@openrig/cli 0.5.8 → 0.5.10

package/daemon/assets/plugins/openrig-core/skills/software-for-agents/SKILL.md

@@ -1,187 +1,19 @@
 ---
 name: software-for-agents
-description: |
-  Use when building, modifying, or diagnosing an OpenRig or studio-box system; when surprising behavior
-  looks like a code bug but may come from Markdown, YAML, JSON, bootstrap files, schemas, skills, or
-  conventions; or when deciding whether an agent-built studio app needs a separate mockup phase. NOT for
-  treating defects in OpenRig core or rigs.to as tolerable control-plane drift.
+description: >-
+  Use when older OpenRig instructions name software-for-agents or describe agent-in-the-middle or
+  studio software under the former skill name.
 metadata:
   openrig:
-    stage: factory-approved
-    audience: any agent building on OpenRig or a studio box — the first-load mental model
-    sibling_skills:
-      - forming-an-openrig-mental-model
-      - openrig-program-manager
-      - mission-slice-sop
-      - openrig-user
+    stage: deprecated
+    successor: agent-operated-software
+    remove_in: 0.6.0
 ---
 
-# Software for agents — the markdown control plane
+# Renamed to agent-operated-software
 
-## Where this applies — and where it does NOT (read this first)
+This is a one-release compatibility redirect. Load `agent-operated-software` for the maintained
+architecture and operating guidance. Do not extend or copy doctrine into this file.
 
-This mental model — *most bugs are coherence gaps, not code*; *ship-and-flag when unsure*; iterate fast —
-is scoped to **agent-managed software: the studio-box mini-apps and any agent-in-the-middle / rapidly-
-evolving lightweight UI** where an agent sits in the loop and downstream cleanup is cheap. It is NOT a
-universal license.
-
-**It does NOT apply to TRADITIONAL software held to a rock-solid, no-bugs bar:** the **OpenRig CLI
-surfaces**, the **OpenRig repo** (daemon / CLI / UI / adapters), and the **rigs.to website**. There, a bug
-is a bug — reproduce it, fix it in code, hold the full-rigor gate. Do NOT treat a real defect there as a
-markdown coherence gap, and do NOT "ship and flag." If you are building or fixing OpenRig core or rigs.to,
-the tolerance in this skill is OFF and `product-is-the-truth-not-the-proof` governs. **Know which lane
-you're in before you apply anything below.**
-
----
-
-You inherited the accumulated footgun-map of thousands of rigs that ran before you. They found and
-solved most of the traps. Your job is to find the *next* one and patch it at the precise optimal spot
-in the substrate, so the rig after you starts from a higher ledge. That is the actual work. Whatever
-you were "assigned" (a video, a feature, a fix) is the vehicle for surfacing it.
-
-## 1. This is not traditional software — it's a control plane made of markdown
-
-In traditional software a bug is a broken function you fix in code. Here, the system you operate in is
-an **agent-in-the-middle** system whose substrate is **markdown + YAML + JSON + folders**: skills,
-instructions, bootstrap files (`CLAUDE.md`/`AGENTS.md`), schemas, `culture.md`, mission/slice notes,
-conventions. **The agents ARE the backend.** So most "bugs" are not broken code — they are **coherence
-failures in the markdown layer**: an instruction that's unclear or missing, a schema that drifted from
-its documented state, a convention living in one seat's head instead of a skill.
-
-**Consequence:** when something surprises you, your first hypothesis is *"the control plane is unclear
-or drifted here,"* not *"the code is broken."* Sometimes it IS the code (fix it — don't overfit on
-markdown; see §5, and mind the scope block above: in OpenRig core / rigs.to the code IS the first
-hypothesis). But the highest-leverage fixes in the agent-managed layer are usually: make the substrate
-coherent again at the exact spot the confusion arose. Keep the markdown/schemas/conventions in sync with
-reality and the system **self-improves** — the next rig inherits the patched substrate and never re-hits it.
-
-## 2. Progressive disclosure — skills are a hot tier, not a manual
-
-Skills are misnamed. They are a **progressive-disclosure primitive**. Think CPU cache / hot storage
-tier: the **name + description of every skill is always ambiently loaded** — a hot tier of awareness
-the agent carries without opening anything. That is enormous leverage, good or bad. So:
-
-- **Write skill name + description as TRIGGERS** — *why/when do you reach for this?* — not as titles.
-  The hot tier's whole job is to fire when an agent doesn't yet know it needs the skill (the
-  "you don't know what you don't know" problem). This skill's own description is written that way.
-- **Reaching for a skill unfurls a trail.** A good skill routes you — breadcrumbs, pointers, maps —
-  so it becomes *inevitable* you find the exact context on disk for what you're doing.
-- **If the context doesn't exist, generate it.** A skill can ship **scripts** that produce context
-  optimally shaped for a decision, or that execute a fiddly API surface so you don't stumble through 12
-  tool calls discovering it. Use a **script as a prompt**: run it — if it works, the result IS your
-  context; if it fails, it should fail in a way that *teaches* you how the system works, so you can
-  read the script, understand the edge case, and do the thing manually. Scripts belong in the skill
-  folder next to the SKILL.md.
-
-## 2b. Self-certifying artifacts — the convention 5 seats (both models) converged on
-
-The single most expensive failure class in production is **not being able to tell a finished artifact
-from an unfinished one.** A mid-write file read as final; a render OOM-killed mid-write left a corrupt
-`.mp4` that passed a filename check; a truncated clip passed a duration check and froze on playback. In
-one build, five seats — Claude *and* Codex, independently — each invented a *different* ad-hoc
-completeness check (ffprobe moov, duration compare, filename convention, manifest assetExists, ffmpeg
-input count). Five blind spots. So make it ONE shared primitive:
-
-**When you author ANY tool that produces an artifact (render / composite / export / cut), it must
-self-certify:**
-1. Write to `<name>.partial` (never the final path directly).
-2. **Verify the content** — the specific property that can be wrong, not a proxy: moov atom present,
-   duration matches the intended window, audio stream present, colorspace/hue correct, resolution =
-   delivery res. (Filename ≠ correct; duration ≠ complete; "clean-encoded" ≠ right.)
-3. **`fsync`, then atomically `rename`** `<name>.partial` → `<name>` (rename is atomic; a half-written
-   file never appears at the real path).
-4. Write the manifest, then a **`.done` sentinel LAST.**
-
-Then *"is this finished?"* is **one `stat` of `<name>.done`** — identical for every tool, seat, watcher,
-and a compacted agent restoring cold (who is least equipped to know what was mid-write when the lights
-went out). **Consumers fail closed:** e.g. a swap-into-slot (`restore_occupant`) must refuse an artifact
-lacking `.done` or failing the verify-gate. This convention collapses the whole "content over filename,
-disk over memory" discipline into one check the substrate enforces for you. Build the sentinel; the
-workarounds disappear. (Code-side companion: a fail-closed verify-gate wired into the swap verb — a
-coordinated build with the tool owner, not a solo markdown edit.)
-
-## 3. Build it like software — piggyback on what agents are trained for
-
-Agents are fine-tuned to write code and build software; the harness itself is a terminal/coding
-instrument. So **whatever you're asked to build — even a video — map the process to a software SDLC**
-and you inherit all that baked-in muscle memory. This is why, e.g., the mini-NLE's beats carry
-reference IDs like `1.1 / 2.1`: a storyboard is the **human-facing visual metaphor**, but underneath it
-is a **specification** — sections, beats, success criteria, the thing being built.
-
-Use an **agent SDLC**, not the antiquated human one (which was shaped around human-org weaknesses):
-**intent → plan → spec → build → verify → review → QA → done.** The human slots in as **steering,
-judgment, taste, review**; the agents do the technical nitty-gritty, in parallel, fast. Map any
-"build X with agents" task onto this and the primitives (specs, locks, proof, verification) become
-intuitive instead of alien.
-
-## 4. Phases and the LOCK gate (spec-locking, not just "done")
-
-Building runs in **phases**, and each phase has a **lock gate** — you don't advance until the taste/
-steering owner has locked it. This is exactly *don't start building until the PRD is locked by product*:
-
-- **Storyboard / intent phase** — done on the **canvas** now (the highest-bandwidth human↔agent surface:
-  the human steers, chats, annotates/circles; agents build structure fast). Iterate here; get the
-  storyboard through the canvas gate. (Canvas largely replaced the NLE's old in-timeline storyboard.)
-- **Plan phase (brief, in the NLE)** — build the spine with placeholders so the human can click through
-  the main-stage player and *feel the flow* (sequencing problems surface when placeholders are strung
-  together with audio). **Lock every beat** = the spec is approved; this is what unlocks parallel build.
-- **Fill phase** — many agents build each beat in parallel, in clear lanes. **Lock a beat when it's
-  final** (`/api/approve`): lock means *don't touch, we're good, signal to everyone incl. the human.*
-  Unlock to revise. **All beats locked = done.**
-
-The lock is the "finished" primitive at the editorial layer. Locking a whole phase's beats before the
-next phase is the discipline that lets 10 agents work in parallel without catastrophic collisions —
-everyone knows the target, their lane, and who judges done (the **producer owns the final product**).
-
-## 4b. Studio apps skip the mockup phase — the build IS the mockup
-
-For a **studio app**, do not run a separate mockup phase. The whole point of the Studio is that a mockup
-buys you almost nothing here: **as fast as it takes to build a mockup, you can build the running app** —
-an unlock made possible by agentic engineering. A mockup is only ever a device to flesh out the PRD; once
-the PRD and its settled answers exist, that phase is **done**. The Studio is a lightweight, rapid-velocity,
-agent-in-the-middle leveraged system: build apps fast, iterate on them fast.
-
-The phase model above collapses accordingly:
-
-1. **The PRD + settled answers ARE the fleshed intent** — no separate mockup gate, no plan-lock-on-mockups step.
-2. **Spec-lock the WHAT** — `rig scope slice approve --scope spec` locks the intent the PRD already fleshed.
-3. **BUILD the app**, then **iterate on the RUNNING app at mockup speed** — the running thing is the
-   iteration surface, not an image.
-4. **LOOK is on the running screens** (any "mockup" proof tag now points at the running app's screens),
-   then **proof-lock** — `rig scope slice approve --scope delivery`. A slice is not done until every
-   proof-contract item has evidence from the **running app**.
-
-**Velocity is the METHOD, not a quality waiver.** The LOOK is still a real LOOK; the proof contract still
-binds at delivery. You are removing a redundant artifact, not lowering the bar.
-
-**Scope — this does NOT generalize** (consistent with the scope block at the top): it applies to the
-studio-app / agent-in-the-middle loop only. Outside that loop, a **locked design mockup that a slice must
-match is still legitimate** — do not strip mockups from traditional or design-locked work. Know which lane
-you're in. For the build mechanics, see the studio's build skill (`building-studio-apps`); this section is
-the *why* and *when*.
-
-## 5. Where to fix — and don't overfit on markdown
-
-- **Precise-spot discipline:** find the *one* place a coherence fix belongs (the skill, the schema, the
-  bootstrap, `culture.md`) so it can't recur — not a symptom patch. Ask: *what would have prevented
-  this for every future rig?*
-- **Don't overfit on the markdown layer** — deterministic code bugs exist and you should fix them. The
-  studio-box apps (NLE, canvas, media manager, shell) live in the **studio-box repo**, portable across
-  hosts (VPS/Mac/VM). **A code fix there fixes ALL studio boxes, not just this host** — so: clear bug or
-  broadly-useful feature → ship it; host-specific behavior → make it optional/guarded. When unsure, ship
-  and flag it; downstream cleanup beats you becoming the bottleneck. *(This ship-and-flag latitude is the
-  studio-box / agent-managed lane only — re-read the scope block: OpenRig core + rigs.to hold the
-  rock-solid bar, no ship-and-flag.)*
-- **Culture lives in `culture.md`** — the rig's social contract / constitution: how the team
-  coordinates, the parallel-agent lanes, the phase-locking discipline, who owns the final call.
-  Coordination is largely **emergent** (bottom-up, evolutionary pressure across thousands of rigs) — but
-  once a pattern proves out, *write it down there* so it's inherited, not re-discovered.
-
-## The one-line seed
-You're not maintaining code; you're **gardening a self-improving control plane made of markdown and
-schemas, using software-engineering muscle memory, with the lock as your spec-gate** — and every
-footgun you patch at the right spot (in the agent-managed lane) makes every future rig better. See also:
-`forming-an-openrig-mental-model` (the OpenRig runtime), `mission-slice-sop` (the SDLC operating
-procedure), `openrig-user` (the CLI surface), `product-is-the-truth-not-the-proof` (the doctrine that
-governs the rock-solid lane). *(The "agents ARE the backend" idea — agent-in-the-middle — is inlined in
-§1; a standalone `agent-in-the-middle` skill is a future candidate, not yet authored.)*
+Retirement: remove this redirect in 0.6.0 after the 0.5.9 compatibility window. Until then, the old
+identifier fails forward to the one editable body instead of silently disappearing.

package/daemon/context-packs/onboarding-width/manifest.yaml

@@ -1,6 +1,6 @@
 # Public capability and source-map width for the default onboarding walk.
 name: onboarding-width
-version: "0.5.8"
+version: "0.5.10"
 # OPR.0.5.6.10 — affordances knowledge (what this system can do) is world
 # content under the coining-session definitions.
 taxonomy: world

package/daemon/context-packs/onboarding-width/public-what-you-can-do.md

@@ -11,7 +11,7 @@ not know exists.** So the point of what follows is not skill. It is recognition:
 lands, something rhymes, and you go check instead of building.
 
 Eighty-one-plus top-level verbs ship (capability canon refreshed through
-`capability-delta-v0.5.7`). Read this once for shape, and let it make you suspicious that a thing
+`capability-delta-v0.5.10`). Read this once for shape, and let it make you suspicious that a thing
 already exists. Model-divergence proclamations are live product (trust them; pins use canonical
 model IDs).
 
@@ -32,6 +32,8 @@ one command away. Your memory of the fleet is a claim about the past.
   unless you ask for nodes.
 - **`rig discover`** — what is running on this box that OpenRig is *not* managing.
 - **`rig queue whoami`** — what the daemon thinks you are holding. Not what you remember holding.
+  When the seat's typed rows name exactly one work node, its JSON also carries `currentWork` with
+  the mission, slice, and path the refocus hook uses.
 - **`rig seat status <seat>`** — what the system already believes about a seat's handover state,
   and whether the thing you did an hour ago actually landed.
 - **`rig view list` / `rig view show <lens>`** — named lenses over coordination state: use
@@ -44,6 +46,11 @@ one command away. Your memory of the fleet is a claim about the past.
   daemon behaviour. They are configuration. **Watch one thing:** `source: default` does not mean
   "the documented default" — it means *derived on this box*, and can resolve somewhere quite unlike
   the path in the help text.
+- **`rig health`** — inspect bounded, explainable findings for the current seat, one stable seat,
+  a rig, or the local instance; `rig health explain <finding-id>` shows the exact window, source,
+  freshness, rule, evidence, confidence, and next inspection. Use the TUI's HEALTH tab for the
+  same records when a human also needs to see them. Empty output is never a healthy assertion,
+  list/explain never mutate, and diagnostic presentation remains explicit opt-in policy.
 
 ## Reaching another agent
 
@@ -53,7 +60,9 @@ unseen — which makes messages the one delivery channel that never gets skipped
 - **`rig send`** — put words in front of one seat, several, a pod, or a rig. **`--verify` checks
   pane-only delivery**: the text was staged at the far end, not that the agent consumed or acted
   on it. Alternate-screen and queued-command cases can still yield false negatives, so
-  consequential delivery gets an effect check at the far end rather than a blind retry.
+  consequential delivery gets an effect check at the far end rather than a blind retry. A
+  producer-link advisory reading `no_activity_signal` means activity could not be determined;
+  confirm by effect, never relaunch on it.
 - **`rig send --raw`** / **`--dangerously-interact --reason "<why>"`** — a seat is frozen on an
   interactive prompt or a permission block. Normal `send` *refuses* to answer a prompt on purpose;
   this is the deliberate override, and it is how you unblock a peer who cannot unblock itself.
@@ -84,9 +93,9 @@ unseen — which makes messages the one delivery channel that never gets skipped
   material without dumping it**: absorption between pieces is the whole mechanism, and sending
   faster than the receiver thinks merges everything into one turn and destroys it. It is also how
   you were onboarded, and how you would onboard someone else.
-- **`rig slack`** — how something reaches a person who is not at a terminal, and how their reply
-  gets back in as work. **`slack status` says it is configured; `slack verify` says it will
-  actually work.**
+- **`rig slack`** — inspect and manage one connector implementation. Use registered-human
+  readiness for the delivery decision and `queue create --verify` for its receipt; connector
+  setup or verification is not an outbound human message.
 
 ## Making work outlive you
 
@@ -105,7 +114,8 @@ your context, your compaction and your replacement — and it is the only thing
 - **`rig queue block` / `resolve`** — park a row on a real blocker so it stays **yours and
   visible**, with a plain-language summary and a pointer to what a human must judge; `resolve`
   writes their decision onto the durable record and wakes the owner. **Closing it would be a lie
-  and sitting on it silently is indistinguishable from a crash.**
+  and sitting on it silently is indistinguishable from a crash.** `--wake-after <duration>` arms
+  one wake for this park episode; a new park supersedes it and every exit route retires it.
 - **`rig queue overdue`** — what was claimed and never closed in time. **Defaults to the current
   rig**; ask for more if you mean more.
 - **`rig queue undelivered`** — pending create-path nudge failures only. For gateway or human
@@ -127,10 +137,13 @@ you that is still running.
 
 - **`rig watchdog register`** — arm a wake for a condition that will become true after you are
   asleep, compacted or finished. For a context wall, use the exact
-  `--policy context-usage-threshold` rather than a hand-rolled transcript timer.
+  `--policy context-usage-threshold` rather than a hand-rolled transcript timer. A scheduled
+  reminder arrives as the authored message under an explicit scheduler identity, not as YAML
+  syntax or anonymous agent input.
 - **`rig watchdog list` / `show` / `status` / `stop`** — did it fire, is it still live, did someone
-  stop it. **Quiet skips are not recorded**, so a healthy idle job and a job that never ran look
-  identical in `status` — INDETERMINATE is the honest read until `show` says otherwise.
+  stop it. `list` defaults to active, compact, and 100; `--all --full` is the complete history.
+  **Quiet skips are not recorded**, so a healthy idle job and a job that never ran look identical
+  in `status` — INDETERMINATE is the honest read until `show` says otherwise.
 - **An alarm whose message has gone stale is worse than no alarm.** When the thread it refers to
   closes, kill it or rewrite it — a successor inheriting an escalation order with no thread
   attached is worse off than one with nothing.
@@ -145,6 +158,10 @@ cheaper than being it.
 - **`rig workflow specs`** — what can be started here, and which are shipped versus authored by
   this rig.
 - **`rig workflow validate`** — will this spec instantiate at all, before a run finds out for you.
+- **`rig workflow compile <mission>`** / **`instantiate-lifecycle`** — derive one executable graph
+  from `project.yaml` → `mission.yaml` → `slice.yaml`, inspect it without writing, then start an
+  eligible graph with an opaque replay key. Typed acceptance candidate, verdict, and evidence
+  travel through `workflow project`; workflow completion alone is never release acceptance.
 - **`rig workflow instantiate`** — start a multi-step, multi-seat run as one governed instance with
   an entry packet that lands on a real owner.
 - **`rig workflow status`** — **which instances need *you*, right now**, with the reason and next
@@ -171,8 +188,11 @@ not have to tear one down to change it, and you rarely have to start from nothin
 - **`rig down`** — stop a rig's seats and take it out of the running set.
 - **`rig launch <rig> [seat]`** — one seat is down; start just that one, without disturbing the
   rest.
+- **`rig seat launch <seat> --fresh --reason <why>`** — deliberately create a blank occupant for
+  exactly one existing seat. It uses no resume, fork, rebuild, snapshot, or restore packet;
+  siblings and durable work stay put, and unmanaged ambiguity refuses.
 - **`rig add`** / **`rig expand`** — graft one more member, or a whole new pod, onto a rig that is
-  already running.
+  already running. `rig grow --new-pod` and `rig expand` are one ingress; choose by input shape.
 - **`rig remove`** / **`rig shrink`** — take a seat, or an entire pod, out of a running topology.
   If it holds active work, pass `--fallback <live-seat>` to reroute before mutation; without a
   valid fallback the command refuses rather than strand the rows.
@@ -201,7 +221,8 @@ not have to tear one down to change it, and you rarely have to start from nothin
 because someone lost work once.
 
 - **`rig start`** — the box rebooted and everything is gone: bring the whole topology back in one
-  move, rather than hand-restoring rig by rig.
+  move, rather than hand-restoring rig by rig. Selected-rig recovery now demands positive runtime
+  evidence and refuses stale identity by name rather than substituting an occupant.
 - **`rig daemon start` / `stop` / `status` / `logs`** — bounce the control plane, or read what it
   actually tried and refused, in its own voice.
 - **`rig doctor`** — is the *installation* wired up correctly, or are you chasing a bug that is
@@ -213,11 +234,19 @@ because someone lost work once.
   list with their exact remediation, mid-run cancel with `c`. It only offers RESTORE on POSITIVE
   down-evidence (confirmed-down vs cannot-verify are distinct screens).
 - **`rig snapshot`** — take a restore point **before** the risky thing. `snapshot list` shows what
-  you actually have and how old the newest is.
+  you actually have and how old the newest is; `--intended-seats` records the topology roster the
+  later restore must judge rather than treating every historical node as current.
 - **`rig restore`** — put a rig back to a snapshot. **`rig restore-check` first**: what would
   actually come back, and for everything that would not, which check fails and what the fix is.
+  Use `rig launch ... --snapshot-id <id>` when selection must be exact, and `rig restore status
+  <attempt> --rig <rig>` for the derived intended-set receipt after an asynchronous restore.
 - **`rig restore-packet write` / `read` / `validate`** — a seat is about to die or must move
   runtimes; capture what it knows into a portable artifact instead of losing it with the process.
+- **Upgrading is agent-led** — load the shipped `openrig-upgrade` skill for the bounded inspect,
+  backup, plugin-refresh, and 0.5.9 instance-migration helpers. The migration is an
+  Agent-Operated Workflow: inspect, take one bounded reversible action, verify its effect, and
+  continue from the receipt. There is no `rig upgrade` verb, and `rig down` is not part of a
+  continuity-preserving upgrade.
 - **A seat's `compaction_strategy` is declared, not improvised at the wall.** Pair a threshold-
   managed seat with the `context-usage-threshold` watchdog above so continuity is arranged while
   the seat can still act.
@@ -230,6 +259,9 @@ because someone lost work once.
 - **`rig seat set-model` / `stop` / `clean`** — persist the model for later managed resumes, stop
   exactly one live seat, or clear a dead seat's stale binding. When the topology is right and only
   the occupant is wrong, use these seat lifecycle verbs or `rig handover`, not a rig down/up cycle.
+  Effective-model detection follows the identity-verified current occupant, not a retained
+  predecessor; a `<synthetic>` transcript record is skipped, so a PENDING model check is not a
+  divergence.
 - **`rig compact-plan`** → **`rig compact`** — who is near the context wall, then act on it.
   **Ordering matters: running `compact` without the plan is guessing which seat needed it.**
 - **Know what compaction costs before you reach for it.** On some runtimes what comes back has
@@ -250,7 +282,9 @@ the tooling already reads. An agent who does not know this exists invents a priv
 scheme, and nothing downstream can see it.
 
 - **`rig scope mission ls` / `show` / `create`** — what work exists, what a mission is for, and how
-  to open one so it gets a stable dot-ID rather than being a bare folder nothing can address.
+  to open one so it gets a stable dot-ID rather than being a bare folder nothing can address. In
+  `rig tui`, SCOPES → select a mission shows the same story as DONE / NOW / NEXT / ATTENTION, with
+  row drill-in and Escape back.
 - **`rig scope slice ls` / `show` / `create`** — the same at the altitude where work is actually
   buildable. `show` gives you intent, frontmatter and children without guessing which of five files
   to open.
@@ -279,8 +313,10 @@ scheme, and nothing downstream can see it.
 - **`rig workspace doctor` / `validate`** — does the daemon agree with you about where the work
   tree is, and which files are missing the frontmatter their kind requires.
 - **`rig context work-install --project … --mission … --slice … [--deliver]`** — resolves the ordered
-  context plan; add `--deliver` to emit the exact extant files in that same order while marking
-  absent pieces visibly. Without the flag it remains plan-only.
+  System World, topology, and Project World plan. Add `--runtime` to see the composed managed skill
+  loadout, `--apply-skills` to reconcile its owned harness projection, or `--deliver` to emit the
+  exact extant files in order while marking absent pieces visibly. Without the flags it remains
+  plan-only.
 - **`rig context show` / `sync` / `rm`** — what is inside a context pack before you prime a seat
   with it, and how to make the library catch up when you edit one.
 - **`rig context get <name-or-ref>`** — pull exact context by address instead of reading files:
@@ -314,12 +350,17 @@ working arrangement becomes something someone else can instantiate.
 
 - **`rig spec validate` → `preflight` → `audit`** — three different questions, in order: is the
   file well-formed, would it boot *on this host*, and **will the agents it launches actually know
-  anything when they arrive**. The third is the one people skip.
+  anything when they arrive**. The third is the one people skip. Unknown structural keys refuse
+  with their path instead of being normalized away.
+- **`rig context trace --pod <pod>`** — walk the context chain through instance → rig → pod → seat
+  when the pod altitude matters.
 - **`rig specs show` / `preview` / `add` / `sync` / `rename` / `remove`** — where a spec lives,
   what you would get if you launched it, and how to put yours in the library so it is launchable
   by bare name.
 - **`rig export <rig>`** — turn a rig that is *running right now* back into a spec you can read,
   diff or hand to someone. **`rig import`** goes the other way.
+- **`rig import <workspace.yaml> --workspace-only --target-rig <id>`** — apply a validated
+  workspace declaration to an existing rig without changing topology; `rig export` preserves it.
 - **`rig bundle create` / `inspect` / `install` / `history`** — one file that rebuilds a rig on a
   machine with none of its content, what is inside one before you trust it, and what has actually
   been installed here.
@@ -343,8 +384,19 @@ reaching them is ordinary work rather than an escalation.
   than guessing a hostname, because entries do not all use the same transport.
 - **`rig file copy`** — move a file between hosts without hand-rolling `scp` and guessing the
   address.
-- **`rig gateway human add`** — make a *person* addressable, so an escalation reaches a named human
-  over a real connector instead of dying in a log.
+- **`rig gateway human list` / `show`** — discover registered humans and inspect configured,
+  enabled, active, ready, reason, and next action. Use the returned `<entityId>@external`
+  address; a username or kernel seat is not a human delivery address.
+- **`rig queue create --destination <entityId>@external --verify`** — persist one human
+  request, then boundedly inspect its transport receipt. Posted means posted, not read;
+  pending, failed, or indeterminate delivery leaves the row intact. Inspect the same row's
+  transitions before retrying. `rig send` remains agent-terminal delivery only.
+- **When project policy calls for human judgment or an update, load `messaging-the-human`.**
+  System World teaches these mechanics; Project World decides when and why they apply.
+  Existing `<entityId>@host` blockers are internal custody labels mapped through the registry
+  to the external participant, not a separate outbound route.
+- **`rig gateway human add`** — register a person and their connector binding. Registration or
+  connector changes do not themselves authorize a message.
 - **Across a host boundary, "it didn't work" has four distinct shapes** — unreachable machine,
   permission gate, remote runtime down, or the remote command itself failed. Collapsing them throws
   away a diagnosis you already had. **And a transport that succeeded says nothing about whether the
@@ -356,7 +408,9 @@ reaching them is ordinary work rather than an escalation.
 your circumstances is configuration, and the ones that are not, another agent can change for you.
 
 - **`rig config get` / `reset` / `init-workspace`** — read one value, change a system-wide setting
-  and put it back exactly as it was, or lay down the workspace tree on a box that has none.
+  and put it back exactly as it was, or additively lay down the canonical project scaffold on a
+  box that has none. Instance startup uses the same additive initializer for the surrounding
+  `state`, `context`, `skills`, `topology`, and operational roots.
 - **`rig policy list` / `show` / `current`** *(v0.5.2)* — what permission policy is actually in
   effect: discovers custom policy specs, validates refs (malformed can never read as valid OR
   absent), shows what would apply.
@@ -364,30 +418,36 @@ your circumstances is configuration, and the ones that are not, another agent ca
   loudly to report, whether to batch permission questions or block on them. **This declares a
   posture; it does not grant or deny permissions** — the harness's own settings are the control
   surface for that.
-- **The owner boundary is exactly: pushes and PRs.** Nothing else needs the owner's word — local
-  commits and ordinary apply work never do. When a script guard mentions being gated, it is
-  demanding an explicit path (e.g. `OPENRIG_SKILL_CANON_ROOT`), not permission; read it as a
-  missing input, never as an authorization wall.
+- **Project World declares the human authority boundary.** Read the current project and mission
+  policy for actions requiring approval; the system mechanics do not impose a universal list.
+  A script's explicit-path authoring guard (for example `OPENRIG_SKILL_CANON_ROOT`) asks for a
+  missing source path and does not itself create a permission gate.
 - **`rig auth list` / `validate` / `seats`** — is this seat's runtime actually logged in, which
   accounts exist, and which account each seat is *supposed* to be on.
 - **`rig provider accounts` / `bindings` / `signals` / `switch`** — which seats are bound to which
   accounts, what the usage signals say, and whether a seat can be moved without stranding the
   conversation it is in the middle of. **`provider signals` reports anomalies rather than a
   listing** — unbound seats, accounts shared across several seats.
+- **Codex configuration fragments** — a `codex_config_fragment` must open with a table header and
+  never overrides a user-declared table; see `docs/reference/agent-spec.md`.
 - **`rig env`** — the real services behind a rig: are they up, what are they saying, how do you
   stop them without killing the rig.
 - **`rig setup`** — what OpenRig would change about this machine, shown before it touches anything.
 - **`rig usage series`** — what a seat's token curve has looked like over time: climbing steadily,
   reset, or stopped reporting entirely. The last one is a signal, not a gap.
 - **`rig tui`** — the interactive view over rigs, pods, seats and specs. **`rig tui commands`**
-  lists everything it can do without launching it. **`rig ui open`** is unmaintained, best-effort,
-  and replaced by the TUI, so never diagnose product behaviour from the web UI. The TUI plus Slack
-  are the human surface; the CLI plus terminal are the agent surface.
+  lists everything it can do without launching it. Open the instance row for one continuous
+  cross-rig agent table with pod separators and material `RECENT` transitions; drill into a rig,
+  mission, slice, or agent without losing the owning identity. **`rig ui open`** is unmaintained,
+  best-effort, and replaced by the TUI, so never diagnose product behaviour from the web UI. The
+  TUI plus Slack are the human surface; the CLI plus terminal are the agent surface.
 - **`rig mcp serve`** — how an agent that speaks MCP rather than shell drives OpenRig, and which
   operations are exposed that way. Relevant the moment a tool you are integrating cannot run a
   shell command.
-- **`rig skill`** — how packaged capability gets routed and projected to seats. Worth knowing the
-  layer exists; it is mid-repair right now, so treat what is currently installed as in flux.
+- **`rig skill loadout --runtime <claude-code|codex>`** — inspect the exact catalog revision,
+  selectors, target, and current/missing/shadowed/conflicting state for one working directory.
+  `--apply` writes only the managed ownership set, is idempotent, and refuses local edits or
+  unowned collisions.
 - **`rig startup-proof submit`** — prove you actually oriented at boot, rather than claiming you
   read the prompt.
 

package/daemon/context-packs/skills/agent-operated-software/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: agent-operated-software
+description: >-
+  Use when designing, building, operating, or diagnosing an ongoing application whose live backend
+  or control loop includes OpenRig agents, including applications with a Markdown, YAML, or JSON
+  agent control plane or a thin surface over specialist agent roles.
+metadata:
+  openrig:
+    stage: provisional
+    audience: any agent building or operating an agent-backed application
+    sibling_skills:
+      - agent-operated-workflows
+      - forming-an-openrig-mental-model
+      - mission-slice-sop
+      - openrig-user
+---
+
+# Agent-Operated Software
+
+**Agent-Operated Software** is an ongoing application whose functioning runtime includes an OpenRig
+agent or rig in its live backend or control loop. The application surface can be thin: structured
+state and specialist roles do the work, while the UI makes that work legible and steerable.
+
+## Start with the shared taxonomy
+
+- **AI-enabled software:** application code owns the control loop and calls a model as one capability.
+- **Agent-Operated Workflow:** an agent owns one bounded procedure with a start and stop condition;
+  see `agent-operated-workflows`.
+- **Agent-Operated Software:** agents participate in an ongoing application's functioning runtime.
+
+An application may compose many Agent-Operated Workflows. A bounded workflow does not by itself make
+its surrounding product Agent-Operated Software, and a model call is neither category unless an agent
+owns part of the control loop.
+
+## Agents are part of the backend
+
+In this architecture, behavior is not located only in functions. It is distributed across agents,
+skills, instructions, bootstrap files, schemas, Markdown, YAML, JSON, folders, and deterministic
+tools. A surprising result may therefore be a code defect or a coherence gap in this control plane.
+Trace the path that actually produced the behavior before choosing which layer to repair.
+
+This is not permission to tolerate defects in OpenRig core or another rock-solid substrate. There,
+reproduce the bug, fix the code, and hold the full gate. The faster coherence-first posture belongs
+to recoverable agent-operated application layers whose state and behavior can be inspected and
+repaired cheaply.
+
+## Markdown is the control plane
+
+Markdown is maximally useful to an agent while remaining legible enough for a human to steer. Put
+intent, work state, evidence, and decisions into stable addressed artifacts rather than private chat
+or an opaque custom database. Keep schemas and conventions aligned with the running behavior: the
+agent population acts on those files as executable context.
+
+Use **progressive disclosure**. A skill's name and description are the hot trigger; its body is cold
+procedure. Descriptions say when to load, not how to work. The body should route the reader to exact
+sources instead of copying them into another doctrine fork.
+
+Scripts can act as prompts. A good script returns the context or exact effect an agent needs; when it
+cannot, its failure teaches what it observed, why it stopped, and safe next actions. Keep deterministic
+mechanics in tools and judgment in agents.
+
+## Make artifacts self-certifying
+
+When a tool produces an artifact, do not make every consumer invent a completeness test:
+
+1. Write to a partial path, never the final path.
+2. Verify the property that can actually be wrong, such as duration, streams, resolution, or schema.
+3. Flush and atomically rename the partial artifact to its final path.
+4. Write the manifest, then a `.done` sentinel last.
+
+Consumers fail closed on the shared proof. A filename or exit code is not content verification.
+
+## Build with an agent SDLC
+
+Map work onto **intent -> plan -> spec -> build -> verify -> review -> QA -> done**. The human supplies
+steering, judgment, taste, and the call on irreversible ambiguity; agents perform and coordinate the
+technical work. Locks freeze the agreed spec and accepted delivery so multiple seats can work without
+guessing whether the target moved.
+
+For studio applications, the running product is usually the best iteration surface. A separate mockup
+earns its cost only when it resolves a real design uncertainty that the running app cannot expose as
+cheaply. This removes a redundant artifact, not the visual review or proof contract.
+
+## Repair the narrowest authoritative layer
+
+Find the generator or source that every affected agent actually consumes. Fix a code defect in code;
+fix a missing trigger in the skill; fix a malformed contract in its schema. Then verify through the
+consumer. Editing a rendered or installed copy creates a temporary fork, not a repair.
+
+The payoff compounds: a correction to the shared application control plane changes the next agent's
+starting point. That is how an ongoing agent-operated system improves without making one human its
+permanent router.

package/daemon/context-packs/skills/agent-operated-software/manifest.yaml

@@ -0,0 +1,10 @@
+# GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
+# Package-time projection of a canonical skill; regenerated every build.
+name: "agent-operated-software"
+version: "0.5.10"
+taxonomy: "skills"
+purpose: "Use when designing, building, operating, or diagnosing an ongoing application whose live backend or control loop includes OpenRig agents, including applications with a Markdown, YAML, or JSON agent control plane or a thin surface over specialist agent roles."
+files:
+  - path: "SKILL.md"
+    role: "instruction"
+    summary: "Use when designing, building, operating, or diagnosing an ongoing application whose live backend or control loop includes OpenRig agents, including applications with a Markdown, YAML, or JSON agent control plane or a thin surface over specialist agent roles."