupport.kind === "supported") {
         checks.push({ name: "node_version", status: "pass", message: `Node ${process.version}` });
     }
+    else if (nodeSupport.kind === "untested") {
+        checks.push({ name: "node_version", status: "warn", message: nodeSupport.message });
+    }
     else {
         checks.push({
             name: "node_version",
             status: "fail",
-            message: `Node ${process.version} is below minimum (v${MIN_NODE_MAJOR}).`,
-            reason: "OpenRig requires Node 20+ for built-in fetch, ESM, and stable API support.",
-            fix: "Install Node 20+ via nvm, fnm, or your package manager.",
+            message: nodeSupport.message,
+            reason: nodeSupport.reason,
+            fix: nodeSupport.fix,
         });
     }
     // 4. tmux