@openrig/cli 0.6.11 → 0.6.12

package/daemon/context-packs/skills/core/openrig-software-factory/references/worked-example.md

@@ -22,7 +22,8 @@ boundary, acceptance and evidence pointers; create it before sending:
 ```sh
 rig whoami --json
 rig queue create --destination dev-build@starter \
-  --body-file ./TASK.md --summary 'Implement the agreed CSV inspection' --json
+  --body-file ./TASK.md --summary 'Implement the agreed CSV inspection' \
+  --tags 'project:<id>,mission:<id>,slice:<id>' --json
 rig queue claim <returned-qitem-id> --json
 ```
 
@@ -30,7 +31,8 @@ After implementing and checking the cumulative candidate, the current owner uses
 
 ```sh
 rig queue handoff <owned-qitem-id> --to dev-review@starter \
-  --body-file ./REVIEW-REQUEST.md --json
+  --body-file ./REVIEW-REQUEST.md --summary 'Review the CSV inspection candidate' \
+  --tags 'project:<id>,mission:<id>,slice:<id>' --json
 ```
 
 The request binds exact candidate, acceptance, commands and evidence. Read the
@@ -177,10 +179,11 @@ task instead of duplicating it):
 ```sh
 rig queue create --destination dev-parser@starter \
   --body-file "$PROJECT_ROOT/.openrig/factory/TASK-A.md" \
-  --summary 'Implement the agreed independent change A' --json
+  --summary 'Implement the agreed independent change A' \
+  --tags 'project:<id>,mission:<id>,slice:<id>' --json
 ```
 
-Use actual project/mission/slice tags where applicable. Read back the returned ID
+Use the project, mission and slice the work belongs to. Read back the returned ID
 with `rig queue show <id> --full --json`; A claims it as itself. Use the earlier
 queue loop for results, review and blockers. Existing Workflow-bound work keeps
 its packet/projection contract: adding a seat does not revise a running graph or

package/daemon/context-packs/skills/core/openrig-upgrade/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-upgrade"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when an agent is preparing or performing an OpenRig CLI/daemon upgrade and must preserve live seats, verify each mutation, or reconcile managed plugin and skill files without overwriting local work."
 files:

package/daemon/context-packs/skills/core/rig-bundles-and-shareable-artifacts/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "rig-bundles-and-shareable-artifacts"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when authoring or installing a rig bundle (packaged, shareable artifact that instantiates an opinionated OpenRig topology + workflow), reasoning about the bundle vs extension boundary, or auditing a bundle for portability. Covers the 4 failure modes that prevent bundles from working anywhere but the operator's machine, and the inspect-before-install discipline."
 files:

package/daemon/context-packs/skills/core/rig-lifecycle/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "rig-lifecycle"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when reasoning about the rig lifecycle operations family (create / start / stop / resume / restore / snapshot / release / unclaim / destroy), reading or trusting `rig ps` / lifecycle projections after recovery, or designing proof for a lifecycle scenario. Covers the 4 failure modes (auto-restore creates partial rig; projections report healthier than reality; provider auth treated as impl work; resume succeeds for one runtime fails another) plus the restore-honesty rule (failed resume is FAIL"
 files:

package/daemon/context-packs/skills/core/session-source-fork/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "session-source-fork"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when authoring a rig spec member or `rig expand` payload that needs to start a new managed seat from a prior runtime conversation source — `session_source: { mode: fork, ref: { kind, value } }`. v1 supports `mode: fork` with `ref.kind: native_id` for Claude and Codex. The new seat persists a NEW post-fork token; the parent token is NEVER written onto the new seat. NOT for restoring an existing seat or for artifact-backed mental-model rebuild."
 files:

package/daemon/context-packs/skills/core/specification-system/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "specification-system"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when authoring rig specs, agent specs, workflow specs, startup/context fragments, operating-mode declarations, or designing the user spec library. Covers the 4 failure modes (spec instantiates topology but not workflow/mode; spec depends on local paths and fails on another host; agents modify specs as one-off files instead of preserving reusable intent; validation proves YAML shape but not whether topology can run) and the validation-vs-runtime-realization distinction."
 files:

package/daemon/context-packs/skills/core/topology-mutation-and-seat-management/SKILL.md

@@ -112,7 +112,7 @@ Per `cli-reference.md` v0.2.0:
 - `rig grow <rig-id> <member...> [--pod <pod> | --new-pod <pod>] [--runtime <runtime>] [--cwd <path>]` (added after v0.2.0; check `rig grow --help`)
 - `rig expand <rig-id> <pod-fragment-path>` (with optional `session_source`)
 - `rig shrink <rigId> <podRef>`
-- `rig launch <rigId> <nodeRef>`
+- `rig launch <rig> <nodeRef>` (the rig's name or ID)
 - `rig remove <rigId> <nodeRef>`
 - `rig discover [--draft]`
 - `rig bind <discoveredId> --rig <rigId> (--node <id> | --pod <ns> --member <name>)`

package/daemon/context-packs/skills/core/topology-mutation-and-seat-management/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "topology-mutation-and-seat-management"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when changing a rig while it is alive — `rig grow` / `rig expand` / `rig shrink` / `rig launch` / `rig remove` / `rig discover` / `rig bind` / `rig adopt` / `rig attach`. Covers the 4 failure modes (newly created seat lacks queue/startup/role; edges and permissions not updated; adopt/bind succeeds at tmux but not OpenRig identity; shrink/remove leaves stale topology references) and the rule that mutation must work while the rig is active, not just in clean fixtures."
 files:

package/daemon/context-packs/skills/core/watchdog/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "watchdog"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when configuring `rig watchdog` policies, authoring wake/refocus/alignment-checkpoint messages, or choosing the right intervention level for a stale-owner situation. The 3-level continuity-check stack (wake / refocus / alignment-checkpoint), the discipline that prevents cadence pollution and bureaucracy theater, and the artifact-pool loop-edge pattern for evidence-aware waking."
 files:

package/daemon/context-packs/skills/delegating-work/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: delegating-work
-description: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams abandon subagents."
+description: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context — or how to brief the agent you hand it to, which depends on the model it runs. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams abandon subagents."
 metadata:
   openrig:
     stage: field-captured
@@ -36,11 +36,31 @@ Before delegating to a blank slate, ask: **would a wrong-but-plausible answer he
 ## It generalizes
 This is really **"route work to whoever holds the context,"** with subagents as the option for work that needs none. The audience is **every agent** — implementers and QA seats make this call as much as orchestrators do.
 
+## Check what kind of agent you're handing it to
+How to brief another agent depends on the model it runs, so check before you hand over anything open-ended.
+`rig ps --nodes --json` shows the model each seat's spec declares (`model`; `null` if none is declared). A declared
+model can differ from the one running, so if it's null, or you aren't sure, ask the seat which model it's running.
+
+- **Goal-oriented models** are built to take a goal and find the route themselves. Today that's Claude Opus 5.5 or
+  newer and any Fable model, and Codex models at the Sol level or above from GPT-5.6 on (GPT-5.6-Sol, GPT-6-Sol,
+  GPT-6.1-Sol, GPT-6-Astra). Give them the goal, why it matters, what good looks like, the requirements and the
+  context, then let them work. Spell out the route only where those details really matter.
+- **Every other model, and any model you can't identify,** does its best work on smaller, simpler pieces with clear
+  steps, clear boundaries and a result you can check. Split open-ended work before you hand it over, or keep the
+  open-ended part yourself.
+
+Describe the task, not the agent: don't tell a model which group it's in, or call it weaker. A model can take a
+label like that literally and work down to it. A newer model in a family above (a later Opus, Fable, or Codex Sol or
+Astra) belongs with the goal-oriented group. A model the lines above can't place, such as a new family or an unfamiliar
+tier, starts in the second group until you know where it sits; its maker's own description (frontier or workhorse,
+versus balanced, fast or affordable) is a good first signal.
+
 ## Hand over intent, not instructions
-Whoever does the work, give them the goal, why it matters, the context you hold and where to find more, then let
-them decide how. When you have the requester's own words, pass them on instead of compressing them into a list of
-steps. A capable agent with the goal builds better than one painting inside a narrow spec, which gets exactly what
-was written and not what was wanted. Keep exact instructions for the few things that must be exact, and say why.
+Whoever does the work, give them the goal, why it matters, the context you hold and where to find more. When you have
+the requester's own words, pass them on instead of compressing them into a list of steps. A goal-oriented model builds
+better from that than from a narrow spec, which gets exactly what was written and not what was wanted, so let it
+decide how; don't pre-do its research or fence what it may conclude. For other models, add the steps and boundaries
+the work needs, a piece at a time. Keep exact instructions for the few things that must be exact, and say why.
 
 ## Once you've decided
 - Decided on subagents for 2+ independent tasks → `dispatching-parallel-agents` (the fan-out mechanics).

package/daemon/context-packs/skills/delegating-work/manifest.yaml

@@ -1,10 +1,10 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "delegating-work"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
-purpose: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams a"
+purpose: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context — or how to brief the agent you hand it to, which depends on the model it runs. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-developme"
 files:
   - path: "SKILL.md"
     role: "instruction"
-    summary: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams a"
+    summary: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context — or how to brief the agent you hand it to, which depends on the model it runs. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-developme"

package/daemon/context-packs/skills/forming-an-openrig-mental-model/SKILL.md

@@ -117,7 +117,9 @@ read only the pieces a task needs.
 
 The session-name format `{pod}-{member}@{rig}` is your address. When you
 run `rig whoami --json`, you get back your full topology context: rig name,
-pod, member, peers, edges, transcript path.
+pod, member, peers, edges, transcript path. With `output.compact` enabled,
+a large rig's peer list can be a bounded, edge-first selection: `peersNote`
+then says how many are not shown; `rig whoami --json --all-peers` lists them all.
 
 ---
 
@@ -232,7 +234,7 @@ OpenRig has a few load-bearing cultural principles. Internalize these:
 If you're booting into a new seat in an OpenRig rig:
 
 1. **`rig whoami --json`** — recover identity. Know your rig, pod, member,
-   peers.
+   peers (`--all-peers` when `peersNote` says some are not shown).
 2. **Read your role guidance** — typically delivered via startup files.
    `guidance/role.md` for your specific seat.
 3. **Read the rig's `CULTURE.md`** if it has one — the team operating

package/daemon/context-packs/skills/forming-an-openrig-mental-model/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "forming-an-openrig-mental-model"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when the system around you does not make sense yet: you just booted into a seat and do not know how the pieces fit; someone said rig, pod, seat, fleet, topology, or slice and you are not certain what they mean here; you are unsure what kind of rig you are in or what it is for; you do not know how skills reach you or where context comes from; or you are about to act on a guess about how OpenRig works. Gives the runtime mental model fast, so you stop guessing."
 files:

package/daemon/context-packs/skills/loading-addressable-markdown/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "loading-addressable-markdown"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when a mission, slice, dashboard, or task references Markdown as path#h2-slug or path#h2-slug/h3-slug outside the OpenRig context-pack library."
 files:

package/daemon/context-packs/skills/mission-slice-sop/SKILL.md

@@ -66,7 +66,7 @@ These three are a division of labour, not a chain of gates. One agent may hold a
 ### PROGRESS.md
 - **WHO:** the orchestrator owns the current state; every agent logs its own outcomes.
 - **WHEN:** on material delivery-state changes and at acceptance.
-- **HOW:** keep current delivery state in `## Current state`; append material outcomes with links to proof under `## Outcomes`. Retain historical entries and existing checkboxes without treating them as current acceptance authority. For a selected proof policy, use `rig proof show <slice>` for current readiness; keep frontmatter `stage`/`verified` honest.
+- **HOW:** keep current delivery state in `## Current state`, naming who the next move waits on, and check that against the source (the PR on GitHub, the queue) before you rely on it; append material outcomes with links to proof under `## Outcomes`. Retain historical entries and existing checkboxes without treating them as current acceptance authority. For a selected proof policy, use `rig proof show <slice>` for current readiness; keep frontmatter `stage`/`verified` honest.
 
 ### PROOF.md + proof/
 - **WHO:** the impl/QA pair that worked the slice.
@@ -90,6 +90,15 @@ End every turn by passing the ball — a `rig queue handoff` to the next agent.
 
 Never go idle holding a baton.
 
+## Records
+
+The rules for recording a slice's state are in the conventions SSOT (`docs/reference/sdlc-conventions.md` in the OpenRig source repository, `$OPENRIG_HOME/reference/sdlc-conventions.md` when installed). Read them before you stamp, judge or report:
+
+- **Stamps, stages and proof:** A2 (`rig proof judge`, `rig scope slice stage` and `verified`) and B2–B3 (`rig scope slice approve --scope spec|delivery`, `rig proof add` and `--candidate-sha`).
+- **Built and merged:** the release-mission paragraphs of A1 (`candidate:<sha>`, `merged:<pr-number>`, `arrangement.source.integration_ref`).
+- **Dispatch data:** the DISPATCH DATA row of the component menu (the `worktree_path=` body line).
+- **Editing judged evidence resets the judgment.** An accepted `rig proof judge` records the sha256 of the evidence it cites; edit that evidence (the cited section, when it cites a heading), the contract item's text or the scope's proof policy, and the item reads `unknown` until you judge it again.
+
 ## Verify (deterministic backstop)
 
 Run `rig scope audit` at slice-close. Every convention check is **advisory / fail-open** — it records and advises, never blocks a write. Fix what's real, skip what isn't, keep moving. **A clean audit score is not required to proceed.**

package/daemon/context-packs/skills/mission-slice-sop/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "mission-slice-sop"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when starting, building, handing off, restoring, or closing a mission or slice under the default lightweight SDLC."
 files:

package/daemon/context-packs/skills/openrig-operating-model/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-operating-model"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when you do not know WHERE something belongs: you learned a lesson and are unsure which file takes it; you are about to create a new doc, folder, or convention; you are asking \"should this be a skill, a note, or a chain file?\"; you inherited a seat and want to know what SHOULD exist; or you are about to duplicate knowledge that already has a home. Also the trace-to-root: how a seat orients by reading one filename at each level from where it stands up to the fleet."
 files:

package/daemon/context-packs/skills/openrig-user/SKILL.md

@@ -54,7 +54,8 @@ Use for any substantive work that must not fall through chat — slice handoffs,
 guard verdicts, QA results, full-tip reviews, multi-item batches. Survives agent
 restarts. Tracked in the daemon SQLite schema. Surfaces in Project / queue views
 + in the destination seat's inbox. Tag with mission / slice / gate / checkpoint
-so future-you (and any peer) can find it.
+so future-you (and any peer) can find it. Give the row a `--summary` (its subject, wherever the row is listed)
+and the `project:`, `mission:` and `slice:` tags when it is project work.
 
 Body discipline: substantive bodies go through **`--body-file <path>`** (or `-` for stdin) — the
 purpose-built, corruption-safe surface (it kills the backtick-shell-corruption class for multi-line
@@ -66,7 +67,8 @@ Example:
 ```bash
 rig queue create \
   --destination dev-reviewer@example-project \
-  --tags "mission:data-import,slice:import-report" \
+  --summary "Review the import report: it changes how rows are deduplicated" \
+  --tags "project:example-project,mission:data-import,slice:import-report" \
   --body-file /tmp/import-report-handoff.md
 ```
 
@@ -83,7 +85,8 @@ Example:
 ```bash
 rig queue handoff <qitem-id> \
   --to dev-reviewer@example-project \
-  --tags "mission:data-import,slice:import-report" \
+  --summary "Review the import report: it changes how rows are deduplicated" \
+  --tags "project:example-project,mission:data-import,slice:import-report" \
   --body-file /tmp/import-report-handoff.md
 ```
 
@@ -355,12 +358,16 @@ restore) into one call.
 
 ```bash
 rig start                    # interactive: daemon + kernel + pick-and-restore
-rig start --last             # headless: restore all rigs that were last running
+rig start --last             # headless: restore rigs that were last running; a rig stopped on purpose stays down
 rig start --all              # headless: restore all rigs with restore-usable snapshots
 rig start --rigs <name> [<name>...]   # headless: restore only the named rigs
 rig start --json             # JSON output for agents
 ```
 
+`rig start --last` keeps down a rig that was stopped on purpose (`rig down` or `rig seat stop`).
+Bring it back with `rig start --rigs <rig>`. A rig whose seat statuses can't be read is still
+attempted, with a warning (`seat_status_unreadable`).
+
 Framing: `rig start` is the RECOVERY entry point, not the getting-started
 hero. The fresh-user boot hero remains `rig up <team>` (typically
 `rig up starter` for a first change, or `rig up factory`). Reach for `rig start` after a host reboot, daemon
@@ -500,11 +507,12 @@ rig ps --active             # opt-in active-state filter (does NOT change the al
 ```bash
 rig whoami                  # compact: identity + peers names + edges + transcript path
 rig whoami --json           # compact JSON
+rig whoami --json --all-peers  # compact JSON with every peer, when output.compact bounds the list
 rig whoami --full           # complete payload (v0.3.4 default shape)
 rig whoami --verbose        # alias of --full
 ```
 
-The first command every agent runs on boot AND every compaction-restore. The compact default keeps identity-recovery essentials (`identity`, `peers` names + sessionNames, `edges` directional `kind` + `to.sessionName`, `transcriptPath`). `--full` adds `contextUsage`, `commands`, `peersNote`, `runtimeContext`. The compact-default is an ALLOWLIST projection — future payload fields default to `--full` and cannot silently re-bloat the every-boot path.
+The first command every agent runs on boot AND every compaction-restore. The compact default keeps identity-recovery essentials (`identity`, `peers` names + sessionNames, `peersNote`, `edges` directional `kind` + `to.sessionName`, the transcript path). `--full` adds `contextUsage`, `commands`, `runtimeContext` and `workspace`. With `output.compact` on, compact JSON lists at most `output.whoami_peers` peers (default 8): edge peers first, then your pod, then roster order. `peersNote` and `peersOmitted` then say how many were left out, and `--all-peers` lists every one; `edges` stays complete. The compact-default is an ALLOWLIST projection — future payload fields default to `--full` and cannot silently re-bloat the every-boot path.
 
 ### `rig queue list` — active-frontier + docker/kubectl grammar
 
@@ -519,7 +527,7 @@ rig queue list --mine                # just the caller's items
 rig queue list --destination <s>     # destined to <s>
 rig queue list --source <s>          # sourced by <s>
 rig queue show <qitemId>             # bounded single-item body preview
-rig queue show <qitemId> --full      # complete body and chain fields
+rig queue show <qitemId> --full      # complete body and chain fields; a closed row adds closingTransition (the close's state, reason, target, actor, time and note)
 ```
 
 Four orthogonal axes (scope × history × field-breadth × encoding), all composable. **STOP using bare `rig queue list` as the cross-rig firehose.** Default is now active + compact + current-rig. Cross-rig history with full bodies is opt-in via `-A -a --full`; request only the breadth and fields needed for the question.
@@ -938,6 +946,88 @@ rig auth seats … --runtime codex         # seat -> profile registry (metadata
 
 **Hard secret boundary:** no token value is ever printed, logged, queued, streamed, or committed; status/validate report presence/mode/login-state only; seat labels are metadata, not live-account proof. MVP is `--runtime codex`; other runtimes use the same surface with a different `--runtime`, never a parallel command.
 
+### Manage subscriptions across a fleet (when the person asks you to)
+
+**This applies only when both hold:**
+- the daemon's `provider.subscription_moves` setting is on. It's off by default; the person turns it on with
+  `rig config set provider.subscription_moves true`;
+- the person has asked you to manage their subscriptions.
+
+Otherwise, don't take this job on. Installing or upgrading OpenRig appoints no agent, launches no bundle and starts no
+rotation.
+
+When a person runs several Claude and Codex subscriptions across machines, the fleet studio bundle's one agent is meant
+to keep work running, through the Fleet app. Until that bundle is available, the agent the person asks to manage their
+subscriptions can use this section. If that's you, you decide which subscription or home moves, and when. You decide
+from:
+- the usage and assignment readings, and their freshness;
+- the move record;
+- the person's standing preferences.
+
+You say why, and you see the outcome through. OpenRig gives you the facts and the tools; it never decides for you,
+and there's no threshold to obey.
+
+**Who decides:**
+- **The person's operator agent** can ask you for a move, or look at the record. It doesn't make competing moves of
+  its own.
+- **One agent manages subscriptions:** the one the person asked, or the fleet studio's agent once that bundle is
+  available. There's no other fleet-manager role and no automatic manager. Use the commands below directly; no extra
+  hand-off is needed.
+- **The Observatory is optional:** it can show your moves and readings, but you don't need it to rotate.
+
+**The unit is a Codex home, with every seat on it.** Moving some seats on a shared home to a different account, and
+moving Claude seats, aren't supported moves yet: say so instead of improvising.
+
+1. **Know the subscriptions.**
+   - Each subscription is reached through a saved profile on a home (`rig auth list` and `rig auth save`) on each
+     machine. Which seats use which profile is `rig auth seats`, and that's metadata: not proof of a live account.
+   - Check you can read each subscription's usage, and name any you can't.
+2. **Read before deciding.**
+   - Use `rig provider status --all-hosts --json` (add `--refresh` for fresh native readings). Each allowance has
+     its windows, reset times and when it was observed.
+   - **One allowance seen on two machines is one allowance:** never add its headroom twice.
+   - **A stale reading** is usable only with its age recorded, or after a refresh.
+   - **An unknown or unavailable reading is never room.**
+   - **Equal reset times don't mean the same account.**
+   - **A seat's link to a subscription is observed, configured or unknown.** Only an observed link shows the seat
+     actually uses it; a configured one (a profile, a registry row) is a claim.
+3. **Decide, and leave seats alone for a reason.**
+   - `rig seat restart <seat> --keep-conversation --plan` shows what a restart keeps, and every peer on the same
+     home. Moving the home moves them all.
+   - Skip a seat that's mid-turn, running a service, or about to finish, and record why.
+   - The person's standing preferences ("never move the reviewers") are yours to follow and record.
+4. **Move the home.**
+   - On that machine, `CODEX_HOME=<that home> rig auth switch <profile> --runtime codex`. `rig auth` acts on
+     `CODEX_HOME`, or on the default home, and `rig auth status` prints which home it means: check it before
+     switching.
+   - Then restart each chosen seat: `rig seat restart <seat> --keep-conversation --reason "<why>"`.
+   - After it completes a real tool-using turn, check it: `rig seat restart <seat> --keep-conversation --verify
+     --expect-account <the target's Account line>`. `--verify` only checks; it never restarts. Only that check
+     reports `moved`, and anything less is unconfirmed.
+   - **A slow reply isn't a failure:** never restart a seat a second time. Follow up at your next look.
+5. **Record every move, partial or unconfirmed included,** with `rig provider moves record --file <move.json>`
+   (`--help` shows the shape):
+   - the home and machine;
+   - from and to, as labels;
+   - your reason;
+   - each reading you acted on, with its observation time;
+   - each seat's result (`moved`, `unconfirmed` or `unknown`) with its evidence or what's missing;
+   - the peers, for example "not restarted; account unverified".
+
+   A seat marked `moved` needs its `evidence`, and an `unconfirmed` or `unknown` one needs what's `missing`. A home
+   switched with every seat left as a peer is still a move to record, with `seats: []`. A follow-up that confirms an
+   earlier unconfirmed seat records a new move with `supersedes`. Asked "why did this
+   seat move?", answer from `rig provider moves --seat <seat>`. Never put credentials in a record.
+6. **When a sign-in is needed:**
+   - Ask the person once, durably: a queue item to their seat, naming the machine and the subscription.
+   - Move nothing onto that subscription until it's done.
+   - On later wakes, check that item instead of asking again. Carry on with everything else.
+7. **When nothing has room:** say so, with the reset times. Never fall back to an API key, buy anything, or create an
+   account.
+
+**What wakes you:** a watchdog, a usage-limit park on the queue, or the person asking. How often you look is your
+judgment within those.
+
 ## Context packs and paced delivery (0.5.0)
 
 **Compose context once, hand it to a seat cleanly.** A library primitive plus a set of delivery flags. The rule that keeps the grammar coherent — internalize this one: **the noun stores and composes; the verbs deliver.** `rig context` never sends anything; delivery is only ever `rig send` / `rig broadcast` / `rig walk` / `rig queue`.
@@ -984,7 +1074,8 @@ Walk a seat *through* a pack: each piece is sent into the pane, spaced by `--pac
 - **The orchestrator habit — assign work *with* its context attached:**
   ```bash
   rig context compose --out packs/qitem-brief --from <brief-file> <proof-file>
-  rig queue create --destination dev-driver@build --body-context packs/qitem-brief --summary "…"
+  rig queue create --destination dev-driver@build --body-context packs/qitem-brief \
+    --summary "…" --tags "project:<id>,mission:<id>,slice:<id>"
   ```
   Replace `<brief-file>` and `<proof-file>` with your existing local files. The curated context rides the durable handoff, survives compaction, and is auditable.
 
@@ -1280,8 +1371,8 @@ This lets ordinary agents ask the manager for OpenRig help instead of every agen
 ```bash
 rig grow <rig-id> <member...> [--pod <pod> | --new-pod <pod>] [--runtime <runtime>] [--cwd <path>] [--json]
 rig expand <rig-id> <pod-fragment-path> [--rig-root <path>] [--json]
-rig launch <rigId> <nodeRef> [--json]
-rig launch <rigId> --seats <a,b,c> [--hold-reason <text>] [--json]
+rig launch <rig> <nodeRef> [--json]
+rig launch <rig> --seats <a,b,c> [--hold-reason <text>] [--json]
 rig remove <rigId> <nodeRef> [--json]
 rig shrink <rigId> <podRef> [--json]
 rig unclaim <sessionRef> [--json]
@@ -1294,8 +1385,9 @@ or `rig add` (one member) when a seat needs an explicit model, a permission poli
 different agent spec or role profile, per-seat runtime or cwd, or startup files.
 
 Node-granular managed partial restore (v0.3.4+):
-- `rig launch <rigId> <nodeRef>` relaunches a single seat by logical id or node id through orchestration.
-- `rig launch <rigId> --seats <a,b,c>` relaunches a comma-separated subset of seats.
+- `rig launch <rig> <nodeRef>` relaunches a single seat by logical id or node id through orchestration. `<rig>` is the
+  rig's name or ID; a name shared by more than one active rig stops with the candidate IDs.
+- `rig launch <rig> --seats <a,b,c>` relaunches a comma-separated subset of seats.
 - `--hold-reason <text>` records a reason for holding non-target seats during the partial launch.
 - This is a SUPPORTED managed path. The prior `pod_aware_launch_unsupported` dead-end is retired; pod-aware narrow launch now goes through this surface rather than ad-hoc rebuilds.
 
@@ -1370,6 +1462,75 @@ Current shipped MCP tools:
 - `rig_capture`
 - `rig_chatroom_send`
 - `rig_chatroom_watch`
+- `rig_add`
+- `rig_queue_create`, `rig_queue_show`, `rig_queue_list`, `rig_queue_claim`, `rig_queue_update`
+
+The server acts as one seat: the `OPENRIG_SESSION_NAME` in its environment. Every request carries that identity, so
+no tool call names a sender. Without it, writes that need an actor are refused with `actor_required`.
+
+### Join a team from an agent with no terminal of its own (desktop apps)
+
+An agent in a desktop app can work with a team as a seat through this MCP server. If the app gives it a shell, it can
+use the `rig` CLI instead, the same way.
+
+1. **Attach once.** With its shell, or by asking the person to run it:
+   `rig attach --self --rig <rigId> --pod <namespace> --member <name> --runtime <runtime> --print-env`.
+   Note the `OPENRIG_SESSION_NAME` it prints.
+2. **Give the person the MCP entry to add.** Don't edit their app's settings yourself. The entry runs
+   `rig mcp serve`, with `OPENRIG_SESSION_NAME=<that seat>` in its environment. Most MCP clients take it as a
+   command, arguments and an `env` map.
+3. **Hand off work** with `rig_queue_create`, and keep the `qitemId` it returns.
+4. **Read the answer** with `rig_queue_show <qitemId>`. The item's state, closure and transition notes are where the
+   assignee records it. A call that times out has an unknown outcome: check `rig_queue_show` with the same id
+   before you retry, and retry only with that id.
+5. **Take work** with `rig_queue_list` (`owned: true`), `rig_queue_claim` and `rig_queue_update`. Close with the
+   answer in `note`.
+
+Limits today:
+- **OpenRig can't wake this agent itself.** `rig send` to an attached external node is refused, and a task's nudge to
+  it is unroutable. It sees new work when it checks `rig_queue_list`, or, if its app can run background shell
+  commands, with the opt-in wait below.
+- **Proven surfaces:** treat each app, and each mode inside one, as unproven until it has been run there.
+
+#### Wake on new work (opt-in; off unless the person turns it on)
+
+An agent whose app can run a shell command in the background, and starts a new turn when that command finishes, can
+wait for its own work. Claude Code, including Claude Desktop's Code tab, does this.
+
+- **Only if the person has said they want teammates to be able to wake this session.** Never turn it on yourself, and
+  never change their settings for it.
+- The shell needs this seat's identity: export the `OPENRIG_SESSION_NAME` that the one-time attach printed.
+- Start this as a background command, then end your turn. Don't poll it yourself.
+
+```sh
+# Waits until a task is assigned to this seat, prints it and exits; ends after MAX seconds.
+max=${MAX:-3300}; every=${EVERY:-5}; end=$(( $(date +%s) + max )); checked=0; failing_since=""
+while [ "$(date +%s)" -lt "$end" ]; do
+  if out=$(rig queue list --owned --state pending --json 2>/dev/null); then
+    checked=1; failing_since=""
+    case "$out" in *'"qitemId"'*) printf 'NEW WORK: %s\n' "$out"; exit 0 ;; esac
+  elif [ -z "$failing_since" ]; then
+    failing_since=$(date -u +%H:%M:%SZ)
+  fi
+  sleep "$every"
+done
+why="Run rig queue list --owned to see why (this seat's identity, the daemon) before starting the wait again."
+if [ "$checked" = 0 ]; then
+  echo "Couldn't check for work: every poll failed. $why"; exit 1
+elif [ -n "$failing_since" ]; then
+  echo "Checking stopped working at $failing_since: every poll since then failed. $why"; exit 1
+fi
+echo "No new work before the deadline. Start the wait again."
+```
+
+- **When it wakes you with `NEW WORK`:** `rig queue claim` each item, do it, and close it with the answer. Then start
+  the wait again and end your turn.
+- **Don't leave an item you've seen pending:** it wakes you again at once. Claim it, block it or hand it off.
+- **A failed poll doesn't end the wait;** only new work or the deadline does.
+- **If every poll failed, or every poll since some point did** (the daemon stopped mid-wait), it says so, with when,
+  and exits non-zero instead of reporting no work. A failure followed by a successful poll stays quiet. Find out why
+  with `rig queue list --owned` (usually this seat's identity, or the daemon) before starting the wait again.
+- **If your app stops the background command, or you start a new session,** start the wait again.
 
 ## Troubleshooting and Weird States
 

package/daemon/context-packs/skills/openrig-user/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-user"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when a specific `rig` command, subcommand, or flag is already known and you need its exact syntax, JSON shape, defaults, or error meaning. NOT for natural capability discovery, open-ended how-do-I questions, or choosing which OpenRig move applies."
 files:

package/daemon/context-packs/skills/orienting-to-an-inherited-seat/SKILL.md

@@ -180,10 +180,13 @@ reconcile. **This is the feature a handover has and a compaction does not** —
 - **Ask across the three levels** — the base verb `rig ask <rig|target> "<question>"` takes a level flag:
   - `--seat <session-name>` — search a **seat's transcript** (the seat-scoped record).
   - `--session <token>` — search a specific **session's JSONL** by token.
-  - `--wake <seat[@gen] | token>` — **wake** that tenure: resume it to reason a *fresh* answer (the
-    expensive level, distinct from the two cheap searches). A `seat@gen` ref resolves through the
-    lineage ledger; an unresolvable ref's refusal **teaches you the available tenures**. This is the
-    ergonomic wrapper for the manual resume in the floor above.
+  - `--wake <target>` — **wake** that tenure: resume it to reason a *fresh* answer (the
+    expensive level, distinct from the two cheap searches). Wake seat targets must include the rig:
+    `member@rig` or `member@rig@N` (1 = newest tenure). Seat refs resolve from that seat's `sessions`
+    rows, newest first; an unresolvable ref's refusal **teaches you the available tenures**.
+    A two-part target such as `x@2` is a seat name, not a generation selector.
+    Values without `@` go unchanged to the runtime as a session ID or title; a bare member
+    name is not resolved within `<rig>`. This is the ergonomic wrapper for the manual resume above.
   Reach for the cheap transcript / JSONL searches first; **wake only when you need reasoning the record
   does not already hold.**
 - **`rig ask --wake` wraps the harness resume and is not yet well-exercised.** If it errors, hangs

package/daemon/context-packs/skills/orienting-to-an-inherited-seat/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "orienting-to-an-inherited-seat"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Use when you have just been primed into an EXISTING seat through a planned handover — a different agent retired and handed you the seat plus its earned context — and you need a world model of what just happened to you. Covers how a handover differs from compaction and from a fresh launch, the inherit-the-seat-not-the-identity rule, treating the handover packet as testimony you verify (and refusing stale ghost prompts, and verifying your OWN identity surfaces), why a seat is a COMPOUNDING LINEAGE"
 files:

package/daemon/context-packs/skills/pm/backlog-capture/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "backlog-capture"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Quickly capture product ideas, feature requests, or insights from meetings and conversations. Rapid documentation with smart categorization and deduplication."
 files:

package/daemon/context-packs/skills/pm/context-builder/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "context-builder"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Gather and distill context from meetings, competitors, regulatory sources, and internal discussions. Produces background.md for a feature and updates shared context docs when new knowledge is discovered."
 files:

package/daemon/context-packs/skills/pm/exec-summary/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "exec-summary"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "Generate a 1-2 page executive summary for a feature — orients sales, leadership, and engineering from a single document."
 files:

package/daemon/context-packs/skills/pm/office-hours/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "office-hours"
-version: "0.6.11"
+version: "0.6.12"
 taxonomy: "skills"
 purpose: "YC-style product validation using six forcing questions. Pressure-tests a feature idea before it becomes a requirement — ensuring real demand, a clear wedge, and evidence behind assumptions."
 files: