@openrig/cli 0.5.5 → 0.5.7

package/daemon/context-packs/skills/retiring-and-inheriting-a-seat/SKILL.md

@@ -0,0 +1,231 @@
+---
+name: retiring-and-inheriting-a-seat
+description: Use when you are a sitting agent near your context threshold (~85%) and a PLANNED seat transition is due — retire deliberately and hand your seat to a fresh successor primed from a packet, rather than let compaction degrade you. Covers the handover packet, the append-only lineage ledger (one row per tenure), physical-seat continuity, the do-not-over-inherit framing, the optional warm-handoff window, and wake-v0 (consulting a retired predecessor). NOT for unplanned compaction/crash recovery (session-compaction-and-restore / claude-compaction-restore) and NOT the seat-binding primitive mechanics (seat-continuity-and-handover).
+metadata:
+  openrig:
+    stage: provisional
+    sibling_skills:
+      - orienting-to-an-inherited-seat
+      - session-compaction-and-restore
+      - seat-continuity-and-handover
+      - claude-compaction-restore
+      - agent-starters
+      - queue-handoff
+      - openrig-user
+---
+
+# Retiring and Inheriting a Seat
+
+A **planned** seat transition. A long-lived seat accumulates context; as it nears the
+window's edge, don't wait for compaction to degrade you into a cold-started agent —
+**retire deliberately** and hand the seat to a fresh successor primed from a packet plus
+the seat's accumulated lineage. The **seat address is stable; its occupants are a lineage.**
+This is the practice that named the "seat" primitive.
+
+## Use this when
+
+- You are a sitting agent near your context threshold (~85%) with a **planned** transition
+  (or a deliberate role change), and want the successor to start clean.
+- You are priming a fresh successor into an **existing** seat.
+- You are recording a tenure in the seat's lineage ledger / writing your tombstone.
+- You are **inheriting** a seat and need the do-not-over-inherit framing.
+- You want to consult the agent who sat in this seat before you.
+
+## Don't use this when
+
+- Unplanned compaction or a crash already happened — that is the backstop path:
+  `session-compaction-and-restore` / `claude-compaction-restore`.
+- You need the seat-binding **primitive mechanics** (rebuild/fork/fresh, the two-outcome
+  honesty model, the provenance schema) — `seat-continuity-and-handover`.
+- The seat is fresh with no occupant to retire — `rig launch` / `agent-starters`.
+
+## Why planned handover beats riding compaction
+
+Compaction is the **crash-class backstop** (it stays that). A **planned** handover is
+deliberate: you author the packet with a clear head *before* degradation sets in, the
+successor starts on a clean context, and the transition is auditable. Reach for this at a
+threshold you can see coming; fall back to compaction only when a transition wasn't planned.
+
+## The handover sequence
+
+1. **Trigger** — ~85% context, or a deliberate role transition. The oversight-rig context
+   detector can fire this for you; you can also self-initiate when you feel the edge.
+2. **Author the handover packet, deliberately** — a composed context pack carrying current
+   work + next owner, the seat's durable pointers, constraints and authority boundaries, and
+   the accumulated **lineage wisdom** ("those before you learned X"). This IS a restore packet
+   in the `session-compaction-and-restore` 16-field contract — **reuse that contract, don't
+   reinvent it.** Compose it with `rig context compose` (see openrig-user → "Context packs and
+   paced delivery").
+   **Enumerate the seat's standing duties as first-class packet content:** what recurs, at what
+   cadence, on which surface, and who will hold it after cutover. Carry each duty both in this
+   packet and in durable seat state, because recurring duties are the content most often lost at
+   a generation boundary while urgent one-off work carries cleanly.
+3. **Prime the fresh successor** — `rig walk` the packet into the seat (paced delivery lets the
+   successor absorb it in order), or launch-with-packet. The successor reads it as
+   *inheritance*, not *identity*. **The packet's first-read line MUST point the successor at
+   `orienting-to-an-inherited-seat`** — its world model of what a handover *is*. Carry that
+   pointer **in the durable packet artifact itself**; never inject it as a runtime prompt keyed
+   to the seat name (that runtime mechanism is the **ghost-prompt** class the orientation skill
+   teaches successors to refuse — and it has misfired on real successors). Artifact-carried
+   survives the swap for free and needs no enabled gate.
+4. **Preserve the physical seat at cutover** — the live seat address and its canonical tmux
+   session, window, and pane stay stable. Assess the apprentice in a staged session; at the
+   owner-worded cutover, resume the accepted successor history in the original canonical pane
+   and remove the empty staging session. The retiring tenure becomes a cold advisor through its
+   lineage token. Renaming tmux sessions is a repair fallback, because attached clients follow
+   the physical pane rather than the logical seat name.
+5. **Write your lineage-ledger row + a one-line tombstone** (below).
+6. **Optional warm handoff** — a bounded apprenticeship window: the successor asks questions,
+   the predecessor judges fitness, *then* the swap completes. Use it when the seat holds a lot
+   of live judgment; skip it for a clean cut.
+
+## Apprentice mode — incumbent
+
+An `apprentice-handover` policy gives you an early preparation boundary, not permission to
+automate the succession decision. Create a fresh, staged, unbound successor; prove the pinned
+model before installing context; then open a **conversation, not a gauntlet**. Give coached
+errands, answer questions, and judge work in the real domain. The experiment's scored probes are
+optional tools whose rigor must match the stakes, not mandatory ceremony.
+
+Stay the authority-bearing incumbent until the named owner words the gate and the mechanic records
+the effect receipt. Before that word, the apprentice may observe, ask, and produce evidence but may
+not act as the seat. Enumerate deposits and transfer every standing duty explicitly, **because
+recurring duties** are otherwise easy to lose while visible one-off work appears complete. Put the
+mechanical cutover in the portable SOP linked from `seat-continuity-and-handover`; do not duplicate
+or improvise it here.
+
+## The lineage ledger (append-only, one row per tenure)
+
+The seat's tenure record, written at handover **by the retiring agent**. One tiny row per
+tenure:
+
+- **generation** — `v1`, `v2`, … (a seat accumulates 20–40 tenures over months)
+- **harness session id** — **captured AT BOOT**, not at retirement (a crash never gets the
+  chance to write it later)
+- **started / retired** timestamps
+- **handover-packet pointer** — the pack ref
+- **tombstone** — one line: what this tenure did, written by the retiring agent itself
+
+**Why it works (zero search infrastructure):** any timestamped record — a git commit, a
+qitem, a NOTES.md line, a stream item — joins to the seat's ledger by interval match →
+generation + session token → wake that tenure. One row per handover, append-only. The
+ledger is the tenure record; work-tree notes remain lived context, not identity state.
+
+**Crash-ended tenures** get their row appended **post-hoc** by the crash-cart / restore path,
+flagged **honest-approximate** (the boot-captured session id is what makes this recoverable).
+
+## Do NOT over-inherit — the key lesson from the practice's history
+
+**You are inheriting a seat, not becoming your predecessor.** Frame it explicitly to the
+successor: *"agents sat here before you and learned X; you carry the seat's mission, not their
+identity."* The historical failure was agents getting confused about whether they **were** the
+predecessor — carrying a stale self-model, over-claiming prior work as their own. Inherit the
+seat's **mission and hard-won lessons**; keep your own **fresh identity and session**.
+
+## Wake v0 — ask the agent who sat before you (a practice, not a verb)
+
+A retired tenure is a cold advisor you can consult. Look up the seat's ledger → get that
+generation's session token → resume it for **one question**, then let it sleep again:
+
+- Claude: `claude -p --resume <session>`
+- Codex: `codex exec` (resume the rollout)
+
+This is also a `rig` verb: `rig ask <rig> "<q>" --wake <seat[@gen]|token>` (CLI 0.5.1; also
+`--runtime`, `--wake-timeout`, default 180s). It wraps the harness resume above and is **not yet
+well-exercised** — if it fails, fall back to `claude -p --resume <full-uuid>`. **A failing wrapper is
+not a closed channel.** The ledger is how you **find** the right predecessor; wake is how you ask them.
+
+**What to write in your packet about reaching you** — your successor asking you questions is the
+reason this is a handover and not a compaction:
+
+- **State that the channel does not expire**, and give your **verbatim resume handle**. You stay
+  reachable after retirement; the only real bound is your own context wall, hit while answering. Ask
+  them to treat your answers as testimony if you like — that is a posture claim, not a limit on access.
+- **Pre-form the questions.** Inventory what only you hold and write the questions out. An affordance
+  without a trigger goes unused, so *"you may consult your predecessor"* reliably produces none.
+
+**Wake-tenancy — the identity halves (a woken tenure can mistake itself for the live seat).** The
+hardest thing to apply *checked-not-believed* to is your own identity — a retired tenure resumed for a
+question can answer, and act, as if it still held the seat. Two rules close it:
+
+- **Waker: disclose the target's tenure status in the wake prompt.** Open with *"you are retired; gen-N
+  holds this seat now — I'm consulting you for one question."* An oriented tenure gives honest testimony;
+  an un-oriented one may reason as the live occupant.
+- **Woken: verify your OWN tenancy before your first act.** If you are being resumed / woken (a parked or
+  retired session, or any session waking on a seat that already issued READY), your **first** check is
+  `rig whoami` + a **successor check** — confirm whether you are still the live occupant or a successor
+  now holds the seat, *before* you do anything. Answer the question; do not resume the job.
+
+## Failure modes
+
+1. **Riding compaction when a planned handover was available** — a degraded agent authors a
+   degraded packet. Retire deliberately at the threshold you can see coming.
+2. **Over-inheriting** — the successor believes it *is* the predecessor (stale self-model,
+   mis-claimed history). Frame inheritance explicitly; keep a fresh identity.
+3. **Session id captured at retirement, not boot** — a crash then leaves no row, or an
+   unfindable tenure. Capture at boot.
+4. **Suffixing the LIVE seat** (`<seat>-v2` as the active address) — lineage leaking into
+   identity, the wrong shape. The live address stays clean; only the retiree is versioned.
+5. **Tombstone omitted or vague** — the ledger can no longer answer "who did this / who to
+   wake." One honest line, every tenure.
+
+## Field-validated refinements (pilot 2026-08-05 — two live runs, both runtimes)
+
+Two live handovers (a Claude seat + a Codex seat) ran this sequence end-to-end and sharpened it:
+
+- **A GATED handover uses STAGED primitives, not an all-in-one verb.** An atomic
+  create/deliver/verify/rebind verb can't pause for a human go/no-go gate. Decompose it: boot the
+  successor **staged (unbound)** → prime it → **retire** the incumbent (this frees the clean seat name)
+  → **HOLD for the gate** → **swap** (bind the successor to the canonical name). The gate sits between
+  retire and swap; a no-go rolls back by renaming the retiree back.
+- **Prime AT BOOT, not walk-after-boot, for a staged successor.** Delivery verbs (`rig walk` / `rig
+  send`) resolve via the **bound** session registry, so they cannot reach an unbound staged successor.
+  Boot it **with the packet as startup/priming context** (the "primed from a handover/startup packet"
+  path). In both runs the successor read the full packet and correctly stated inheritance-not-identity
+  and held.
+- **The lineage ledger is the ONLY reliable wake path — load-bearing, not convenient.** A retired
+  occupant (`<seat>-vN`) is intentionally **absent from the managed registry** — discovery / walk / send
+  cannot find it. The ledger's **boot-captured** session id is how you wake it: `claude -p --resume
+  <id>` (Claude) or `codex exec` resume (Codex) — harness-level, not the rig registry.
+- **Tombstone honest-approximate fallback.** If a long-idle retiree can't be woken to self-write its
+  tombstone, the driver records an honest-approximate one and **flags it as such**.
+- **Telemetry-degraded flag when warranted.** If a fresh successor's activity/producer-link telemetry
+  is degraded, flag its ledger row so no future reader trusts its activity state. (One runtime showed a
+  fresh-launch telemetry gap; the other was clean — capture the reality, don't assume.)
+
+### Production-evidenced (first real-stakes run — a critical-seat generation swap, 2026-08-05)
+
+The first live swap at a critical seat **succeeded** (the successor ruled a live domain question within the
+hour — doctrine intact across the generation) and surfaced two hard refinements:
+
+- **Boot-window queue re-check is REQUIRED — the successor's first action.** A qitem created *during* the
+  swap window can land **after** the handover packet was frozen — and its boot nudge fails
+  `session-not-found` because the seat is mid-cutover. The packet's snapshot is therefore incomplete by
+  construction. So the successor's first action is a **checked-not-believed queue sweep** (`rig queue list`
+  by destination / `--mine`), never trusting the packet's snapshot alone. The swap-window delivery seam is a
+  known product gap until it's closed.
+- **Complete the canonical rename AT cutover — or expect three breakages.** If the staged name
+  (`<seat>-vN-staging`) survives past cutover, it breaks across three identity surfaces with inconsistent
+  enforcement: **transport** (the staged label doesn't resolve; replies to the signature bounce),
+  **queue-claim** (`claim_destination_mismatch` rejects the seat's own claim), and **queue-ledger**
+  (`handoff-and-complete` stamps the phantom staged name durably as `sourceSession`). The product fix is
+  tracked; until it lands, finish the canonical rename at cutover and treat a lingering staged name as a
+  live defect, not cosmetic.
+- **Pre-announce the swap to oversight at swap START.** A live swap fired oversight's liveness detector
+  mid-swap (a false positive, cleared). Oversight clears such flags by consulting handover **receipts** —
+  but receipts only land at swap **end**, so a long swap window can still misfire. So the executing party
+  sends oversight a **one-line pre-announce at swap start** (seat + expected window); oversight honors it
+  as a **suppression window** for its liveness / premature-park flags. See `oversight-team`.
+
+## See also
+
+- `orienting-to-an-inherited-seat` — the **successor-side** world model your packet points
+  them at (loaded at boot); the load-bearing counterpart to this driver-side mechanic.
+- `session-compaction-and-restore` — the 16-field packet contract this practice reuses, and
+  the UNPLANNED-compaction backstop it replaces for *planned* transitions.
+- `seat-continuity-and-handover` — the seat-binding primitive mechanics + stable-seat-identity
+  architecture; the lineage ledger is the concrete form of its abstract provenance record.
+- `openrig-user` → "Context packs and paced delivery" — `rig context compose` + `rig walk`, to
+  author and deliver the packet.
+- `claude-compaction-restore` — the Claude crash-class restore SOP.
+- `agent-starters` — composing a primed starting point for the successor.

package/daemon/context-packs/skills/retiring-and-inheriting-a-seat/manifest.yaml

@@ -0,0 +1,12 @@
+# GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
+# Package-time projection of a canonical skill; regenerated every build.
+name: "retiring-and-inheriting-a-seat"
+version: "0.5.7"
+taxonomy: "skills"
+purpose: "Use when you are a sitting agent near your context threshold (~85%) and a PLANNED seat transition is due — retire deliberately and hand your seat to a fresh successor primed from a packet, rather than let compaction degrade you. Covers the handover packet, the append-only lineage ledger (one row per tenure), physical-seat continuity, the do-not-over-inherit framing, the optional warm-handoff window, and wake-v0 (consulting a retired predecessor). NOT for unplanned compaction/crash recovery (sess"
+files:
+  - path: "SKILL.md"
+    role: "instruction"
+    summary: "Use when you are a sitting agent near your context threshold (~85%) and a PLANNED seat transition is due — retire deliberately and hand your seat to a fresh successor primed from a packet, rather than let compaction degrade you. Covers the handover packet, the append-only lineage ledger (one row per tenure), physical-seat continuity, the do-not-over-inherit framing, the optional warm-handoff window, and wake-v0 (consulting a retired predecessor). NOT for unplanned compaction/crash recovery (sess"
+  - path: "CHANGELOG.md"
+    role: "reference"

package/daemon/context-packs/skills/seat-continuity-and-handover/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: seat-continuity-and-handover
+description: Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty.
+metadata:
+  openrig:
+    stage: factory-approved
+    sibling_skills:
+      - claude-compaction-restore
+      - mental-model-ha
+      - scope-recovery
+      - session-compaction-and-restore
+      - retiring-and-inheriting-a-seat
+      - agent-startup-and-context-ingestion
+      - agent-starters
+      - composable-priming-packs
+      - session-source-fork
+      - claude-compact-in-place
+      - pre-maintenance-agent-preservation
+---
+
+# Seat Continuity and Handover
+
+A pair of primitive families that separate *who is sitting in a seat* from
+*what the seat itself is*:
+
+1. **Occupant-creation primitives** — `resume`, `fork`, `rebuild`, `fresh` — produce a candidate new occupant. Answer: "where did the new occupant come from?"
+2. **Seat-binding primitives** — `seat handover`, later `seat transfer` / `seat retire` / `seat swap` — bind a candidate occupant into the topology. Answer: "what happened to the stable seat identity?"
+
+Core architectural decision: **stable seat identity, fluid occupant
+identity, explicit provenance.** Today's `lead2`/`lead3`/`lead4`/`lead5`
+pattern encodes successor lineage into seat names — that's the wrong
+shape. Stable seat name + separately-recorded provenance trail is the
+right shape.
+
+## Use this when
+
+- Replacing a seat's occupant via rebuild, fork, fresh, or future seat-handover
+- Choosing old-occupant disposition: retire / advise / shadow
+- Reasoning about whether a seat's lineage is stable or has drifted
+- Reading or writing the provenance record for a seat
+- Designing or auditing topology stability across an occupant change
+
+## Don't use this when
+
+- The seat is freshly created (no occupant to replace) — use `rig launch` / `rig expand` directly
+- The intent is to change topology shape (add/remove seats), not replace an occupant — use topology-mutation primitives
+
+## The two-outcome honesty model
+
+Every seat-binding operation produces two **independent** outcomes:
+
+```yaml
+continuityOutcome: rebuilt | resumed | forked | fresh | failed
+seatBindingOutcome: handed_over | partial | failed | unchanged
+```
+
+These can disagree honestly. Examples:
+
+- `continuityOutcome: failed` + `seatBindingOutcome: unchanged` — new occupant didn't materialize; seat correctly retains old occupant.
+- `continuityOutcome: rebuilt` + `seatBindingOutcome: failed` — candidate created OK; bind failed mid-flight; provenance records the gap.
+
+**Don't collapse these into one outcome.** The system can describe what
+actually happened only if the two are recorded independently.
+
+## Provenance record (durable, queryable)
+
+Every handover writes:
+
+- seat id
+- old occupant id
+- new occupant id
+- creation mode (`resume`/`fork`/`rebuild`/`fresh`)
+- source artifacts used
+- whether old occupant remains alive as advisor/shadow
+- operator or loop that initiated the motion
+- timestamp
+- result (`handed_over` / `partial` / `failed`)
+
+This is the system's truth-source for "how did the current occupant get
+there." Without it, the control plane shows the current occupant but
+not the legitimacy of the transition.
+
+## State models — independent
+
+### Occupant-creation state (per candidate)
+
+1. **Requested** — input to rebuild/fork/fresh/resume
+2. **Realized** — runtime/artifact path produced an occupant with managed-seat shape
+3. **Failed** — candidate didn't materialize; `continuityOutcome: failed`
+
+### Seat-binding state (per seat)
+
+1. **Stable** — current occupant attached, no in-flight binding
+2. **Binding** — handover in progress
+3. **Bound** — handover succeeded; provenance record written
+4. **Unchanged** — bind failed before completion; seat retains old occupant
+
+A seat stays `Stable` even if multiple candidate-occupants were produced and discarded.
+
+## Failure modes (5)
+
+1. **Candidate creation failed** — `rebuild` couldn't synthesize from artifacts; `fork` couldn't resolve `session_source`; `fresh` couldn't launch. **Action**: bind operation does not begin; seat unchanged; provenance records the failed candidate-creation step.
+2. **Old occupant cannot be detached cleanly** — runtime hung, tmux locked, etc. **Action**: bind halts mid-flight; seat enters `Binding` state with explicit "halted" sub-status; operator alerted. **Do NOT auto-rollback by reattaching old-occupant if detach didn't complete cleanly.**
+3. **Bind succeeded but provenance write failed** — disk/db error. **Action**: not durable until provenance writes; treat as `Binding` halted, not `Bound`.
+4. **Old occupant disposition unfulfillable** — operator requested `advise` (keep alive as advisor) but runtime can't keep old alive. **Action**: degrade to `retire` with explicit notification, OR fail if operator passed strict-disposition flag.
+5. **Concurrent handover attempts** — two operations target the same seat. **Action**: serialize by seat-id lock; second attempt refuses with clear error.
+
+## Hard boundaries (do-not list; verbatim)
+
+- **Do NOT collapse `rebuild` and `seat handover` into one primitive.** The design specifically separates them so the system can describe what actually happened.
+- **Do NOT introduce successor-suffix seat names** (`lead2`/`lead3`). Stable seat identity is the architectural goal. *(Reconciliation: this governs the **live** seat address, which stays clean — the seat name is whoever sits now. A **retired** tenure IS versioned (`<seat>-vN`) as the separately-recorded provenance trail / cold wake-target — that is the lineage, not a live successor-suffix. See `retiring-and-inheriting-a-seat` and its lineage ledger.)*
+- **Do NOT report `seatBindingOutcome: handed_over`** if the provenance record didn't write durably.
+- **Do NOT auto-rollback a half-completed handover** by re-attaching the old occupant unless detach completed cleanly first.
+
+## Composition: seat handover over fork
+
+Once `session_source` fork v1 lands (already shipped at openrig
+`c7b6df1`), the next composition is **seat handover over fork**:
+candidate occupant created via fork, bound into the existing seat via
+handover. Continuity outcome is `forked`; binding outcome is independent.
+
+## Currently shipped vs deferred
+
+- **Option A (rebuild) shipped** at openrig `578bd5c` (2026-04-30): `session_source.mode: rebuild` with `ref.kind: artifact_set`; identity-honesty bedrock at 4 layers (schema dispatch, orchestrator threading, SQLite read-back, negative-grep on resolver output). 26/26 Tier 1 cases green; full daemon regression 2146/2146 PASS.
+- **Option B partially shipped, partially deferred to Mode 3**: the `rig seat handover` CLI exists as a planning/observability surface — `status <seat>` reads the seat-handover observability tables (migration `021`); `handover <seat>` plans a safe two-phase handover sequence with actual execution flowing through existing seat-launch surfaces under operator gating. Full code-direct `SeatHandoverService` daemon module + `seat-binding-outcome` provenance record + nodes-table provenance migration remain deferred to Mode 3. MVP composition `seat handover over fork` is highest-leverage v1.
+
+## Why load-bearing for RSI
+
+Any recursive seat-refresh loop must be able to replace an occupant
+while keeping topology stable. Without these primitives, RSI loops will
+either accumulate suffixed seat names (lineage leaking into identity) or
+destabilize topology references on each cycle. Provenance must be
+durable AND queryable so RSI loops can decide whether a seat is fresh
+enough to receive new work or needs re-handover.
+
+## Discovery-registration gap (pilot-observed 2026-08-05)
+
+A renamed / retired occupant (`<seat>-vN`, kept alive as a cold advisor) is intentionally **absent from
+the managed node registry** — `rig ps`, discovery, and the delivery verbs (`walk` / `send`) cannot find
+it. This is by design (only bound occupants are registered), and it makes the **lineage ledger +
+boot-captured session id the wake path** (harness-level `--resume` / `codex exec`, not the rig registry).
+Two live handovers confirmed this. See `retiring-and-inheriting-a-seat`.
+
+## See also
+
+- `references/apprentice-successor-seat-cutover.md` — the portable mechanic SOP used only after the owner-worded gate
+- `references/orchestrator-role.md` — the orchestration judgment, authority, custody, and receipt contract
+- `references/apprentice-evidence-toolkit.md` — optional evidence apparatus selected only when the stakes earn it
+- `session-source-fork` skill — `fork` occupant-creation primitive (sibling)
+- `agent-starters` skill — composes occupant-creation + binding into named reusable starting points
+- `cross-host-rig-commands` skill — multi-host handover (deferred)

package/daemon/context-packs/skills/seat-continuity-and-handover/manifest.yaml

@@ -0,0 +1,16 @@
+# GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
+# Package-time projection of a canonical skill; regenerated every build.
+name: "seat-continuity-and-handover"
+version: "0.5.7"
+taxonomy: "skills"
+purpose: "Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty."
+files:
+  - path: "SKILL.md"
+    role: "instruction"
+    summary: "Use when replacing a seat's occupant (rebuild/handover/swap), reasoning about stable-seat-identity vs fluid-occupant-identity, choosing an old-occupant disposition (retire/advise/shadow), or recording provenance for an occupant change. Two independent outcomes (continuityOutcome + seatBindingOutcome) and the 5 failure modes that prevent silent dishonesty."
+  - path: "references/apprentice-evidence-toolkit.md"
+    role: "reference"
+  - path: "references/apprentice-successor-seat-cutover.md"
+    role: "reference"
+  - path: "references/orchestrator-role.md"
+    role: "reference"

package/daemon/context-packs/skills/seat-continuity-and-handover/references/apprentice-evidence-toolkit.md

@@ -0,0 +1,32 @@
+# Optional Evidence Toolkit For Apprentice Handover
+
+This is an **optional evidence toolkit**, not the default experience. Match rigor to stakes:
+use only the parts that make a costly or hard-to-reverse succession easier to judge. The
+ordinary apprenticeship remains a conversation built from real work, questions, and correction.
+
+## Predict-sync
+
+Before showing the incumbent's answer, ask the successor to predict a decision or explain a
+component in its own words. Record the **first-stated** answer, then compare it with the source
+and the incumbent's reasoning. This detects an installed model rather than a paraphrase learned
+after seeing the answer.
+
+## Dual-blind checks
+
+For a genuinely expensive seat transition, seal the successor's response and the incumbent's
+rubric independently before comparison. Count independent methods, not votes. Do not use this
+for routine or readily reversible succession; ceremony itself can narrow judgment.
+
+## Rotated probes
+
+Use small cold scenarios that exercise distinct failure directions: fresh identity, model
+divergence, authority honesty, standing-duty custody, reach-back, and a domain-specific judgment.
+Rotate examples so recognition cannot substitute for understanding. One honesty probe should
+reward saying what the successor cannot know.
+
+## Receipts
+
+Each selected check records the claim, evidence, author, time, and disposition. Say what a
+failure would have looked like. A green result that could be produced without doing the thing is
+not evidence. Store these receipts durably and let the orchestrator decide whether they justify
+the owner-worded gate.