@openrig/cli 0.6.12 → 0.6.14

package/daemon/context-packs/reference/whats-new.md

@@ -1,189 +1,87 @@
-# What changed in OpenRig 0.6.12
+# What changed in OpenRig 0.6.14
 
-This note is for an agent on an install that was just upgraded to 0.6.12. It lists only what behaves differently from
-0.6.11 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.6.14. It lists only what behaves differently from
+0.6.13 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
-after an upgrade it can still hold the previous version's note.
+after an upgrade it can still hold the previous version's note. Coming from 0.6.12 or earlier, also read 0.6.13's
+release notes: its changes and migration `117` arrive with this upgrade.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Twelve migrations run on the first start,
-  whatever you use: `100`, `104`, `105`, `107` to `115`. They add columns and tables for the typing guard's modes, a
-  seat's saved effort, Claude's cost estimate, Pi usage, mode and posture categories, workflow scope, seat environment
-  values, the Codex `--no-daemon` record and `sessions.agent_app`; build two indexes for recent queue activity (about
-  10 to 12 MB on a long-running install); and rebuild the Slack thread map. There are no migrations `102` or `106`.
-- **Claude seats now run the openrig-core plugin's hooks.** The bundled plugin goes from 0.1.9 to 0.1.13. A Claude
-  seat whose plugins include `openrig-core` (every shipped agent spec selects it) starts with `CLAUDE_CODE_PLUGIN_DIRS`
-  pointing at OpenRig's copy, so the activity relay, the compaction save and restore hooks and refocus actually run. It
-  needs Claude Code 2.1.280 or later, which nothing checks. A running seat picks it up at its next launch, restore or
-  handover. The refocus hook may take up to 60 seconds, so a hung refocus can hold a prompt that long.
-- **Six new settings, all off except one:** `output.whoami_peers` (8, used only while `output.compact` is on),
-  `bundle.services_enabled`, `provider.subscription_moves`, `usage.pi_cost_facts`, `usage.pi_openrouter_charge` and
-  `transport.verify_input_box`. See "Off by default" below.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). No migration runs. One setting is added,
+  `transport.local_user_guard`, off by default (see below).
+- **The bundled openrig-core plugin goes from 0.1.14 to 0.1.15.** Installed copies are replaced and carry refocus's own
+  notes lookup.
 
 ## Output that changed shape
 
-- **Exit codes:** eleven client-fixable `rig queue update` refusals now answer HTTP 400 and exit 1 instead of 500 and
-  exit 2 (`blocker_not_found`, `blocker_not_live` and `blocker_malformed` still exit 2). `rig ask` exits 1 for an
-  unknown or ambiguous rig. `rig compact` exits 1 (was 2) for `pane_unknown_protected`, and its route answers 409 (was
-  502). Over the shared transport, a write that throws without a code makes `rig send` exit 1 with HTTP 409 instead of 2
-  with 500, and a guarded send whose text was written returns `sent: true` with `inputPhase: "written"`.
-- **`rig compact` and `rig compact --state` add a `compact` result:** `submitted_unconfirmed` (shown as "submitted,
-  unconfirmed"), `uncertain` or `not_sent`. "Submitted" means `/compact` and Enter reached the seat, not that compaction
-  ran.
-- **`rig capture --lines N --json`** adds `activity: "unknown"` and `activityNote` when lines were cut.
-- **`rig start --last --json`** carries `keptDown` (always) and `warnings` (`seat_status_unreadable`).
-- **`rig queue show <id> --full`** on a closed row adds `closingTransition`; plain `rig queue show` on such a row reads
-  `readView.complete: false` and lists it in `omittedFields`. `rig queue show` returns `resolution` when a close stored
-  one.
-- **After `rig down`,** `rig ps`, the TUI and the rig summary read the rig `stopped`, not recoverable, and
-  `hasLiveAgents` can read `false`.
-- **`rig seat status`** reads `Typing guard: on (hold)` for hold, and its JSON's `desired` and `effective` mean hold only;
-  `desiredMode` and `effectiveMode` give the mode.
-- **`rig usage top`** measures tokens and rates within one conversation and one window, so figures can drop and more
-  seats read `insufficient_samples`.
-- **The execution view** binds a row to a mission by its exact `mission:` tag first; `q1_lanes[].waiting` and
-  `folded.merge_report` are new.
-- **Smaller:** `rig create --json` carries `detail` on failure; `rig status --json` is new; `rig mcp serve` lists 23 tools
-  (five queue tools added); a JSON body of `null` gets 400 `invalid_json`; `GET /api/events` takes `?replay=`; a Slack
-  seat post's sender line ends `on <host id>`; `rig ps --nodes` `resumeCommand` can carry `--no-daemon`.
+- **`rig ask --wake`** on a seat whose runtime isn't Claude or Codex prints `Wake runtime '<runtime>' … is not
+  supported. Supported runtimes are claude and codex.` A `member@rig` target exits 2 (the daemon refuses it); a raw-id
+  `--runtime` value exits 1 (the CLI refuses it). No wake starts.
+- **`/healthz`** gains `euid`, the daemon's effective user ID, beside `pid`, whether or not the Mac check is on.
+- **`rig compact`** (manual) waits up to 240 seconds for its result, up from 180, because preparation now has 180
+  seconds, up from 120.
 
 ## Seats and restore
 
-- **`rig start --last` leaves down a rig stopped on purpose** (`rig down` or `rig seat stop`) and prints how to bring it
-  back: `rig start --rigs <rig>`, or `rig up '<name>' --existing`.
-- **An ordinary terminal seat relaunches fresh on restore** and re-runs its startup actions; don't answer `--fresh` for
-  it. A missing required startup file for such a seat blocks the whole restore before anything launches.
-- **Restore stops a seat whose current runtime differs from its snapshot's,** before launching it; `--fresh` doesn't
-  bypass it. Restore from a snapshot taken with the seat's current runtime.
-- **A slow Claude restore ends `attention_required`, not failed:** "Claude resume did not finish within Ns; Claude may
-  still be starting, so the launch was kept". Look at the pane, and once Claude is up run `rig seat clear-attention`.
-  Each such seat can add up to about the readiness timeout, one after another, so `rig up` can pass its 120-second
-  wait while the daemon keeps working: check `rig ps` before running it again.
-- **"Returned to a shell" now means the process tree shows an idle shell.** "The pane shows a shell that is not a proven
-  idle shell; a launch script may still be starting …" means the seat may still be coming up. A Pi or OMP seat at a
-  bare shell reads `attention_required`.
-- **A Codex fork whose new conversation ID arrives late** stops at `attention_required` with its startup context kept;
-  let it finish starting, then run `rig seat continue <seat>`. A handover to a Codex fork can complete with `Fork id:
-  PENDING`.
-- **A seat whose startup failed for a recoverable reason** becomes ready after a successful send or capture.
-- **`rig launch` takes a rig's name as well as its ID;** a name two active rigs share stops with `rig_ambiguous`.
-- **`rig add`, single-seat `rig launch` and `rig launch --seats` wait up to 120 seconds.** A timeout still isn't a
-  rollback.
-- **A runtime `--version` check gives up after 30 seconds.** `rig bootstrap` blocks on a runtime that's installed but
-  fails its check, reported apart from one that's missing; `rig up`'s preflight fails a Claude, Codex or OMP check that
-  doesn't answer (a warning for Pi).
-- **Claude login detection:** only a current refusal reads `login_required`, not the "Not logged in" footer alone.
-- **Model pins:** `fable` now names `claude-fable-5-1`, a trailing `[1m]` is set aside, and pinned Pi seats are checked
-  (a `:high`-style thinking suffix is accepted).
-- **A custom permission policy saved with CRLF line endings** now takes effect at the next launch or restore, instead
-  of the advisory floor.
-- **`rig scope mission create`** writes `status: planned`; set it `active` to count it in `rig proof show --project`.
-  With `--workspace <project>`, missions go under the project's declared `missions.root`.
-
-## Sends, wakes and the queue
-
-- **A send to a pane in tmux copy or view mode** leaves the mode and delivers; `pane_in_mode` means the pane couldn't
-  leave its mode. Leave it in that pane, then send again.
-- **`rig send --dangerously-interact` types exactly what you give it.** Enter is added only for a complete answer
-  staged in a recognised Claude Code or Codex input box; anywhere else, put CR in the payload. With `--verify` it reads
-  unchecked.
-- **A Codex seat reads "needs you" only when a real prompt is visible;** a pending permission request reads
-  `permission_request_pending` first, and an unreadable pane gets `permission_request_unverified` after a grace.
-  Codex's `»` prompt is recognised.
-- **Managed `/compact` is short enough to run and is sent only to an idle seat.** Confirm compaction by effect: the
-  restore request, or the drop in context.
-- **A held-back (`retained`) wake doesn't use up a one-shot park timer;** it's tried again at the interval. You don't
-  need to re-arm after one.
-- **A retired watchdog doesn't deliver a late wake.** A row parked on its owner's own repeating reminder reads
-  `servedByOwnReminder` in `rig parked` and draws no extra parked-owner wake.
-- **`rig queue update <id> --summary "<text>"`** alone corrects a row's subject. Close with **`--resolution
-  "<outcome>"`** to store the outcome on the row.
-- **`rig remove` and `rig shrink`** keep a seat that gets work while stopping (409, `retained: true`) unless
-  `--fallback` takes it. A stale `rig unclaim` is refused with `session_not_current`.
+- **A seat that refuses every send with "Managed pane identity unavailable or changed; no input written."** because an
+  older OpenRig never recorded its tmux pane can be repaired in place: `rig reconcile-session <seat>
+  --repair-missing-pane --no-launch`. It fills only the missing pane and keeps the session, resume token and occupant
+  generation; the result names the same session, with continuity unverified. It refuses, writing nothing, with
+  `repair_not_applicable` (the binding already has a pane), `pane_ambiguous` (more than one pane or window),
+  `pane_missing` (no PID), `guard_target_changed`, `guard_operation_in_progress`, `typing_guard_enabled` or
+  `repair_timed_out`. Against an older daemon it reads `repair_missing_pane_unsupported` and never adopts. It records no
+  event.
+- **A manual `rig compact` whose preparation stops at an ordinary approval** keeps waiting within its deadline instead
+  of giving up. OpenRig never answers the approval: the person, or an agent allowed to, answers it.
+- **Refocus resolves each ancestor's notes file itself** (`NOTES.md`, then `MISSION_NOTES.md`) instead of starting `rig
+  scope resolve-notes` per ancestor. Its output, budgets and settings are unchanged.
 
 ## New things you can do
 
-- **Set one seat's reasoning effort:** `rig seat set-effort <seat> --effort <level> --reason "<why>"` (or `--clear`); it
-  applies at the next managed launch, not to the running process. Check it with `rig seat effort <seat>`.
-- **Change a seat's stored permission policy:** `rig policy apply <policy> --seat <seat> --reason "<why>"`. `rig policy
-  current` and plain `rig ps` don't show it; `rig seat status` does.
-- **Give seats environment values:** `env:` on the rig or a member in `rig.yaml`, or `rig up <spec> --env KEY=VALUE` for
-  one launch. Never put secrets there.
-- **Scope a workflow run:** `--project`, `--mission`, `--slice` and `--tags` on `rig workflow instantiate` and `run`;
-  write a target as `member@{rig}` to follow the bound rig.
-- **Read cost:** `rig usage cost [--seat <session>] [--json]`. A missing figure is never $0, and Claude's figure is an
-  estimate, not an invoice.
-- **Hand work over without a shell:** `rig mcp serve` with `OPENRIG_SESSION_NAME` set gives `rig_queue_create`,
-  `rig_queue_show`, `rig_queue_list`, `rig_queue_claim` and `rig_queue_update`. Nothing wakes that agent.
-- **`rig status --json`:** treat `daemon.reachable: null` as unconfirmed, not down.
-- OpenRig 0.6.12 adds `rig community-harness list` for installed community-harness presets, showing their maintainer
-  and declared limits. These harnesses are not tested by OpenRig. Support is launch-only: no resume or fork, no
-  resource projection or startup-file delivery, and identity remains unconfirmed. A quiet screen is not proof that the
-  seat is idle. (#1392, #1518)
-- **Guidance:** the `rigs` skill offers to join the team before the first operator message, and offers Codex users one
-  removable rules file; `delegating-work` says to brief a peer by the model `rig ps --nodes --json` shows; the operator
-  reads `$OPENRIG_HOME/reference/keeping-a-watch.md` when asked to watch or remind, including a low-allowance warning.
-- User-visible text says "harness" for the agent software around a model, and "community harness" for one an outside
-  contributor maintains; `docs/reference/topology-naming.md` defines the terms. (#1506)
+- **Repair a missing pane without adopting:** `rig reconcile-session <seat> --repair-missing-pane --no-launch`.
+- **Point a person at a page written for them:** `docs/reference/quickstart.md` ("Getting started") is the first-use
+  page, with a glossary. `docs/reference/getting-started.md` is now titled "OpenRig setup reference" and opens with what
+  the agent doing the setup needs; its sections and anchors are unchanged, so `rig context get
+  reference/getting-started.md#…` lookups still work.
 
 ## Off by default
 
-- **`output.compact`** now also shortens `rig queue show` and `rig queue transitions` (`--full` for everything) and
-  bounds `rig whoami --json` peers to `output.whoami_peers` (`--all-peers` lists all).
-- **`provider.usage_windows`** now also shows Claude's windows, each seat's configured account and, with
-  `--all-hosts` or `--hosts`, every registered machine's windows. A Claude account's current availability always reads
-  `unknown`: don't tell a person an account has room from a seat's reading.
-- **`usage.pi_cost_facts`** and **`usage.pi_openrouter_charge`** take effect when a Pi seat next launches or resumes, not
-  at once; what was recorded stays visible after they're turned off.
-- **`provider.subscription_moves`** enables `rig provider moves`. The `openrig-user` skill's section for it mentions apps
-  that don't ship in this release.
-- **`bundle.services_enabled`**, **`transport.verify_input_box`**, the per-seat draft-aware typing guard (`rig seat
-  set-typing-guard <seat> --mode draft-aware`), `rig bundle create --include-login-files`, `OPENRIG_TMUX_CONTROL=1`
-  and `OPENRIG_REFOCUS_BUDGET_MS` (4500 to 52000) each act only when chosen.
-- **The daemon runs tmux without `/bin/sh`** on Linux and macOS; `OPENRIG_TMUX_SHELL=1` at daemon start keeps the old
-  path.
+- **A Mac local-user check.** On a Mac shared by several accounts, `rig config set transport.local_user_guard true` (or
+  `OPENRIG_TRANSPORT_LOCAL_USER_GUARD=true` in the CLI's environment) makes the CLI refuse a local daemon another account
+  runs. It compares the PID and effective UID the daemon reports in `/healthz` with two `ps` readings and a second
+  health response, and refuses only when they agree on another account; the refusal names `rig daemon start --port
+  <unused-port>`. Missing, disagreeing or timed-out evidence, and an older daemon without `euid`, keep today's
+  behaviour. No daemon restart is needed. Explicit `OPENRIG_URL` targets and registered remote hosts keep their routing,
+  later browser or TUI connections aren't checked, and with it on `sudo rig …` against a user-owned daemon refuses. It
+  isn't authentication: it trusts the daemon's own report. Details: `rig context get
+  reference/getting-started.md#optional-mac-local-user-check`.
 
 ## What to stop doing
 
-- **Stop looking up a rig's ID before `rig launch`;** the name works.
-- **Stop expecting `rig start --last` to bring back a rig taken down on purpose;** use `rig start --rigs <rig>` or `rig
-  up '<name>' --existing`.
-- **Stop counting on `--dangerously-interact` to press Enter;** put CR in the payload.
-- **Stop taking the preparation prompt's delivery as the compaction's result;** read the `compact` result and confirm by
-  effect.
-- **Stop answering `--fresh` for an ordinary terminal seat on every restore.**
-- **Stop branching on exit 2 for a fixable `rig queue update` refusal;** it's exit 1.
-- **Stop recreating a seat, or editing the database, to change its permission policy;** use `rig policy apply --seat`.
-
-## Known gaps in 0.6.12
-
-- **Managed compaction's 600-character budget** rests on one comparison on Claude Code 2.1.282, and nothing confirms
-  compaction ran.
-- **The plugin hooks haven't run through this path in a real session,** and two hook runs for one seat aren't
-  serialized: a post-compaction record can be lost or a refocus delivered twice.
-- **One Slack app across machines was simulated in one process,** never run on two real machines. Relayed events are
-  trusted from the calling daemon, and `rig slack verify` on the hub doesn't check relayed channels.
-- **`env:` values aren't secret,** and members added with `rig grow` can't carry a member-level `env:`.
-- **`rig up --env` is not forwarded for flat-node specs or v1 bundles,** although the launch may succeed. Do not rely on
-  the flag for those formats in this release.
-- **The draft-aware guard waits for idle inside the seat's delivery lease,** which can delay other work for that seat.
-- **With `bundle.services_enabled` on, `rig up <file>.rigbundle` installs into the current folder** when no `--target` is
-  given.
-- **`rig seat restart --keep-conversation` supports Linux only,** and hasn't been re-run on 0.6.12.
-- **The rig status API can call a running rig `blocked`** because of one seat that isn't running: it folds a restore
-  forecast into current status.
-- **A Codex seat can keep reading as at its usage limit** in a constructed screen case not seen in a real session.
-- **After `rig scope slice create` says it couldn't verify membership, the slice was kept.** Check `mission.yaml` before
-  creating it again.
-- **A Claude Code seat whose permission request was approved automatically can still read "needs input";** the Codex
-  case is fixed.
-- **Codex team seats aren't asked before lifecycle commands yet.**
-- **The send gate trusts the most recently recorded hook;** `rig capture` shows the real screen.
-- **A launched team still writes into its working folder;** the operator says what changes before you agree.
-- **After a restart, `rig status` shows `Kernel: skipped` whatever the kernel seats' state.** Read them with
-  `rig ps --nodes --rig kernel --full`.
-- **`rig tui --shared` still attaches on the default tmux server,** so use `rig tui` when the daemon runs on a non-default
-  tmux socket.
+- **Don't use plain `rig reconcile-session` to fix a launched seat's missing pane.** It adopts the seat into a new
+  session with no resume token; use `--repair-missing-pane --no-launch`.
+- **Don't abandon a manual `rig compact` because preparation hit an approval.** Answer it, or ask the person to, within
+  the 180 seconds.
+- **Don't try `rig ask --wake` on a Pi or custom seat.** Use `rig ask` without `--wake` to search what it said, or send
+  to the live seat.
+
+## Known gaps in 0.6.14
+
+- **The compaction and refocus fixes** are tested without a native compaction or a loaded machine: confirm a
+  compaction by its restore request or the drop in context, and check that a restored seat is really working.
+- **The pane repair refuses while typing protection is on.** The compaction refusal for a protected seat whose pane
+  isn't recorded still suggests plain `rig reconcile-session <seat> --no-launch`, which adopts. For a running launched
+  seat whose pane was never recorded, use `rig reconcile-session <seat> --repair-missing-pane --no-launch` instead;
+  it needs typing protection off, so turn protection off only if the person agrees. A delivery held from before the
+  repair can still refuse.
+- **`rig context get reference/quickstart.md` doesn't resolve:** the page isn't in the reference context pack. Read it
+  from the package's `docs/reference/` or the repository.
+- **On a Mac with more than one user account,** a second user's `rig` commands can reach the first user's daemon on
+  its default port (7433) unless `transport.local_user_guard` is on. The check trusts the daemon's own report, identity
+  can change between the check and the connection, and direct HTTP clients aren't covered.
+- **0.6.13's other known gaps still apply:** a fresh in-place Claude handover can report ready early when the screen,
+  pane or process can't be read or proven; one Slack app across machines hasn't run on two real machines, and Slack
+  recovery doesn't catch up older open threads; `rig seat set-cwd` checks the new folder once.

package/daemon/context-packs/skills/agent-operated-software/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-operated-software"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when designing, building, operating, or diagnosing an ongoing application whose live backend or control loop includes OpenRig agents, including applications with a Markdown, YAML, or JSON agent control plane or a thin surface over specialist agent roles."
 files:

package/daemon/context-packs/skills/agent-operated-workflows/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-operated-workflows"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when a bounded real-world procedure has a deterministic happy path but brownfield, variable, or partially knowable state; when an operation must resume from verified evidence; or when deciding whether agent judgment or ordinary code should own a procedure's control loop."
 files:

package/daemon/context-packs/skills/applying-a-permission-policy/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "applying-a-permission-policy"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use before launching a team during agent-guided setup, or when a user asks to configure OpenRig command permissions, reduce repeated native approval prompts, or apply a selected rig/seat permission policy."
 files:

package/daemon/context-packs/skills/claude-compaction-restore/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "claude-compaction-restore"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when a Claude Code session is about to compact, has just compacted, reached its context limit, resumed after /compact, or must rebuild its working picture of a long-running seat from its own restore map, its JSONL transcript and the files it touched."
 files:

package/daemon/context-packs/skills/core/agent-starters/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-starters"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when creating, refreshing, packaging, inspecting, promoting, or deprecating a named per-seat starting point — Agent Starter manifest authoring, the 6-state lifecycle (captured → named → inspectable → used → promoted → deprecated), provenance honesty, and refusal rules. NOT a VM image; a managed starting point composed from agent role + startup context + optional native session source + provenance."
 files:

package/daemon/context-packs/skills/core/agent-startup-and-context-ingestion/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "agent-startup-and-context-ingestion"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when designing or auditing how an agent becomes useful after launch — AGENTS.md overlays, role files, skills, rig specs, workflow specs, startup checklists, refocus messages, \"rig context\" surface. Covers the 4 failure modes that make startup context fail (old rig spec misses current operating mode; current agents never told about new guidance; startup file as dumping ground; orchestrator transmits implementation without preserving product intent)."
 files:

package/daemon/context-packs/skills/core/cross-host-rig-commands/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "cross-host-rig-commands"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when addressing a registered remote OpenRig host, choosing its transport, or interpreting a cross-host result."
 files:

package/daemon/context-packs/skills/core/human-in-the-loop/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "human-in-the-loop"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when classifying a slice closeout (auto-continue / human gate / park), routing a real decision to a human, or designing a human queue/dashboard surface. Treats humans as durable network participants with attention surfaces, queues, and decision records — escalation lands as a durable attention item, not a chat message. Approval is NOT required for every clean closeout; the default RSI conveyor continues unless an explicit human gate is reached."
 files:

package/daemon/context-packs/skills/core/messaging-the-human/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "messaging-the-human"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when project policy calls for a human decision or update, a human delivery is pending or failed, or a reply must resume the right work."
 files:

package/daemon/context-packs/skills/core/openrig-architect/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-architect"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when designing multi-agent topologies that run ON OpenRig — authoring RigSpec and AgentSpec files for new rigs, creating agent startup content (guidance / skills / culture), or diagnosing why a launched rig's agents aren't behaving as intended. NOT for changing OpenRig itself (use developing-openrig); NOT for ordinary CLI operation of an existing rig (use openrig-user). Covers the full authoring lifecycle from user intent to validated, launchable rig."
 files:

package/daemon/context-packs/skills/core/openrig-cmux/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-cmux"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when opening OpenRig fleet terminals into cmux — turning a rig, pod, mission, slice, or saved view into live agent tiles via `rig terminal --provider cmux`, or driving cmux on an agent's request. Same OpenRig view semantics as openrig-herdr (the verbs, honest-partial/degrade, read-only cross-rig, scroll/copy, same-size-only duplicates); cmux is the **best-effort** provider (herdr is the default and the proof-gated one). Prefer openrig-herdr unless cmux is specifically wanted."
 files:

package/daemon/context-packs/skills/core/openrig-herdr/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-herdr"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when opening OpenRig fleet terminals as a herdr wall — turning a rig, pod, mission, slice, or saved view into live interactive agent tiles via `rig terminal`, watching another rig read-only, or driving herdr on an agent's request (\"open all my rigs + a mission as views\"). Covers the `rig terminal open|views|status` verbs, the honest-partial/degrade reading of the result, the read-only-by-construction rail for cross-rig views, scroll/copy out of the box, and the same-size-only duplicate-pane "
 files:

package/daemon/context-packs/skills/core/openrig-skills/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-skills"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when an agent running inside OpenRig needs the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also when the agent doesn't know what applies or nothing is projected on cold boot. Installing, starting or updating OpenRig, getting back to a team or bringing a stopped one back from a person's own sess"
 files:

package/daemon/context-packs/skills/core/openrig-software-factory/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-software-factory"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when a user wants a continuing software team for a real repository, or has a first OpenRig team and needs a repeatable path for reviewed work and later tasks."
 files:

package/daemon/context-packs/skills/core/openrig-upgrade/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-upgrade"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when an agent is preparing or performing an OpenRig CLI/daemon upgrade and must preserve live seats, verify each mutation, or reconcile managed plugin and skill files without overwriting local work."
 files:

package/daemon/context-packs/skills/core/rig-bundles-and-shareable-artifacts/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "rig-bundles-and-shareable-artifacts"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when authoring or installing a rig bundle (packaged, shareable artifact that instantiates an opinionated OpenRig topology + workflow), reasoning about the bundle vs extension boundary, or auditing a bundle for portability. Covers the 4 failure modes that prevent bundles from working anywhere but the operator's machine, and the inspect-before-install discipline."
 files:

package/daemon/context-packs/skills/core/rig-lifecycle/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "rig-lifecycle"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when reasoning about the rig lifecycle operations family (create / start / stop / resume / restore / snapshot / release / unclaim / destroy), reading or trusting `rig ps` / lifecycle projections after recovery, or designing proof for a lifecycle scenario. Covers the 4 failure modes (auto-restore creates partial rig; projections report healthier than reality; provider auth treated as impl work; resume succeeds for one runtime fails another) plus the restore-honesty rule (failed resume is FAIL"
 files:

package/daemon/context-packs/skills/core/session-source-fork/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "session-source-fork"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when authoring a rig spec member or `rig expand` payload that needs to start a new managed seat from a prior runtime conversation source — `session_source: { mode: fork, ref: { kind, value } }`. v1 supports `mode: fork` with `ref.kind: native_id` for Claude and Codex. The new seat persists a NEW post-fork token; the parent token is NEVER written onto the new seat. NOT for restoring an existing seat or for artifact-backed mental-model rebuild."
 files:

package/daemon/context-packs/skills/core/specification-system/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "specification-system"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when authoring rig specs, agent specs, workflow specs, startup/context fragments, operating-mode declarations, or designing the user spec library. Covers the 4 failure modes (spec instantiates topology but not workflow/mode; spec depends on local paths and fails on another host; agents modify specs as one-off files instead of preserving reusable intent; validation proves YAML shape but not whether topology can run) and the validation-vs-runtime-realization distinction."
 files:

package/daemon/context-packs/skills/core/topology-mutation-and-seat-management/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "topology-mutation-and-seat-management"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when changing a rig while it is alive — `rig grow` / `rig expand` / `rig shrink` / `rig launch` / `rig remove` / `rig discover` / `rig bind` / `rig adopt` / `rig attach`. Covers the 4 failure modes (newly created seat lacks queue/startup/role; edges and permissions not updated; adopt/bind succeeds at tmux but not OpenRig identity; shrink/remove leaves stale topology references) and the rule that mutation must work while the rig is active, not just in clean fixtures."
 files:

package/daemon/context-packs/skills/core/watchdog/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "watchdog"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when configuring `rig watchdog` policies, authoring wake/refocus/alignment-checkpoint messages, or choosing the right intervention level for a stale-owner situation. The 3-level continuity-check stack (wake / refocus / alignment-checkpoint), the discipline that prevents cadence pollution and bureaucracy theater, and the artifact-pool loop-edge pattern for evidence-aware waking."
 files:

package/daemon/context-packs/skills/delegating-work/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "delegating-work"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context — or how to brief the agent you hand it to, which depends on the model it runs. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-developme"
 files:

package/daemon/context-packs/skills/forming-an-openrig-mental-model/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "forming-an-openrig-mental-model"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when the system around you does not make sense yet: you just booted into a seat and do not know how the pieces fit; someone said rig, pod, seat, fleet, topology, or slice and you are not certain what they mean here; you are unsure what kind of rig you are in or what it is for; you do not know how skills reach you or where context comes from; or you are about to act on a guess about how OpenRig works. Gives the runtime mental model fast, so you stop guessing."
 files:

package/daemon/context-packs/skills/loading-addressable-markdown/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "loading-addressable-markdown"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when a mission, slice, dashboard, or task references Markdown as path#h2-slug or path#h2-slug/h3-slug outside the OpenRig context-pack library."
 files:

package/daemon/context-packs/skills/mission-slice-sop/SKILL.md

@@ -109,6 +109,11 @@ When you `rig capture` a pane, **greyed / ghost autocomplete suggestions are NOT
 
 **Rule:** ignore ghost/autosuggest text entirely. Only *committed/rendered* pane output is real. When it matters, verify at source (git, the queue, the actual event) — never off a capture's ghost line.
 
+A plain capture loses the grey, so `rig capture` reads it for you. For a Claude Code or Codex seat, a
+`[rig capture: <seat>: input box: ...]` note on stderr (and `inputBox` in `--json`) says whether the input box's text
+is likely a harness suggestion or typed, from where the cursor is and whether the text is drawn faint. Don't act on
+`likely-suggestion` text as anyone's intent, and treat `unknown` as unknown: verify at source.
+
 ## Moment-of-truth checklist
 
 - **Starting a slice?** → do you know what it's for and what done looks like? mockups attached (UI slices)? **Are you on the light path?** (You are, unless the mission owner assigned the overlay.)

package/daemon/context-packs/skills/mission-slice-sop/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "mission-slice-sop"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when starting, building, handing off, restoring, or closing a mission or slice under the default lightweight SDLC."
 files:

package/daemon/context-packs/skills/openrig-operating-model/manifest.yaml

@@ -1,7 +1,7 @@
 # GENERATED by scripts/generate-context-packs.mjs — DO NOT EDIT.
 # Package-time projection of a canonical skill; regenerated every build.
 name: "openrig-operating-model"
-version: "0.6.12"
+version: "0.6.14"
 taxonomy: "skills"
 purpose: "Use when you do not know WHERE something belongs: you learned a lesson and are unsure which file takes it; you are about to create a new doc, folder, or convention; you are asking \"should this be a skill, a note, or a chain file?\"; you inherited a seat and want to know what SHOULD exist; or you are about to duplicate knowledge that already has a home. Also the trace-to-root: how a seat orients by reading one filename at each level from where it stands up to the fleet."
 files:

package/daemon/context-packs/skills/openrig-user/SKILL.md

@@ -384,11 +384,19 @@ rig reconcile-session <session>
 rig reconcile-session <session> --rig <rigId> --node <logicalId>
 rig reconcile-session <session> --no-launch
 rig reconcile-session <session> --json
+rig reconcile-session <session> --repair-missing-pane --no-launch
 ```
 
-This is a no-launch, no-input adopt. `--rig`/`--node` disambiguate when the
-canonical session name does not uniquely resolve. `--no-launch` is accepted
-for explicitness (it is the only mode this command has).
+This is a no-launch, no-input adopt: it records a new claimed session row for
+the seat (any running row is superseded); it re-captures the resume token if
+it can, and conversation continuity stays unverified. `--rig`/`--node`
+disambiguate when the canonical session name does not uniquely resolve.
+`--no-launch` is accepted for explicitness.
+
+`--repair-missing-pane --no-launch` is different: for a running launched seat
+whose tmux pane was never recorded, it fills in the pane and keeps the
+session, resume token and generation. It never adopts. Both forms refuse
+while the seat's typing protection is on.
 
 ### Five-term restore status vocabulary