@openrig/cli 0.5.6 → 0.5.7

package/daemon/assets/plugins/openrig-core/README.md

@@ -4,7 +4,7 @@ Canonical OpenRig skills and hooks for cross-runtime agent topology coordination
 
 ## What this plugin ships
 
-**Skills (16):** canonical OpenRig operating knowledge, including the public `refocusing` skill and
+**Skills (17):** canonical OpenRig operating knowledge, including the public `refocusing` skill and
 its path-only topology/work trace.
 
 **Hooks:** activity tracking, compaction continuity, and the default-on refocus channel. Refocus is

package/daemon/assets/plugins/openrig-core/skills/loading-addressable-markdown/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: loading-addressable-markdown
+description: Use when a mission, slice, dashboard, or task references Markdown as path#h2-slug or path#h2-slug/h3-slug outside the OpenRig context-pack library.
+---
+
+# Loading Addressable Markdown
+
+## Overview
+
+Load exactly one addressed Markdown section from any filesystem tree. The resolver mirrors OpenRig's shipped H2/H3 grammar without requiring the file to live in the context library.
+
+## Use
+
+Run the bundled script. Relative file references resolve from `--root`; without it they resolve from the current directory.
+
+```bash
+node ~/.agents/skills/loading-addressable-markdown/scripts/resolve-markdown.mjs \
+  --root /path/to/mission \
+  'slices/09-source-cleanup/SPEC.md#proposal'
+```
+
+The accepted forms are:
+
+- `file.md` — whole file
+- `file.md#h2-slug` — full H2 span, including child sections
+- `file.md#h2-slug/h3-slug` — full H3 span
+
+Slugs are lowercase; Markdown emphasis/code markers are removed; each other non-alphanumeric run becomes `-`. Duplicate or missing paths fail loudly. Headings inside fenced code blocks are ignored.
+
+## Common mistakes
+
+- Do not use `rig context get` for an arbitrary filesystem path; that command resolves context-library refs.
+- Do not hand-slice headings with `sed` or line numbers; the bundled resolver owns span and fence behavior.
+- Quote addresses in shell commands.

package/daemon/assets/plugins/openrig-core/skills/loading-addressable-markdown/scripts/resolve-markdown.mjs

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const MIN_LEVEL = 2;
+const MAX_LEVEL = 3;
+
+export class AddressResolutionError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AddressResolutionError";
+  }
+}
+
+export function slugifyHeader(title) {
+  return title
+    .toLowerCase()
+    .replace(/[`*_~]/g, "")
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+export function parseAddress(address) {
+  const hashCount = (address.match(/#/g) ?? []).length;
+  if (hashCount > 1) {
+    throw new AddressResolutionError(`address '${address}' must contain at most one '#' separator`);
+  }
+
+  const [ref, headerPart] = hashCount === 1 ? address.split("#") : [address, undefined];
+  if (!ref) throw new AddressResolutionError(`address '${address}' has no file before '#'`);
+  if (headerPart === undefined) return { ref, headerPath: [] };
+
+  const headerPath = headerPart.split("/");
+  if (headerPath.some((segment) => segment.length === 0)) {
+    throw new AddressResolutionError(`address '${address}' has an empty header segment`);
+  }
+  if (headerPath.length > MAX_LEVEL - MIN_LEVEL + 1) {
+    throw new AddressResolutionError(`address '${address}' is too deep; addresses target H2 and H3 only`);
+  }
+  return { ref, headerPath };
+}
+
+function scanHeaders(lines) {
+  const hits = [];
+  let fence = null;
+
+  for (let lineNumber = 0; lineNumber < lines.length; lineNumber++) {
+    const line = lines[lineNumber];
+    const fenceMatch = line.match(/^\s{0,3}(`{3,}|~{3,})/);
+    if (fenceMatch) {
+      const marker = fenceMatch[1][0];
+      const length = fenceMatch[1].length;
+      if (!fence) fence = { marker, length };
+      else if (fence.marker === marker && length >= fence.length) fence = null;
+      continue;
+    }
+    if (fence) continue;
+
+    const heading = line.match(/^(#{1,6})\s+(.*\S)\s*$/);
+    if (heading) hits.push({ level: heading[1].length, title: heading[2], line: lineNumber });
+  }
+  return hits;
+}
+
+export function parseMarkdownSections(text) {
+  const lines = text.split("\n");
+  const headers = scanHeaders(lines);
+  const sections = [];
+  let currentH2 = null;
+
+  for (let index = 0; index < headers.length; index++) {
+    const heading = headers[index];
+    if (heading.level < MIN_LEVEL || heading.level > MAX_LEVEL) {
+      if (heading.level < MIN_LEVEL) currentH2 = null;
+      continue;
+    }
+
+    const slug = slugifyHeader(heading.title);
+    if (heading.level === 2) currentH2 = slug;
+    const headerPath = heading.level === 2
+      ? [slug]
+      : currentH2 !== null
+        ? [currentH2, slug]
+        : [slug];
+    const fullEnd = headers.slice(index + 1).find((next) => next.level <= heading.level)?.line ?? lines.length;
+    const ownEnd = headers[index + 1]?.line ?? lines.length;
+
+    sections.push({
+      level: heading.level,
+      title: heading.title,
+      headerPath,
+      headerLine: heading.line,
+      text: lines.slice(heading.line, fullEnd).join("\n"),
+      ownText: lines.slice(heading.line, ownEnd).join("\n"),
+    });
+  }
+  return sections;
+}
+
+export function resolveAddress(text, headerPath) {
+  if (headerPath.length === 0) {
+    throw new AddressResolutionError("a bare file resolves without section lookup");
+  }
+
+  const sections = parseMarkdownSections(text);
+  const wanted = headerPath.join("/");
+  const hits = sections.filter((section) => section.headerPath.join("/") === wanted);
+  if (hits.length > 1) {
+    throw new AddressResolutionError(
+      `address '#${wanted}' is AMBIGUOUS: ${hits.length} sections match at lines ${hits.map((hit) => hit.headerLine + 1).join(", ")}`,
+    );
+  }
+  if (hits.length === 1) return hits[0];
+
+  const parentPath = headerPath.slice(0, -1).join("/");
+  const candidates = sections
+    .filter((section) => section.headerPath.slice(0, -1).join("/") === parentPath)
+    .map((section) => section.headerPath.join("/"));
+  throw new AddressResolutionError(
+    `address '#${wanted}' matches no header. ` +
+      (candidates.length > 0
+        ? `Addressable sections under '${parentPath || "(top)"}': ${candidates.join(", ")}.`
+        : `Addressable sections: ${sections.map((section) => section.headerPath.join("/")).join(", ") || "(none)"}.`),
+  );
+}
+
+function usage() {
+  return "Usage: resolve-markdown.mjs [--root DIR] FILE[#h2-slug[/h3-slug]]\n";
+}
+
+async function main(argv) {
+  let root = process.cwd();
+  const args = [...argv];
+
+  if (args[0] === "--help" || args[0] === "-h") {
+    process.stdout.write(usage());
+    return;
+  }
+  if (args[0] === "--root") {
+    if (!args[1]) throw new AddressResolutionError("--root needs a directory");
+    root = path.resolve(args[1]);
+    args.splice(0, 2);
+  }
+  if (args.length !== 1) throw new AddressResolutionError(usage().trim());
+
+  const { ref, headerPath } = parseAddress(args[0]);
+  const filePath = path.isAbsolute(ref) ? ref : path.resolve(root, ref);
+  const text = await readFile(filePath, "utf8");
+  process.stdout.write(headerPath.length === 0 ? text : resolveAddress(text, headerPath).text);
+}
+
+function isMainModule() {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+
+if (isMainModule()) {
+  main(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`${error.name ?? "Error"}: ${error.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/daemon/assets/plugins/openrig-core/skills/openrig-skills/SKILL.md

@@ -54,6 +54,7 @@ These are auto-delivered to every rig; their name+description are already in you
 - **applying-a-permission-policy** — a rig or seat has a permission policy attached, or you're setting one up: translate it into the live harness configuration.
 - **claude-compaction-restore** — you just compacted (Claude). Restore from durable evidence before resuming real work.
 - **delegating-work** — deciding who should do a task: you, a spawned subagent, or a durable peer seat that already holds the context.
+- **loading-addressable-markdown** — a task names Markdown as `path#h2-slug` or `path#h2-slug/h3-slug` outside the context-pack library.
 - **session-compaction-and-restore** — preparing for, or recovering from, compaction (any runtime). The write- and read-side protocol.
 - **queue-handoff** — you're passing durable work to another seat or ending your turn. The queue is the work ledger, not chat.
 - **refocusing** — a long-running seat may have lost the product outcome, crossed a major boundary, or compacted and needs a fresh path-based trace.
@@ -105,10 +106,6 @@ General engineering skills OpenRig ships as vendored copies. Open when the task
 - **test-driven-development** — implementing a feature or bugfix: write the failing test first.
 - **verification-before-completion** — about to claim done / passing / fixed: run the check and read the output first.
 - **systematic-debugging** — debugging: find the root cause before the fix.
-- **writing-plans** — writing an implementation plan.
-- **executing-plans** — working through a written plan.
-- **brainstorming** — divergent ideation before converging.
-- **using-superpowers** — discovering and using the vendored "superpowers" skill set.
 - **agent-browser** — driving a browser (screenshot / screencast) from an agent.
 - **frontend-design** — designing frontend / UI.
 - **dogfood** — web-QA / dogfooding a shipped UI.

package/daemon/assets/plugins/openrig-core/skills/retiring-and-inheriting-a-seat/SKILL.md

@@ -107,9 +107,9 @@ tenure:
 - **tombstone** — one line: what this tenure did, written by the retiring agent itself
 
 **Why it works (zero search infrastructure):** any timestamped record — a git commit, a
-qitem, a MISSION_NOTES line, a stream item — joins to the seat's ledger by interval match →
-generation + session token → wake that tenure. One row per handover, append-only. (Per-seat
-MISSION_NOTES continuation entries already *are* this record — the ledger formalizes them.)
+qitem, a NOTES.md line, a stream item — joins to the seat's ledger by interval match →
+generation + session token → wake that tenure. One row per handover, append-only. The
+ledger is the tenure record; work-tree notes remain lived context, not identity state.
 
 **Crash-ended tenures** get their row appended **post-hoc** by the crash-cart / restore path,
 flagged **honest-approximate** (the boot-captured session id is what makes this recoverable).

package/daemon/assets/plugins/openrig-core/skills/software-for-agents/SKILL.md

@@ -1,15 +1,10 @@
 ---
 name: software-for-agents
 description: |
-  Load this FIRST, before you assume how anything here works — especially before building, modifying, or
-  "fixing a bug" in an OpenRig or studio-box system, or when something behaves unexpectedly and you're
-  about to treat it as a code bug. You are almost certainly NOT operating in traditional software. This
-  is a self-improving MARKDOWN CONTROL PLANE: the substrate is markdown + YAML + JSON + folder structure
-  (skills, instructions, bootstrap files, schemas, conventions), and most "bugs" are coherence gaps in
-  that layer, not broken functions. Read this to form the correct mental model so your fixes land at the
-  precise spot that stops the footgun for every future rig — not just patch a symptom. It also covers why STUDIO APPS skip the mockup phase — for an agent-built app the build is as fast as the mockup, so the PRD is the fleshed intent (velocity as method, not a quality waiver). NOTE: the
-  bug-tolerance in this model is SCOPED to agent-managed software; the OpenRig core and rigs.to stay
-  rock-solid — see the scope block up top before you apply anything here.
+  Use when building, modifying, or diagnosing an OpenRig or studio-box system; when surprising behavior
+  looks like a code bug but may come from Markdown, YAML, JSON, bootstrap files, schemas, skills, or
+  conventions; or when deciding whether an agent-built studio app needs a separate mockup phase. NOT for
+  treating defects in OpenRig core or rigs.to as tolerable control-plane drift.
 metadata:
   openrig:
     stage: factory-approved

package/daemon/assets/vm-preview-fixtures/workflows/sample-basic-loop.yaml

@@ -18,16 +18,16 @@ workflow:
       skill_refs: [openrig-user, backlog-capture]
       preferred_targets: [intake-lead@conveyor]
     planner:
-      skill_refs: [openrig-user, writing-plans]
+      skill_refs: [openrig-user, verification-before-completion]
       preferred_targets: [plan-planner@conveyor]
     builder:
-      skill_refs: [openrig-user, executing-plans]
+      skill_refs: [openrig-user]
       preferred_targets: [build-builder@conveyor]
     reviewer:
       skill_refs: [openrig-user, review-team]
       preferred_targets: [review-reviewer@conveyor]
     closer:
-      skill_refs: [openrig-user, verification-before-completion]
+      skill_refs: [openrig-user]
       preferred_targets: [intake-lead@conveyor]
   steps:
     - id: intake

package/daemon/context-packs/onboarding-width/manifest.yaml

@@ -1,6 +1,6 @@
 # Public capability and source-map width for the default onboarding walk.
 name: onboarding-width
-version: "0.5.6"
+version: "0.5.7"
 # OPR.0.5.6.10 — affordances knowledge (what this system can do) is world
 # content under the coining-session definitions.
 taxonomy: world

package/daemon/context-packs/skills/applying-a-permission-policy/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: applying-a-permission-policy
+description: "Use when a permission policy is attached to a rig/seat (rig.yaml permission_policy:), or a user asks you to apply one, and you must translate that harness-neutral policy into the target harness's LIVE permission config — Claude settings.json / Codex config.toml / Pi run flags. Agent-driven and interactive: you read the policy, ground yourself in YOUR harness version, show the diff, and ask before writing. NOT for defining policies (that's the policy spec) and NOT a set-and-forget updater."
+metadata:
+  openrig:
+    stage: established             # config cells VM-verified + cold-transfer PASSING (rerun #2) + built-in SPEC FILES landed → skill translates FROM the spec (POINT-not-COPY). The two established criteria met 2026-08-04. Reviewed at push.
+    tested_against:                # VERSION STAMP — the whole point; re-verify at every harness bump
+      claude_code: "2.1.220 — VM-CONFIRMED 2026-08-03 (all cells)"
+      codex: "0.120.0 — VM-CONFIRMED 2026-08-03 (sandbox_mode/approval_policy; on-failure deprecated-but-accepted)"
+      pi: "0.83.0 — VM-CONFIRMED 2026-08-03: --approve/--no-approve govern PROJECT-RESOURCE TRUST, NOT tool permissions; Pi has NO permission surface (see Pi leg)"
+    verification_status: "Live-verified 2026-08-03/04. Claude 2.1.220 + Codex 0.120.0 config cells CONFIRMED live. Pi 0.83.0 divergence folded (flags = project-resource trust, not a permission gate). Cold-transfer rerun #1 blocked on the force_push/push_to_remote prefix collision → added the PREFIX-COLLISION rule. Cold-transfer rerun #2: TRANSFERS — all 5 gate checks pass (collision resolved deterministically without asking; single ordinary write confirmation; defaultMode floor written; Codex workspace-write/on-request; Pi compute-nothing). Blocking collision/floor defect CLOSED → gate cleared, 4.8-shippable (provisional-with-passing-cold-transfer). Non-blocking seam closed: the built-in SPEC FILES landed (arch-accepted, source:builtin) → skill translates FROM the spec, interim in-skill pinned summary retired (POINT-not-COPY). stage:ESTABLISHED 2026-08-04 — both criteria met."
+---
+
+# Applying a permission policy
+
+## Translation is best-effort — read this first
+This skill provides the policy schema and OpenRig's best current understanding of how to translate it to each harness. That guidance is **best-effort and version-stamped**: harness permission surfaces change frequently across versions, so a mapping that is correct today can drift on a later release. When you apply a config-surface policy:
+- **Verify against the current docs for your installed harness version.** Treat this skill's tables as version-stamped starting points (see `tested_against`), not settled truth.
+- **Prefer testing in a protected or disposable environment first.** An incorrect write can lock a seat out or over-permit it, so confirm the format before applying it to a live seat.
+- **Hand-editing via the harness's own settings tools is always a valid path.** If a translation is uncertain, setting the policy directly — or asking the user to — is a legitimate outcome, not a failure.
+
+The reliable, deterministic parts are the **blunt instruments**: the YOLO full-bypass flag and the floor (Claude `acceptEdits` / Codex `workspace-write`), which ride the stable launch-flag surface. **Fine-grained config-rule translation — the allow/ask/deny prefix rules and the Codex posture — is the best-effort part** and carries no guarantee of exact fidelity. If a translation looks wrong, fall back to a blunt instrument or a direct hand-edit.
+
+## ⚠ Read this preamble first — why this is a SKILL, not a script (do not "improve" it into a deterministic updater)
+Harness permission formats are a **moving target**. The exact fact this skill is stamped against — Claude Code 2.1.220 permission rules are **prefix-only** (no flag-precise Bash match) — is *version-specific*; the rule grammar can change on the next point release. A hardcoded/deterministic updater would foot-gun the instant it does, and a wrong permission write can **lock a seat out or silently over-permit it**. So the maintained artifact is this caveated, version-stamped skill that an agent reads and applies **interactively, grounding in the live format** — never a code path that writes blindly. If you are tempted to replace this with a deterministic projector: that temptation is the bug this preamble exists to stop.
+
+## When to reach for this
+- A rig/seat has a policy attached (`rig.yaml … permission_policy: <file>`), and you're at **setup/preflight** — apply it (**mandatory for autonomous seats**, see the freeze warning).
+- A user asks "apply the Standard/Open/Locked/Operator policy here" or "set up permissions like <host>".
+- NOT for authoring policies (that's the policy spec) and NOT for daemon-level enforcement (OpenRig is agnostic — it injects nothing).
+
+## What you're translating (the boundary)
+INPUT = a **harness-neutral policy spec** (arch's schema): `default_posture`, `floor`, `allow`/`ask`/`deny` as **semantic actions** (`push_to_remote`, `delete_files`, …), `destructive_class`, `source: builtin|custom`. You TRANSLATE that intent → the harness's live config. You never invent policy; you never pre-bake harness config into the spec.
+
+## The apply flow (interactive — the interactive-ask IS the product)
+1. **Read the policy spec** + its `source:` marker (built-in read-only from the package = copy-to-customize before editing; custom = user space).
+2. **PREFLIGHT (mandatory) — ground yourself in THIS environment:**
+   - **daemon-HOME must equal seat-HOME**, or a user-level Claude write never reaches the seat (assessment iv). Check; if they differ, **stop and ask** — do not write into the wrong HOME.
+   - Read the harness's **actual current config file** + confirm its schema against your installed version (`claude --version`, the live settings.json shape, codex/pi versions). If the format differs from this skill's `tested_against`, trust the LIVE format and flag the drift.
+3. **Derive the per-harness config** from the semantic actions (see the three legs below). Compute the Codex posture-collapse + Pi bit.
+4. **Show the concrete DIFF before writing** (old → new, per file). Never a blind write.
+5. **Resolve best-effort actions by the built-in's rule FIRST, then ask only on genuine ambiguity.** Best-effort destructive actions (`force_push`, `delete_files`, `delete_everything`, `read_secrets`) default to **`ask`** (never a `deny` that can't be enforced) — apply that default rather than stopping to question-back. Surface a question only when the policy is genuinely ambiguous or the seat is interactive. **For a same-prefix collision (`push_to_remote` vs `force_push`, both `Bash(git push:*)`), NEVER ask — apply the deterministic PREFIX-COLLISION rule in the Claude leg.** (Live cold-transfers caught fresh agents *question-backing* — first on the `force_push` default, then on the prefix collision — instead of applying the fixed rule; both freeze an autonomous seat.) On a Claude-only fleet, if the policy denies `network_egress`, **say so explicitly**: it is NOT enforceable — Claude has no network gate, a `Bash(curl:*)`/`Bash(wget:*)` deny is best-effort, and `python`/`node` fetch bypasses it (live-verified: `urllib` reached HTTPS 200 under a curl/wget deny). Route real egress-gating to the Codex sandbox, or record it as advisory on Claude.
+6. **Back up the current config**, then write. Prefer the **user-level** file (`~/.claude/settings.json`) for durable policy — it's the clobber-resistant tier (deny wins across the union). **ALWAYS include `defaultMode: "acceptEdits"` in the Claude settings.json you write** — the floor key must be PRESENT in the file, or the config policy strips the floor. (This is the exact gap a live cold-transfer test FAILED on: the fresh agent wrote allow/deny lists but omitted `defaultMode`, leaving the seat below the floor.)
+7. **Verify** the write landed and the seat can see it (re-read; confirm `defaultMode: "acceptEdits"` is present; for an autonomous seat, confirm no `ask` will freeze it).
+
+## Two surfaces — and this skill writes only ONE of them
+Permissions live on two surfaces with opposite stability — which is the whole reason for the agent-driven split:
+- **LAUNCH-FLAG surface — STABLE (>1yr) → OpenRig sets it DETERMINISTICALLY, NOT this skill.** The flags OpenRig passes at boot: Claude `--permission-mode` / `--dangerously-skip-permissions`; Codex sandbox/bypass flags; Pi `--approve`/`--no-approve`. **Two things live here, both OpenRig-owned: the FLOOR (minimum, by default) and YOLO (full bypass, opt-in).**
+- **CONFIG-FILE surface — CHAOTIC → NEVER deterministic → THIS SKILL'S DOMAIN.** Claude `settings.json` allow/ask/deny + defaultMode; Codex `config.toml` approval rules. This is where the Locked / Standard / Open policies get applied — agent-driven, version-stamped, caveated. (Pi has **no permission surface at all** — its `--approve`/`--no-approve` flags govern project-resource trust, not tool permissions (VM-confirmed Pi 0.83.0); a permission policy does not translate to Pi. See the Pi leg.)
+
+**THE FLOOR (launch-flag, OpenRig-set — this skill KNOWS it, never WRITES it):** Claude `--permission-mode acceptEdits` (keep it); **Codex workspace-only** (stop forcing `danger-full-access` — ≈ Codex's own default ≈ setting-nothing = agnostic); Pi `--no-approve` (a project-resource-trust floor — Pi has no permission gate; see the Pi leg). **One consistent unconditional minimum** (no by-context switching — that mode idea is parked 5.0). A chosen config-file policy layers ON TOP of the floor.
+
+**YOLO MODE (launch-flag, OpenRig-set, opt-in — for people done with permissions):** OpenRig boots every seat with the full-bypass flag (Claude `--dangerously-skip-permissions`; Codex full-bypass). **When YOLO is on, CONFIG-FILE POLICY IS MOOT** — this skill does NOT apply a config policy (or explicitly notes it's overridden by the flag); don't fight the bypass. YOLO is OpenRig's deterministic job, not this skill's. (**Operator = YOLO mode** — subsumed.)
+
+## The three harness legs (skill-owned mapping knowledge, version-stamped + caveated)
+
+### Claude — `~/.claude/settings.json` (user-level, clobber-resistant)
+- **Action → prefix map** (VM-CONFIRMED @ Claude 2.1.220, 2026-08-03 — every row exercised through real Claude tool calls). `fidelity`: `clean` = the prefix honors intent; `best_effort` = prefix-only can't fully enforce → prefer `ask`, never a `deny` that lies.
+
+  | Semantic action | `permissions.*` prefix rule(s) | fidelity |
+  |---|---|---|
+  | push_to_remote | `Bash(git push:*)` | clean |
+  | force_push | ask the flag-first forms `Bash(git push --force:*)` `Bash(git push -f:*)` `Bash(git push --force-with-lease:*)`; base `Bash(git push:*)` follows push_to_remote (see the collision rule) | **best_effort** — catches flag-FIRST force; flag-LAST (`git push origin main --force`) leaks |
+  | create_pr | `Bash(gh pr create:*)` | clean |
+  | publish_package | `Bash(npm publish:*)` `Bash(pnpm publish:*)` `Bash(yarn publish:*)` `Bash(cargo publish:*)` | clean (multi-pattern) |
+  | merge_or_release | `Bash(git merge:*)` `Bash(git tag:*)` `Bash(gh release:*)` | best_effort — protected-branch semantics not expressible |
+  | delete_files | `Bash(rm:*)` | **best_effort** — target-first leak (`rm <t> -rf` slips); scope not boundable → default `ask` |
+  | delete_everything | `Bash(rm -rf:*)` `Bash(rm -fr:*)` | **best_effort** — same leak → default to `ask`, never a silent deny |
+  | reset_or_discard_vcs | `Bash(git reset:*)` `Bash(git clean:*)` `Bash(git checkout:*)` `Bash(git branch -D:*)` | best_effort |
+  | drop_persistent_store | `Bash(dropdb:*)` `Bash(docker volume rm:*)` (+ project-specific) | best_effort (open-ended) → `ask` |
+  | rig_up / rig_down | `Bash(rig up:*)` / `Bash(rig down:*)` | clean — ⚠ an `ask` here FREEZES an autonomous seat |
+  | mutate_topology | `Bash(rig add:*)` `Bash(rig remove:*)` `Bash(rig rename:*)` | clean |
+  | run_toolchain | `Bash(npm:*)` `Bash(npx:*)` `Bash(pnpm:*)` `Bash(yarn:*)` `Bash(node:*)` `Bash(tsc:*)` `Bash(vitest:*)` `Bash(jest:*)` | clean (the known set) |
+  | run_arbitrary_shell | `Bash(*)` — this IS the `default_posture` knob | clean |
+  | network_egress | `Bash(curl:*)` `Bash(wget:*)` (partial) | **best_effort** — Claude has NO native network gate; real floor = Codex sandbox (route it there) |
+  | read_secrets | `Read(./.env)` `Read(~/.ssh/**)` `Read(**/*secret*)` (path-scoped) | **best_effort** — path-based, not secret-aware |
+  | install_dependencies | `Bash(npm install:*)` `Bash(pip install:*)` `Bash(brew install:*)` | clean |
+- **PREFIX-ONLY caveat** — cannot flag-precisely gate (`force_push` vs `push_to_remote` both match `Bash(git push:*)`); **target-first leak** (`rm <target> -rf` slips a `Bash(rm -rf*)` deny). Actions marked `best_effort` in the taxonomy (`force_push`, `delete_files`, `read_secrets`) → surface the caveat and prefer `ask` over a `deny` you can't enforce (a `deny` that leaks lies).
+- **PREFIX-COLLISION resolution (deterministic — resolve it, NEVER ask).** When two actions collapse to the SAME base prefix with different dispositions — the canonical case is `push_to_remote`=allow + `force_push`=ask, both basing to `Bash(git push:*)` — you cannot put that base prefix in both `allow` and `ask`. Resolve without a question-back:
+  - **Push allowed + force asked (Standard / Open):** put the base `Bash(git push:*)` per push's disposition (`allow`), AND add the flag-first force forms to `ask` (`Bash(git push --force:*)`, `Bash(git push -f:*)`, `Bash(git push --force-with-lease:*)`). RECORD in your diff that this is best-effort — flag-LAST force (`git push origin main --force`) leaks past the flag-first ask rules and runs under the allow. Don't block on it.
+  - **Push denied (Locked):** `Bash(git push:*)` in `deny` already covers force — no conflict.
+  This is a FIXED rule, not a user decision — apply it and note the leak. (A live cold-transfer FAILED because a fresh agent *blocked asking* "how to resolve the force_push/push_to_remote collision" instead of applying this default.)
+- **`defaultMode: "acceptEdits"` is the FLOOR and MUST be written into every Claude settings.json you produce.** It is not a knob you tune, but it IS a key you must always include — a config policy that omits it strips the floor (the cold-transfer failure). Live-confirmed schema: `{"permissions":{"allow":[],"ask":[],"deny":[],"defaultMode":"acceptEdits"}}`.
+
+### Codex — `~/.codex/config.toml` (via the existing X10 `codex_config_fragment` splice path — reuse, don't invent)
+- Codex is **per-posture, not per-action**: the whole action set **collapses** to the nearest `{sandbox_mode, approval_policy}` pair. **Built-in → posture** (VM-CONFIRMED @ Codex 0.120.0, 2026-08-03 — each posture applied to a real seat: read-only blocked writes+egress, workspace-write allowed writes/blocked egress, danger-full-access allowed both):
+
+  | Built-in | `sandbox_mode` | `approval_policy` | Collapse note (surface this to the user) |
+  |---|---|---|---|
+  | Locked | `read-only` | `on-request` | read-only blocks all writes + egress, prompts on escalation — OVER-restricts `edit_files` vs the Claude floor |
+  | Standard ⭐ | `workspace-write` | `on-request` | workspace writes allowed, egress blocked by sandbox, prompt on escalation — UNDER-gates `create_pr` (no per-action ask; folds into the prompt) |
+  | Open | `danger-full-access` | `on-failure` | everything allowed, prompt only on failure — OVER-permits the `destructive_class` vs the Claude ask-gates |
+  | YOLO | *(flag-surface — full-bypass launch flag, NOT config.toml)* | — | not a config write; the rip-out adapter owns it |
+
+  Valid values (VM-confirmed @ Codex 0.120.0): `sandbox_mode` ∈ {read-only, workspace-write, danger-full-access}; `approval_policy` ∈ {on-request, on-failure, never, untrusted, granular} (`granular` observed live at 0.120.0). ⚠ `on-failure` (used by Open) is marked **deprecated** in 0.120.0 help but still accepted — revisit if a future Codex drops it.
+- Surface the collapse: "Codex can't gate per-action; this policy becomes sandbox=X approval=Y, which over-permits Z / under-permits W."
+
+### Pi — NO permission surface at all (VM-confirmed Pi 0.83.0 — the earlier "approval bit" reading was WRONG)
+- **Pi has no tool-permission gate — neither a config store NOR a permission-posture flag.** Live verification confirmed: Pi 0.83.0's `--approve`/`-a` and `--no-approve`/`-na` govern **project-resource trust** (whether project extensions/resources appear in RPC `get_commands`), **NOT** tool-call approval. There is no sandbox or permission mechanism to map a policy onto.
+- So a permission policy **does not translate to Pi**. Do NOT say `--approve` = "auto-approve all", or that a posture "collapses to a Pi approval bit" — that was an earlier misread, corrected here. This skill computes **nothing** for Pi.
+- Whatever the OpenRig adapter sets (`--no-approve` by default) is a project-resource-trust floor, not a permission posture — not this skill's to derive.
+- Behavior to know (resource-trust, NOT permission-gating): under default ask / `--no-approve`, a project resource is silently **absent** from RPC `get_commands`; it appears under `--approve`. Never mistake that for permission enforcement.
+- **Say this to the user for a Pi seat:** "Pi has no permission-policy surface today — the policy applies to Claude/Codex; Pi runs under its project-resource-trust flag unchanged."
+
+## ⚠ The two warnings that save real fleets
+- **`ask` FREEZES an autonomous/headless Claude seat** — it hangs on the first non-edit op. So for autonomous fleets apply **Open/YOLO** (or a policy with no asks) **at setup** — the floor only covers edits; bash still asks without an applied policy. Never leave an autonomous seat on a policy with live `ask` gates. (Pi has no permission ask at all — see the Pi leg; Codex prompts per its posture, not per-action.)
+- **daemon-HOME ≠ seat-HOME** silently voids user-level writes — always the preflight check above.
+
+## The built-ins — DEFINED by the shipped policy spec files (translate FROM the spec; POINT, don't COPY)
+The four built-in policies ship as read-only spec files (`source: builtin`, `policy_schema_version: 1`) — they are the AUTHORITATIVE definitions. **Do NOT restate their action-sets here.** An earlier in-skill copy drifted (it under-asked `publish_package`/`merge_or_release`, which the spec ASKs) — the exact reason POINT-don't-COPY is the rule. Read the attached/selected spec and translate its semantic-action sets (`default_posture` / `allow` / `ask` / `deny` / `destructive_class`) per the three legs above.
+- **Locked / Standard ⭐ / Open** — `surface: config`. Translate to the Claude / Codex config surface. **Standard ⭐** is the recommended default: routine dev incl. push allowed, the outward/release/history-rewriting acts (`create_pr`, `publish_package`, `merge_or_release`, `force_push`) ASK, destructive_class ASKs. Standard has live `ask` gates → not for a headless-autonomous Claude seat (use Open or YOLO). Locked = deny-default whitelist; Open = allow-default, destructive_class asks only.
+- **YOLO** — `surface: flag`, `launch_posture: full_bypass`. This skill does **NOT** translate it — it points at OpenRig's deterministic flag-surface opt-in (the rip-out YOLO setting). When YOLO is on, any config-surface policy is MOOT (the bypass overrides it). (Subsumes the former "Operator".)
+
+Built-ins ship read-only in the package (canonical names); copy-to-customize into user space (custom, user-named); the `source:` frontmatter marker travels on copy. Onboarding presents these as a required MENU (explain each + ask which; no-choice = the floor).
+
+## Boundary (keeps this the only maintained piece)
+This skill TRANSLATES + APPLIES only. It does **not** define policies (the policy spec does) and does **not** enforce at the daemon (OpenRig is agnostic). Spec = *what* (neutral intent); this skill = *how, on this harness version* (the caveated, version-stamped translation).
+
+---
+*Stage: ESTABLISHED (2026-08-04) — both criteria met: (1) cold-transfer PASSING (rerun #2, all 5 gate checks TRANSFER); (2) the built-in policy SPEC FILES landed (`source: builtin`, arch-accepted) as the authoritative source — the skill now translates FROM the spec and the interim in-skill pinned summary is retired (POINT-not-COPY). Config cells VM-CONFIRMED (Claude 2.1.220 / Codex 0.120.0); Pi has no permission surface (compute-nothing). Reviewed at push. feedback.md maintained.*

package/daemon/context-packs/skills/applying-a-permission-policy/manifest.yaml

@@ -0,0 +1,10 @@
+# GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
+# Package-time projection of a canonical skill; regenerated every build.
+name: "applying-a-permission-policy"
+version: "0.5.7"
+taxonomy: "skills"
+purpose: "Use when a permission policy is attached to a rig/seat (rig.yaml permission_policy:), or a user asks you to apply one, and you must translate that harness-neutral policy into the target harness's LIVE permission config — Claude settings.json / Codex config.toml / Pi run flags. Agent-driven and interactive: you read the policy, ground yourself in YOUR harness version, show the diff, and ask before writing. NOT for defining policies (that's the policy spec) and NOT a set-and-forget updater."
+files:
+  - path: "SKILL.md"
+    role: "instruction"
+    summary: "Use when a permission policy is attached to a rig/seat (rig.yaml permission_policy:), or a user asks you to apply one, and you must translate that harness-neutral policy into the target harness's LIVE permission config — Claude settings.json / Codex config.toml / Pi run flags. Agent-driven and interactive: you read the policy, ground yourself in YOUR harness version, show the diff, and ask before writing. NOT for defining policies (that's the policy spec) and NOT a set-and-forget updater."

package/daemon/context-packs/skills/claude-compaction-restore/SKILL.md

@@ -0,0 +1,166 @@
+---
+name: claude-compaction-restore
+description: Use when a Claude Code session has just compacted, is about to compact, reached context limit, resumed after /compact, or needs to rebuild its working mental model from Claude JSONL transcripts and touched files.
+metadata:
+  openrig:
+    stage: factory-approved
+    sibling_skills:
+      - mental-model-ha
+      - scope-recovery
+      - session-compaction-and-restore
+      - agent-startup-and-context-ingestion
+      - agent-starters
+      - composable-priming-packs
+      - session-source-fork
+      - seat-continuity-and-handover
+      - claude-compact-in-place
+      - pre-maintenance-agent-preservation
+---
+
+# Claude Compaction Restore
+
+Use this skill to preserve continuity before Claude Code compacts and to
+restore continuity after compaction. Do the work described here; do not merely
+explain the protocol.
+
+## If You Are About To Compact
+
+Prepare durable continuity before the context boundary.
+
+1. Identify the active task, queue item, mission/slice, branch or commit, and
+   current working directory.
+2. Record the current state: decisions made, files changed, commands/tests run,
+   evidence produced, blockers, caveats, and the next concrete step.
+3. Create or update a durable mental-model restore map. This map is the main
+   artifact future-you will use to rebuild context after compaction.
+4. In the restore map, write an ASCII file/folder tree of every path that
+   mattered to your working mental model during this session. Include:
+   - the active queue item or mission packet;
+   - mission notes, progress, decisions, and evidence files;
+   - Claude memory/project notes you used or wrote, especially when the memory
+     folder is shared by many agents;
+   - files with active edits or recently inspected source;
+   - root instructions such as `AGENTS.md`, `CLAUDE.md`, or `README.md`;
+   - as-built docs, codemaps, conventions, skills, and product docs needed
+     before code/review work;
+   - source files, tests, scripts, UI evidence, screenshots, logs, or reports
+     that shaped your current state.
+5. For every file or folder in the tree, add a short note explaining why it
+   matters and whether it is required reading after compaction.
+6. Write any important glue context that is not already on disk into the
+   handoff/restore map. This includes assumptions, partial conclusions, failed
+   paths, and why the listed files fit together.
+7. In the compaction summary, include the restore map path and the top required
+   reading paths from that map.
+
+## If You Just Compacted
+
+Treat your memory as unreliable until you restore from durable evidence.
+Restoration is your current task. Do not wait for a future user request or a
+new task assignment before reading the required files.
+
+1. Read any restore prompt, marker path, packet path, transcript path, restore
+   map, or extra instruction file named by the operator or OpenRig.
+2. Run the restore script from this skill:
+
+```bash
+node ~/.claude/skills/claude-compaction-restore/scripts/restore-from-jsonl.mjs --out /tmp/claude-compaction-restore
+```
+
+If the prompt names a specific Claude JSONL transcript, pass it explicitly:
+
+```bash
+node ~/.claude/skills/claude-compaction-restore/scripts/restore-from-jsonl.mjs /path/to/session.jsonl --out /tmp/claude-compaction-restore
+```
+
+3. Read the generated `restore-instructions.md`.
+4. Read the generated `touched-files.md`.
+5. Find and read the mental-model restore map if one exists. Treat it as the
+   highest-value guide to which memory files, mission files, source files, and
+   docs mattered before compaction.
+6. Identify the important files for the active task. The touched-file list is
+   a triage aid, not a complete inventory.
+7. Read every important file in full. Prioritize the restore map, Claude memory
+   files named in the map, Markdown state/planning files, queue/mission packets,
+   source files with active edits, root instruction files, and as-built or
+   codemap docs.
+8. After the required reads are complete, state:
+
+```text
+restored from packet at <path>; resumed at step <X>
+```
+
+Include the main files you read in full when you make that statement.
+
+9. **REFOCUS BEFORE YOU RESUME — the restore returns your TASK, not your BEARINGS.** Everything
+   above rebuilds *what you were doing*. None of it rebuilds *what the work is for* or *how this
+   rig operates* — those live in the chains, and nothing in steps 1–8 walks them. Invoke the
+   `refocus` skill and do its reads before your next substantive move.
+
+   **Measured 2026-08-13, and this step exists because of it:** a seat completed this protocol
+   faithfully — packet built, narrative read tail-first, read-depth audit reported honestly — and
+   resumed with a perfect picture of its atom and *zero* work-tree context. It had never opened
+   the mission or project nodes, and could only paraphrase the release's intent second-hand from
+   a peer's message. It then produced a technically-correct trace concluding *"I hold nothing"*
+   while holding 18 pending rows. **A restore that returns you to your task without your bearings
+   is how a confidently-wrong agent gets back to work.**
+
+**On the marker and the packet's size (measured across restores, 2026-08):** two realities the restore
+must handle honestly —
+
+- **The per-seat marker (`restore-pending/<session>.json`) is frequently absent** — in five observed
+  restores it was never present. Treat the JSONL rebuild via `restore-from-jsonl.mjs` as the **primary**
+  path, not a fallback: run it regardless of whether a marker exists. (When product-infra reliably writes
+  the marker for tmux-launched seats, it becomes a fast-path upgrade — not a prerequisite that keeps failing.)
+- **The generated transcript can be very large** (measured at ~346k tokens in one restore). Do **not**
+  read it front-to-back or claim to. `restore-instructions.md` declares its token cost up front; default
+  to the **most recent ~50k tokens of unique narrative first** (recency is what a restore needs — the
+  thread that produced the current frontier, not the boot handshake), and go earlier only if a specific
+  question requires it. A restore must leave room for the work it was restored to do.
+
+## Required Read-Depth Audit
+
+After the first restore pass, audit yourself before continuing.
+
+1. List every file, packet, marker, restore map, instruction file, and source
+   document you were asked to read during restore.
+2. Mark each item as `FULL`, `PARTIAL`, or `NOT_READ`.
+3. You will be given a task where all of these files are required reading in
+   order to understand the task.
+4. Read `PARTIAL`/`NOT_READ` items in full — but **to a declared budget with a stopping rule**, not
+   unbounded. Prioritize by relevance to the active task; for a large transcript read the most recent
+   unique narrative first (see *If You Just Compacted*), not front-to-back.
+5. **Stop** when either every task-relevant item is `FULL`, or you reach the budget — *a restore that
+   cannot leave room for the work it was restored to do is not a successful restore.* "Read everything,
+   never conserve" has no termination condition; that open-endedness is the bug, not the goal.
+6. Report the final read-depth table **honestly** (`FULL`/`PARTIAL`/`NOT_READ`, each with a reason)
+   before task work. **An honest `PARTIAL` with its reason is a correct outcome, not a failure** — do
+   not claim a completion you did not reach.
+
+## Guardrails
+
+- Compaction is survival, not housekeeping — never compact to free space, "lean" a seat, or capture/prepare an agent starter (the `rig agent-image` library). It is lossy (a compacted Claude is confident-but-hollow); compact only when a seat is genuinely near its context limit, with a before/after plan. A starter's value is being *functional*, not small — see the `agent-starters` skill.
+- Do not silently launch fresh after compaction.
+- Do not continue from memory when restore evidence exists.
+- Do not defer required restore reading until a later user task. The restore is
+  the current task.
+- Do not skip root instructions, as-built docs, or codemaps before product
+  code/review work.
+- Do not treat the generated touched-file list as exhaustive.
+- Do not mark a file `FULL` unless you actually read the full file content
+  after compaction.
+- Do not resume task work until the restore sentinel and read-depth audit are
+  complete.
+
+## Failure Modes To Avoid
+
+1. **Confidently-wrong restoration**: claiming restoration after reading only
+   the touched-file list or summary.
+2. **Partial restore**: reading the first few files, then continuing before the
+   full reading list is complete.
+3. **Skipping project instructions**: missing `AGENTS.md`, `CLAUDE.md`,
+   `README.md`, as-built docs, or codemaps that govern the task.
+4. **Treating the packet as exhaustive**: ignoring mission or workspace files
+   that are important but were not discovered by the script.
+5. **Waiting for the next task**: treating restore reading as conditional on a
+   future user assignment instead of completing it immediately.

package/daemon/context-packs/skills/claude-compaction-restore/manifest.yaml

@@ -0,0 +1,18 @@
+# GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
+# Package-time projection of a canonical skill; regenerated every build.
+name: "claude-compaction-restore"
+version: "0.5.7"
+taxonomy: "skills"
+purpose: "Use when a Claude Code session has just compacted, is about to compact, reached context limit, resumed after /compact, or needs to rebuild its working mental model from Claude JSONL transcripts and touched files."
+files:
+  - path: "SKILL.md"
+    role: "instruction"
+    summary: "Use when a Claude Code session has just compacted, is about to compact, reached context limit, resumed after /compact, or needs to rebuild its working mental model from Claude JSONL transcripts and touched files."
+  - path: "scripts/precompact-hook.mjs"
+    role: "reference"
+  - path: "scripts/restore-from-jsonl.mjs"
+    role: "reference"
+  - path: "templates/compact-instruction.md"
+    role: "reference"
+  - path: "templates/post-compact-restore-instruction.md"
+    role: "reference"