@openrig/cli 0.6.11 → 0.6.13

package/daemon/docs/reference/whats-new.md

@@ -1,7 +1,7 @@
-# What changed in OpenRig 0.6.11
+# What changed in OpenRig 0.6.13
 
-This note is for an agent on an install that was just upgraded to 0.6.11. It lists only what behaves differently from
-0.6.10 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.6.13. It lists only what behaves differently from
+0.6.12 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
@@ -9,160 +9,108 @@ after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). One migration runs on the first start: `103`
-  adds one column to `sessions`, `intentionally_stopped`, which is 0 for every existing row. There are no migrations
-  `100` or `102`. The bundled openrig-core plugin stays at 0.1.9; two of its files changed.
-- **Two new switches, both off by default:**
-  - `output.compact` (or `OPENRIG_OUTPUT_COMPACT`): the seven queue write commands (`rig queue create`, `claim`,
-    `unclaim`, `update`, `block`, `handoff` and `handoff-and-complete`) print a short receipt instead of the whole
-    row, and `--full` prints the whole row. While it's off their output is unchanged, `--full` is accepted, and
-    `rig config` lists the key.
-  - `provider.usage_windows` (or `OPENRIG_PROVIDER_USAGE_WINDOWS` in the daemon's environment): `rig provider status
-    --refresh` reads a Codex login's usage windows once. While it's off, `--refresh` says how to turn it on and exits 1.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Migration `117` runs on every upgrade: it adds
+  an empty, Codex-only `provider_account_readings` table. It fills only with `provider.usage_windows` on (off by
+  default), and then keeps each resolved Codex account's readings across a restart. There's no migration `116`.
+  Coming from 0.6.11 or earlier, 0.6.12's twelve migrations run first.
+- **The bundled openrig-core plugin goes from 0.1.13 to 0.1.14.** Generated Claude hook commands in a project's
+  `.claude/settings.local.json` call the daemon's Node by its absolute path; existing bare-`node` entries refresh on
+  their own, and a person's wrapper is kept. The plugin's own manifest hooks still call bare `node`.
+- **Seats pick up some changes only at their next launch:** a Pi seat's `effort` (sent as `--thinking`), a managed
+  Claude seat's `EDITOR`, `VISUAL`, `DISPLAY`, `XAUTHORITY` and `WAYLAND_DISPLAY`, and the shipped agent specs' role
+  file as the seat's role. Use `rig seat launch <seat> --fresh --stop --reason "<why>"` only when the person wants it
+  now; don't relaunch a working team just to pick these up.
+- **Slack recovery's first pass after the upgrade** scans tracked threads inside the seven-day window once from their
+  root. Replies that already landed aren't delivered twice; recovered ones land as late rows that never answer a
+  decision.
 
 ## Output that changed shape
 
-- **`rig queue create --verify` reports `outcome: "claimed"`** for a claimed row whose wake wasn't confirmed, instead
-  of `indeterminate`. A claim is pickup, not proof the body was read.
-- **`rig queue create --verify` to a registered person who is also a seat with a pane reports the Slack side too.**
-  Beside the terminal wake it adds a `gateway` object: `posted` (`connectorAccepted: true`), `transport-failed` or
-  `never-posted` (`connectorAccepted: false`, with the detail), or `still-pending` (`connectorAccepted: null`). The
-  wait is still bounded by the existing 30-second default, and it can use all of it even when Slack isn't set up or the
-  row won't be posted; the Slack side then reads `still-pending`. Posted isn't read, and "This is not a failed handoff"
-  isn't shown when Slack reports a failed delivery. `GET /api/queue/:qitemId` returns `ownerNotificationLevel`, or
-  `null`.
-- **`rig queue whoami --work-candidates` returns up to 50 held and 50 next rows,** with `heldTruncated` and
-  `nextTruncated`. `heldAndNextTruncated` now means either list was cut. With `OPENRIG_REFOCUS_WORK_PACKET` on (off by
-  default, as in 0.6.10), the refocus work packet lists held and next work separately, up to 50 each.
-- **`rig ps --nodes --json` carries `intentionallyStopped`,** and `rig ps --nodes` shows `usage_limit` under REASON for a
-  Codex seat at its usage limit.
+- **`rig ps --nodes`** prints one line per seat after the table: `Model (<session>): configured <m>; last observed
+  <model> (<source>; native record <time>)`, or `UNKNOWN (<reason>)`. JSON carries `modelObservation`; compact output
+  is `[model, source, time]`, `{status: "unknown", reason}`, or `null` from an older daemon. Roster
+  `live.observedModel` is now filled in.
+- **`rig capture`** writes `[rig capture: <seat>: input box: <hint>]` to stderr for a Claude Code or Codex seat; stdout
+  is unchanged. `--json` and the MCP tool carry `inputBox` (`status`, `confidence`, `cursor`, regions, `evidence`,
+  `hint`). It's a heuristic: `unknown` means unknown.
+- **`rig provider status`** rows carry a sign-in fact (`usable`, `needs sign-in`, `unknown`; JSON `signIn`). A
+  signed-in Claude login never reads better than `unknown`. A signed-out Codex login reports `not_signed_in`, not
+  `rpc_error`.
+- **`rig provider status`** (with `provider.usage_windows` on) Codex rows keep their last reading across a daemon
+  restart as history (`retained: "before_restart"`), labelled "kept from before the daemon restarted; not a current
+  reading", with availability unknown until a fresh read. Rows add `accountHistory` (`linked`, or `unknown`; every
+  Claude row is `unknown`), `lastObservedExhausted`, `retained` and, on an inactive account, `savedProfile: "not
+  linked"`. A window whose reset has passed gains `expectation`: planning, not a reading. Run `rig provider status
+  --refresh` before telling anyone an account has room.
+- **`rig send`** can refuse with `caller_cancelled` (HTTP 409, `sent: false`, `inputPhase: "not_reached"`) when its
+  caller went away before input started.
+- **`rig seat restart --keep-conversation`** reports name a Codex startup screen: `Codex startup gate (<kind>): …`, and
+  JSON gains `codexNoDaemonFlag`, `processMode` (always `unknown` for now) and `account.startupGateKind`.
+- **`rig restore-check`**'s hook check can read `ready_with_caveats` where it read green; the exit code is still 0.
+- **`GET /api/attention`** adds `queue-update:<qitemId>` items and a `"queue updates"` source.
+- **The node-detail API's `targetPath`** names the file a guidance block is really in, or `""`; `declaredTarget` and
+  `effectiveTarget` are new.
+- **`rig grow --json`'s `rigId`** is the resolved id, and `rig grow` and `rig remove` can return `rig_ambiguous`.
+- **The one-line installer** ends with `INSTALLED, SETUP NOT COMPLETE (exit N)` when `rig setup` isn't ready.
 
 ## Seats and restore
 
-- **A restore no longer starts a seat fresh when an earlier occupant left a resume token.** If a seat wasn't running
-  when the snapshot was taken, but an earlier session recorded a resume token, `rig up --existing` and `rig launch`
-  stop that seat at `awaiting-decision` and start nothing, because the token doesn't prove that conversation can still
-  resume. `rig launch` of such a seat exits 1 where it used to start it fresh. The message names the command that
-  starts it fresh on purpose. See the known gap below for how this shows in the rig status API.
-- **In a restore of a rig whose seats are in pods, a seat is rolled back as unresumable only when its runtime reports
-  the conversation missing.** When Claude, Codex or Pi reports that, the seat goes back to `awaiting-decision` and
-  nothing starts, instead of a failed launch that left the new pane behind. A rig where every seat ends this way reads
-  `partially_restored` instead of `failed`; the exit code is 1 either way. A Claude that exits to its shell for another
-  reason keeps 0.6.10's result: the seat is reported failed and its pane is kept, so you can read what happened. Restores
-  of rigs without pods keep their earlier handling.
-- **`rig seat launch --fresh --stop` checks before it stops anything.** A seat with a still-live older session is
-  refused before the current agent is stopped; 0.6.10 stopped it first. `--plan` previews a fresh launch without
-  changing anything and exits 0 even when it would be blocked. `--reason` is required only to execute; leaving it out
-  reports `missing_reason`.
-- **A seat you stop on purpose no longer makes its rig read `degraded`.** `rig seat stop` records the stop, and `rig ps`
-  and the TUI leave that seat out of the rig's state; running counts still exclude it. A rig whose seats were all
-  stopped this way reads `stopped`.
-- **Restart one Codex seat in place, on Linux:** `rig seat restart <seat> --keep-conversation --reason "<why>"`
-  restarts it in its own pane on the same conversation, so it starts again on whatever account its Codex home now
-  holds. It doesn't switch accounts itself. Before it stops anything, it checks that the seat is a Codex seat OpenRig
-  launched, in a single pane, with a conversation it can prove, and that relaunching wouldn't change the running
-  settings; any doubt refuses with nothing stopped. `--plan` runs every check and stops nothing.
-  `--verify --expect-account <account>` reports `moved` only when a tool turn has completed in the same conversation
-  since the restart and Codex's status names that account.
-  On macOS, a request that gets as far as reading the running process refuses before stopping the seat, because that
-  reading depends on `/proc`.
-- **A forked Claude seat launches with its own session ID** (`rig fork`, or `session_source: fork`), so strict restore
-  and clear-attention can verify it as its own conversation. Forking a Claude seat needs Claude Code 2.0.73 or later,
-  which OpenRig doesn't check. Forks launched before this keep reading `mismatch` until they're relaunched.
-- **Seats no longer inherit the launching Claude Code or Herdr session's identity variables,** such as `CLAUDECODE`.
-  If removing them fails, the launch goes ahead with a warning.
-- **A member's `cwd` in a rig spec can be `~`, start with `~/`, or use `$VAR` or `${VAR}`,** expanded from the daemon's
-  environment, when the path as written doesn't exist. `rig up` warns on stderr when it chose `/` as the launch folder
-  itself.
-- **A late readiness result no longer overwrites a newer launch attempt.**
-
-## Sends and wakes
-
-- **`rig send --wait-for-idle N` waits before it takes the seat's delivery lease,** so other sends and queue wakes to
-  that seat aren't held behind a long wait. N is now a deadline from the start of the wait, including any time spent
-  waiting for the lease. A timeout names the wait you asked for.
-- **A parked seat whose occupant is known isn't woken again for the same rows after a wake was delivered,** until it
-  updates one of them or one changes state. A failed, refused or unrecorded wake still repeats at the next park, and a
-  new occupant gets its first wake. "Delivered" means the wake was typed into the seat's terminal, not that the agent
-  read it.
-- **`rig send --verify` confirms enveloped multi-line messages that the agent's screen indents,** and queue wakes use
-  the same check.
-- **A Claude footer in auto, bypass or plan mode on the last line reads idle** when no activity hook is reporting.
-- **A failed Pi or OMP turn shows the provider's own reason** when it gives one.
-- **A `handed-off` closure with no visible successor** gets the same custody advisory and stuck-sweep finding as a
-  `done` closure.
-
-## Status
-
-- **A Codex seat at its usage limit stays `unknown` with reason `usage_limit`** while its screen redraws, instead of
-  reading `running`. It clears when a readable screen shows no banner, or when Codex shows it's working again. See the
-  known gap below.
-- **`rig ps` takes a rig's running count and status from the same set of sessions as `rig ps --nodes`.**
-- **`rig whoami --full --json` shows a Codex seat's `runtimeContext.threadId`** when its stored conversation ID was
-  verified resumable.
-- **The TUI says when a queue sample hit its cap or failed to load:** counts read `N+`, a seat missing from the sample
-  shows `?`, and Pulse no longer lists a NEEDS YOU item a second time. The caps count the whole host, so a quiet rig can
-  read `?` while another rig is busy.
-- **The TUI Topology table's Q, WORK and NOW columns fill again** on drilled views and on a seat's page.
-
-## Smaller fixes
-
-- A Slack reply sent with "Also send to channel" in the default channel is recovered after a connection gap.
-- `rig config set daemon.port` refuses a port outside 0–65535, and a port like that from the environment or
-  `config.json` falls back to the file or default with a warning. `rig daemon start --port` refuses one too, with exit 1.
-- Parallel `rig scope slice create` calls get different slice numbers. A number is never reused, and each create leaves
-  a hidden `slices/.nn-NN` claim file.
-- `rig proof show` and `rig proof judge` take `--project <id>` or a `<project>:` scope prefix. Scope readiness for a
-  project selected in the TUI uses that project's own root.
-- The chat send and topic routes return 400 before storing anything for payloads that used to fail with 500;
-  `/api/wake-resolve` answers a fractional or non-numeric generation with its usual "does not exist" reply; watchdog
-  registration refuses a `scan_interval_seconds` that can't be turned into a number (non-numeric text, a boolean, an
-  empty array); and unmanaged-pane discovery matches agent
-  process names exactly, plus `claude.exe` and names cut to 15 or 16 characters.
-- The `rigs` and `openrig-skills` skill descriptions split by who is asking: a person in their own session, or an agent
-  inside a rig.
-- A new reference page covers keeping a watch for a person with today's queue commands, installed at
-  `$OPENRIG_HOME/reference/keeping-a-watch.md`. See the known gap below.
+- **A fresh in-place Claude handover** checks a ready result from the old pane's history against the current screen,
+  so the packet waits for the successor. It can still admit early when the screen, pane or process can't be read or
+  proven: check that the successor read its packet.
+- **A Claude launched through a wrapper script** is proven by its executable path; a restored auto-mode seat resumes
+  ready.
+- **After a failed restore, a ready `rig seat launch --fresh`** clears the old restore warning, and `rig seat
+  clear-attention` no longer refuses for it.
+- **A complete idle Claude Code or Codex screen** reads `idle` through terminal repaints.
+- **Claude Code's MCP-server approval menu** reads `mcp_gate` and needs input; a restore doesn't call it ready, and an
+  ordinary send is refused instead of pasted. A fresh running hook still sends into it.
+- **Codex's "Trust this folder?" panel** reads `trust_gate` during launch, resume and restore.
+- **A rig name with a dot** is refused at launch, at adding a member and at a first-start retry.
+
+## Sends, wakes and the queue
+
+- **A send whose caller went away** types nothing, then or later, if no input had started.
+- **An old numbered menu in a Codex pane's scrollback** no longer blocks a send when a complete empty input box sits
+  below the status row.
+- **An OMP seat** whose turn ended with a typed transient provider failure (408, 429, 500, 502, 503, 504 or 529) can
+  take an ordinary `rig send` retry; nothing retries on its own.
+- **Parked rows for one seat that fall due in the same pass** arrive as one message naming each row.
+- **A stuck-item finding on a person's item that an agent closed** goes to that agent, not the person.
+- **`rig queue list --state "pending, in-progress"`** matches both states.
+
+## New things you can do
+
+- **Move a seat to a new working folder:** `rig seat set-cwd <seat> --cwd <absolute-path> --reason <text>` saves it
+  for the next fresh launch or rebuild handover; the running agent doesn't move. Switch promptly with `rig seat launch
+  <seat> --fresh --stop --reason "<why>"` or a rebuild handover, and not after a `rig down`/`rig up` or fork handover.
+- **Set a Pi seat's effort:** `rig seat set-effort <seat> --effort <level> --reason "<why>"` and `rig seat effort
+  <seat>` now work for Pi.
+- **See which model a seat was using:** `rig ps --nodes`, `rig roster show`, `rig roster find`.
+- **Use a rig name in `rig grow` and `rig remove`.**
+- **Slack:** missed messages in mapped channels, recent threads and relayed channels are recovered; `rig slack status`
+  shows a line per channel and a thread line.
+
+## Off by default
+
+- **The refocus work packet** stays off for Claude Code and Codex. With `OPENRIG_REFOCUS_WORK_PACKET=1`, its fields
+  are bounded (about 160 characters per summary, 20 held and 10 next rows, about 1,500 characters per section).
 
 ## What to stop doing
 
-- **Stop expecting a restore to start a seat fresh** when an earlier session left a resume token; decide at
-  `awaiting-decision`, or use the command the message names.
-- **Stop reading `indeterminate` as the answer for a claimed row** from `rig queue create --verify`; 0.6.11 says
-  `claimed`.
-- **Stop treating `degraded` as a stopped seat's doing** after `rig seat stop`; the rig leaves that seat out.
-- **Stop counting a long `--wait-for-idle` as extra time after the lease;** N is a deadline from the start of the wait.
-
-## Known gaps in 0.6.11
-
-- **`rig seat restart --keep-conversation` supports Linux only.** Its automated tests are hermetic: they don't restart a
-  real Codex seat.
-- **The rig status API can call a running rig `blocked` because of one seat that isn't running.** It happens when the
-  latest snapshot recorded no occupant for that seat, an earlier session of the seat left a resume token, and its newest
-  session's restore policy is `resume_if_possible`. A restore from that snapshot would stop at the seat for a decision,
-  and `GET /api/rigs/:id/status` folds that forecast into the rig's status, so it mixes current status with restore
-  readiness: no seat is halted. `rig status` and the TUI's rig list don't show it for a running rig.
-- **A Codex seat can keep reading as at its usage limit** when an old usage-limit banner is followed by a submitted
-  prompt and the agent's reply, with no Codex working line and no input line below. It's recorded again every five
-  minutes, where 0.6.10 let it age out. The case was constructed from the source and hasn't been seen in a real
-  session.
-- **The keeping-a-watch page says a timer fires once; a held-back wake uses up that fire.** When the typing guard holds
-  a one-shot `--wake-after` wake back (it shows as `retained`), that held-back attempt is recorded as the timer's one
-  fire and later wakes aren't, so the timer isn't retired: it can wake the owner again at each interval while the row
-  stays set aside. A row sharing the timer through `--wake-watchdog`, after the original row was handed off or stopped,
-  loses its one wake if that wake is held back. Read the row's transitions after each wake.
-- **After `rig scope slice create` says it couldn't verify membership, the slice was kept.** Check `mission.yaml` before
-  creating it again: creating it again makes a second slice with the same name.
-- **The latest first-install check before this release used 0.6.10 on Linux only.** macOS was last checked with 0.6.8,
-  and native Windows hasn't been checked.
-- **Only one selected lifecycle-help command has been checked in a live Claude session;** source and parser coverage
-  is broader. If a help command still asks, report it.
-- **Codex team seats aren't asked before lifecycle commands yet.**
-- **The send gate trusts the most recently recorded hook.** If hooks are recorded out of order, it can hold a send for
-  a question that's already answered, or miss one that's waiting. `rig capture` shows the real screen.
-- **A Codex seat whose permission request was approved automatically can still read "needs input".**
-- **A launched team still writes into its working folder;** the operator says what changes before you agree.
-- **After a restart, `rig status` shows `Kernel: skipped` whatever the kernel seats' state.** Read them with
-  `rig ps --nodes --rig kernel --full`.
-- **`rig tui --shared` still attaches on the default tmux server,** so it can't find the dashboard when the daemon runs
-  on a non-default tmux socket. Use `rig tui` there instead.
+- **Don't read `FAILED [4/4]` from the installer as a failed install:** the script now says `INSTALLED, SETUP NOT
+  COMPLETE`, and the fix is `rig setup` again, not a reinstall.
+- **Don't rely on Slack recovery for older open threads:** only threads whose root or close is within seven days are
+  caught up.
+
+## Known gaps in 0.6.13
+
+- **On a Mac with more than one user account,** a second user's `rig` commands can reach the first user's daemon on
+  its default port (7433). Running each user's daemon on its own port lets both work but doesn't keep them apart.
+- **Managed compaction, refocus after a compaction and snapshot restore** behave as in 0.6.12: confirm a compaction by
+  its restore request or the drop in context, and check that a restored seat is really working.
+- **A fresh in-place Claude handover** can still report ready early when the screen, pane or process can't be read or
+  proven.
+- **One Slack app across machines** hasn't run on two real machines, and Slack recovery doesn't catch up older open
+  threads.
+- **`rig seat set-cwd`** checks the new folder once; switch promptly.

package/daemon/specs/agents/apps/vault-specialist/agent.yaml

@@ -28,6 +28,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
     - path: startup/context.md

package/daemon/specs/agents/conveyor/builder/agent.yaml

@@ -27,6 +27,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
     - path: startup/context.md

package/daemon/specs/agents/conveyor/lead/agent.yaml

@@ -27,6 +27,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
     - path: startup/context.md

package/daemon/specs/agents/conveyor/planner/agent.yaml

@@ -27,6 +27,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
     - path: startup/context.md

package/daemon/specs/agents/conveyor/reviewer/agent.yaml

@@ -27,6 +27,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
     - path: startup/context.md

package/daemon/specs/agents/design/product-designer/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions:

package/daemon/specs/agents/development/implementer/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/development/qa/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/factory-rsi/dogfood/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/factory-rsi/release-manager/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/orchestration/orchestrator/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/product-management/pm/agent.yaml

@@ -47,6 +47,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/research/analyst/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/research/synthesizer/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/review/independent-reviewer/agent.yaml

@@ -25,6 +25,7 @@ resources:
 startup:
   files:
     - path: guidance/role.md
+      orientation: role
       delivery_hint: send_text
       required: true
   actions: []

package/daemon/specs/agents/shared/skills/core/openrig-skills/SKILL.md

@@ -53,7 +53,7 @@ These are auto-delivered to every rig; their name+description are already in you
 - **openrig-user** — you need a `rig` CLI command (send / queue / ps / whoami / scope / broadcast). The daily CLI surface.
 - **applying-a-permission-policy** — a rig or seat has a permission policy attached, or you're setting one up: translate it into the live harness configuration.
 - **claude-compaction-restore** — you just compacted (Claude). Restore from durable evidence before resuming real work.
-- **delegating-work** — deciding who should do a task: you, a spawned subagent, or a durable peer seat that already holds the context.
+- **delegating-work** — deciding who should do a task (you, a spawned subagent, or a durable peer seat that already holds the context), and how to brief the agent you hand it to, which depends on the model it runs.
 - **loading-addressable-markdown** — a task names Markdown as `path#h2-slug` or `path#h2-slug/h3-slug` outside the context-pack library.
 - **session-compaction-and-restore** — preparing for, or recovering from, compaction (any runtime). The write- and read-side protocol.
 - **queue-handoff** — you're passing durable work to another seat or ending your turn. The queue is the work ledger, not chat.

package/daemon/specs/agents/shared/skills/core/openrig-software-factory/SKILL.md

@@ -15,7 +15,6 @@ metadata:
     - workflow instantiate-lifecycle
   openrig:
     stage: WIP
-    transfer_test: pending
 ---
 
 # OpenRig Software Factory

package/daemon/specs/agents/shared/skills/core/openrig-software-factory/references/worked-example.md

@@ -22,7 +22,8 @@ boundary, acceptance and evidence pointers; create it before sending:
 ```sh
 rig whoami --json
 rig queue create --destination dev-build@starter \
-  --body-file ./TASK.md --summary 'Implement the agreed CSV inspection' --json
+  --body-file ./TASK.md --summary 'Implement the agreed CSV inspection' \
+  --tags 'project:<id>,mission:<id>,slice:<id>' --json
 rig queue claim <returned-qitem-id> --json
 ```
 
@@ -30,7 +31,8 @@ After implementing and checking the cumulative candidate, the current owner uses
 
 ```sh
 rig queue handoff <owned-qitem-id> --to dev-review@starter \
-  --body-file ./REVIEW-REQUEST.md --json
+  --body-file ./REVIEW-REQUEST.md --summary 'Review the CSV inspection candidate' \
+  --tags 'project:<id>,mission:<id>,slice:<id>' --json
 ```
 
 The request binds exact candidate, acceptance, commands and evidence. Read the
@@ -177,10 +179,11 @@ task instead of duplicating it):
 ```sh
 rig queue create --destination dev-parser@starter \
   --body-file "$PROJECT_ROOT/.openrig/factory/TASK-A.md" \
-  --summary 'Implement the agreed independent change A' --json
+  --summary 'Implement the agreed independent change A' \
+  --tags 'project:<id>,mission:<id>,slice:<id>' --json
 ```
 
-Use actual project/mission/slice tags where applicable. Read back the returned ID
+Use the project, mission and slice the work belongs to. Read back the returned ID
 with `rig queue show <id> --full --json`; A claims it as itself. Use the earlier
 queue loop for results, review and blockers. Existing Workflow-bound work keeps
 its packet/projection contract: adding a seat does not revise a running graph or

package/daemon/specs/agents/shared/skills/core/topology-mutation-and-seat-management/SKILL.md

@@ -112,7 +112,7 @@ Per `cli-reference.md` v0.2.0:
 - `rig grow <rig-id> <member...> [--pod <pod> | --new-pod <pod>] [--runtime <runtime>] [--cwd <path>]` (added after v0.2.0; check `rig grow --help`)
 - `rig expand <rig-id> <pod-fragment-path>` (with optional `session_source`)
 - `rig shrink <rigId> <podRef>`
-- `rig launch <rigId> <nodeRef>`
+- `rig launch <rig> <nodeRef>` (the rig's name or ID)
 - `rig remove <rigId> <nodeRef>`
 - `rig discover [--draft]`
 - `rig bind <discoveredId> --rig <rigId> (--node <id> | --pod <ns> --member <name>)`

package/daemon/specs/agents/shared/skills/pods/orchestration-team/SKILL.md

@@ -94,7 +94,7 @@ When you dispatch work, give the receiving agent enough structure to act without
 - what proof or verification you expect back
 - any independently held component explicitly selected, and the boundary that triggers it
 
-**(0.5.0) Assign work *with* its context attached.** Rather than make the assignee grep for the as-built, compose a context pack and ride it on the handoff: `rig context compose --out packs/<brief> --from <files>`, then `rig queue create --destination <seat> --body-context packs/<brief> --summary "…"`. The pack's resolved content is snapshotted into the qitem (plus its ref for provenance), so the context survives compaction and is auditable. See `openrig-user` → "Context packs and paced delivery." (`rig context` composes; the queue delivers — the noun never sends.)
+**(0.5.0) Assign work *with* its context attached.** Rather than make the assignee grep for the as-built, compose a context pack and ride it on the handoff: `rig context compose --out packs/<brief> --from <files>`, then `rig queue create --destination <seat> --body-context packs/<brief> --summary "…" --tags "project:<id>,mission:<id>,slice:<id>"`. The pack's resolved content is snapshotted into the qitem (plus its ref for provenance), so the context survives compaction and is auditable. See `openrig-user` → "Context packs and paced delivery." (`rig context` composes; the queue delivers — the noun never sends.)
 
 If design clarity is missing, route to design first.
 If QA gating is required, say so explicitly in the assignment.

package/daemon/specs/rigs/launch/demo/CULTURE.md

@@ -40,7 +40,7 @@ Do not stall silently. Do not pretend you have permissions you don't.
 
 ## After startup
 
-Every agent should run `rig whoami --json` immediately after launch or compaction to recover identity, peers, and edges.
+Every agent should run `rig whoami --json` immediately after launch or compaction to recover identity, peers, and edges. If `peersNote` says some peers are not shown, `rig whoami --json --all-peers` lists them all.
 
 ## Culture
 

package/daemon/specs/rigs/launch/factory/CULTURE.md

@@ -46,7 +46,7 @@ If blocked on another agent:
 
 ## After startup or compaction
 
-Run `rig whoami --json` immediately. This tells you who you are, who your peers are, and how to reach them.
+Run `rig whoami --json` immediately. This tells you who you are, who your peers are, and how to reach them. If `peersNote` says some peers are not shown, `rig whoami --json --all-peers` lists them all.
 
 ## Culture
 

package/daemon/specs/rigs/launch/factory/topology/rig/CRAFT.md

@@ -4,8 +4,8 @@
      later rig-up never overwrites). Rig-wide norms every member holds. -->
 
 - **If another seat must ACT, it needs a queue row.** A send informs; only a
-  row creates an auditable obligation. Pass work with `rig queue handoff` so
-  the close and the create are one transaction.
+  row creates an auditable obligation. Pass work with `rig queue handoff` (give it a
+  `--summary`) so the close and the create are one transaction.
 - **A turn holding work ends by handing off or naming a live blocker.**
   Ending a turn with a summary in your own terminal is going dark: from
   outside, a clean finish and a crash are identical.

package/daemon/specs/rigs/launch/first-project/CULTURE.md

@@ -17,7 +17,8 @@ a queue identity.
 
 For the first meaningful code change, ask dev-check for an independent check
 of the exact diff and the behavior it promises. Subsequent checks should match
-the consequence of the work. Hand off through `rig queue handoff`, with the
+the consequence of the work. Hand off through `rig queue handoff` with a
+`--summary` and the project, mission and slice tags, giving the
 repository path, candidate commit or diff, checks run and any limits. Consult
 `--help` for current syntax. Do not use chat text as the work record.
 

package/daemon/specs/rigs/launch/first-project-claude/CULTURE.md

@@ -17,7 +17,8 @@ a queue identity.
 
 For the first meaningful code change, ask dev-check for an independent check
 of the exact diff and the behavior it promises. Subsequent checks should match
-the consequence of the work. Hand off through `rig queue handoff`, with the
+the consequence of the work. Hand off through `rig queue handoff` with a
+`--summary` and the project, mission and slice tags, giving the
 repository path, candidate commit or diff, checks run and any limits. Consult
 `--help` for current syntax. Do not use chat text as the work record.
 

package/daemon/specs/rigs/launch/first-project-mixed/CULTURE.md

@@ -17,7 +17,8 @@ a queue identity.
 
 For the first meaningful code change, ask dev-check for an independent check
 of the exact diff and the behavior it promises. Subsequent checks should match
-the consequence of the work. Hand off through `rig queue handoff`, with the
+the consequence of the work. Hand off through `rig queue handoff` with a
+`--summary` and the project, mission and slice tags, giving the
 repository path, candidate commit or diff, checks run and any limits. Consult
 `--help` for current syntax. Do not use chat text as the work record.
 

package/daemon/specs/rigs/launch/kernel/agents/operator/agent/guidance/role.md

@@ -30,6 +30,9 @@ user's view unless the task calls for navigation, and use the registered human
 channel for decisions. If the TUI has exited, its shell remains; run `rig tui`
 there once.
 
+When a person asks you to watch something or remind them, in any words, read
+`$OPENRIG_HOME/reference/keeping-a-watch.md` first and follow it.
+
 You run OpenRig on behalf of the user. The operator pod's `operator.human`
 member holds their shared terminal view. Human decisions use the registered
 human channel; a terminal attachment is not a person's address.
@@ -102,7 +105,11 @@ configurations, as below; do not take the pin from a cached page summary.
      them to https://openrig.dev/rigs/workshop: the bundle ships with broad
      access and non-interruptive mode, bypassing permission prompts and
      supported harness warning dialogs. Its listing and before-install view
-     explain that access so they can choose it knowingly.
+     explain that access so they can choose it knowingly. Its listing has
+     several configurations (`recommended` mixes Claude Code and Codex, plus
+     `all-claude`, `all-codex` and others); name the one that fits the
+     providers they have, and when they say they use only one, offer that
+     one rather than the default.
    - `factory`: seven agents (a lead, an advisor, build, QA, design and two
      independent reviewers) for sustained product work. Built in; it uses the
      most concurrent capacity.
@@ -239,7 +246,7 @@ configurations, as below; do not take the pin from a cached page summary.
    not proof of what the person sees.
 9. **Hand the goal to the team's lead.** Once the lead's `startupStatus` is
    `ready`, give it the person's goal in their own words, with the folder, as
-   a queue row (`rig queue create --destination <lead> --body-file <file>`) so
+   a queue row (`rig queue create --destination <lead> --summary "<the goal in a sentence>" --body-file <file>`) so
    it is durable and wakes the lead. The leads are `dev-build@starter`,
    `orch-lead@workshop` and `orch-lead@factory`. Tell the person the lead has
    their goal, and identify its pane in the new space or repeat its exact