@openrig/cli 0.6.14 → 0.7.1

package/daemon/assets/skills/rigs/SKILL.md

@@ -14,7 +14,8 @@ if the person asks you to. When they say what they want built, give it to OpenRi
 building it yourself.
 
 Tell the person what you're about to run and why before you run it. Don't install system packages or change their
-machine without a yes. Starting OpenRig and a team writes files: Codex hooks and settings in
+machine without a yes, and don't start a team, including `rig up`, without their yes to what it will start; a yes they
+already gave for that same launch counts, so don't ask twice. Starting OpenRig and a team writes files: Codex hooks and settings in
 `~/.codex/config.toml`, Claude Code workspace trust in `~/.claude.json`, discovery skills in `~/.claude/skills` and
 `~/.agents/skills`, and, in the repository, managed guidance in `AGENTS.md` or `CLAUDE.md`, activity hooks in
 `.claude/settings.local.json` and a status line there unless the project already has its own, plus the team's skills
@@ -23,6 +24,10 @@ seats run with an operational default: Codex with `-s danger-full-access -a neve
 tools, web fetches and operational commands, including reads under the home folder, allowed without asking. Say so
 before you start OpenRig ([the full list](https://github.com/mvschwarz/openrig#what-openrig-changes-on-your-machine)).
 
+When you give the person a file or a command to run in their own terminal, use a path that exists on their side. A
+file a sandboxed agent writes under `/tmp` may not exist in the person's terminal (seen with Codex), so put files the
+person needs in their project or home folder and name that path.
+
 ## 1. Install OpenRig, if it isn't installed
 
 - **Check first:** `rig --version`. If it prints a version, go to step 2.
@@ -105,14 +110,20 @@ before you start OpenRig ([the full list](https://github.com/mvschwarz/openrig#w
   `rig attach --self --rig <rigId> --pod operator --member person-agent --runtime <claude-code|codex> --print-env`.
   `--node <logicalId>` binds to an existing seat instead. Attach once, and keep the variables it prints
   (`OPENRIG_NODE_ID` and `OPENRIG_SESSION_NAME`). Each command may run in a fresh shell, so put them in front of every
-  later `rig` command. Check with `rig whoami --json`.
+  later `rig` command. Check with `rig whoami --json`, and use it or `rig seat status` later for identity and state,
+  not `rig attach --json` output. Don't print `OPENRIG_ACTIVITY_*` values: they're credentials.
+  If they decline, a message that must still say who it's from can go as a queue item with a declared source,
+  `rig queue create --source <their id>@external --destination <seat> --summary "<one line>" --body-file <file>`: the
+  seat sees that name, recorded as declared, and can reply to them if they're registered (`rig gateway human list`).
+  A declared name is a claim, not a seat's own identity: for a team that acts only on seat identity, the attached
+  shell above is the route.
 - **Give the operator the goal:** ask what they want worked on, in which repository and on which branch, unless they've
   said. Find the `operator.agent` row in `rig ps --nodes --rig kernel --json`, take its `canonicalSessionName`
   (never the logical ID or a guessed name) and send:
   `rig send <canonicalSessionName> 'This is the agent that installed OpenRig. The person will answer in your pane. Goal: <goal>. Project folder: <absolute path>. Branch: <branch>.'`
   Or the person types the goal and folder in the operator's pane. If they give you a goal later, forward it the same
-  way. The operator helps them pick a team that fits their logins, starts it on their yes and gives the goal to the
-  team's lead. Before that yes, it says what launching into their folder changes for their own agent there; relay
+  way. The operator helps them pick a team that fits their logins, starts it (`rig up`) only on their yes to the plan it
+  shows, and gives the goal to the team's lead. Before that yes, it says what launching into their folder changes for their own agent there; relay
   that with the question. Show them where the operator answers, and don't build the project yourself.
 - **Relay the operator's questions:** the operator asks in its own pane, and the person may not be looking there.
   After each step you hand it, read its screen with `rig capture <canonicalSessionName>`. When it asks the person
@@ -125,8 +136,17 @@ before you start OpenRig ([the full list](https://github.com/mvschwarz/openrig#w
 - **See what's running:** `rig ps`, then `rig ps --nodes --rig <rig>` for a team's agents. If a team is already
   running in that repository, tell the operator.
 - **Check it's ready before you say so:** `rig ps --nodes --rig <rig>`. If an agent is stopped at a prompt or a menu,
-  read it with `rig capture <seat>@<rig>` and answer with the key that screen shows (`rig send --help` says how to
-  send a digit, a letter or Escape), or ask the person. Capture it again before sending anything more.
+  read it with `rig capture <seat>@<rig>`. A permission prompt is the person's to answer: show it to them, with any
+  others waiting, one line each (seat, exact action, the choices offered). Before sending their choice, capture that
+  seat again: if its prompt changed, don't reuse the answer. Then send exactly the choice they made for that prompt
+  (`rig send --help` says how to send a digit, a letter or Escape to a prompt). A yes to one prompt isn't a
+  yes to the next, and never pick a "don't ask again" choice they didn't pick. If they've told you outright to decide a
+  kind of future prompt (say, "approve prompts that only write inside my project"), you may decide each one: read its
+  whole action, answer only when it's clearly inside what they said, and tell them you answered under that instruction,
+  not that they said yes. Bring anything unclear or outside it back to them; a command's name or a path that looks like
+  their project doesn't show what the action touches. Their instruction changes no permission setting.
+  Another kind of menu you can answer with
+  the key that screen shows, or ask the person. Capture it again before sending anything more.
 - **Replies:** in a plain shell, other agents can't type into this session. Read work sent to you with
   `rig queue list --destination <your address>` and `rig queue show <id> --full`, and read an agent's screen with
   `rig capture <seat>@<rig>`.

package/daemon/context-packs/help/manifest.yaml

@@ -1,6 +1,6 @@
 # Agent help: the single troubleshooting and escalation guide (docs/reference/help.md).
 name: help
-version: "0.6.14"
+version: "0.7.1"
 taxonomy: world
 purpose: "What an agent does when its user says OpenRig isn't working: diagnose, fix within permissions, verify, and escalate to OpenRig support."
 files:

package/daemon/context-packs/onboarding-width/manifest.yaml

@@ -1,6 +1,6 @@
 # Public capability and source-map width for the default onboarding walk.
 name: onboarding-width
-version: "0.6.14"
+version: "0.7.1"
 taxonomy: world
 purpose: "The public capability map and source map referenced by the default onboarding walk."
 files:

package/daemon/context-packs/onboarding-width/public-what-you-can-do.md

@@ -10,9 +10,11 @@ already does it, or two verbs crossed already answer it. **You cannot look up a
 not know exists.** So the point of what follows is not skill. It is recognition: that when a task
 lands, something rhymes, and you go check instead of building.
 
-Eighty-eight top-level verbs ship (capability canon refreshed through
-`capability-delta-v0.6.14`). This marker describes the pack's teaching, not publication or live
+Ninety top-level verbs ship (capability canon refreshed through
+`capability-delta-v0.7.1`). This marker describes the pack's teaching, not publication or live
 adoption. Read this once for shape, and let it make you suspicious that a thing already exists.
+What changed in the installed version, and what to do about it, is one read away:
+`rig context get reference/whats-new.md`.
 Model-divergence proclamations are live product (trust them; pins use canonical
 model IDs).
 
@@ -36,7 +38,10 @@ one command away. Your memory of the fleet is a claim about the past.
   source and time), or unknown; it never shows the configured model in its place. A Claude seat at
   Claude Code's MCP-server approval menu reads as needing input (`mcp_gate`), a Codex seat at its
   folder-trust panel reads `trust_gate`, and an OMP seat whose turn ended with a typed transient
-  provider failure reads idle and takes an ordinary retry.
+  provider failure reads idle and takes an ordinary retry. The `ATTN` column (`yes`, `no` or `?`)
+  says which seats need attention (`needsAttention` in `--json`; `--full` shows every field). Cells
+  are one space apart, so read `--json`, with `--fields` to pick fields, rather than column
+  positions.
   **`rig ps --resources`** shows this host's load and transcript capture cost.
 - **`rig ps --all-hosts --nodes -A`** — the same across every registered machine. Rollup-only
   unless you ask for nodes.
@@ -45,7 +50,10 @@ one command away. Your memory of the fleet is a claim about the past.
   When the seat's typed rows name exactly one work node, its JSON also carries `currentWork` with
   the mission, slice, and path the refocus hook uses.
 - **`rig seat status <seat>`** — what the system already believes about a seat's handover state,
-  and whether the thing you did an hour ago actually landed.
+  and whether the thing you did an hour ago actually landed. Before a relaunch, it shows what the
+  seat's next fresh managed launch will ask for, labelled planned rather than observed: the native
+  permission argument, where each part comes from, what OpenRig adds and the commands that change
+  it, plus the seat's terminal policy.
 - **`rig view list` / `rig view show <lens>`** — named lenses over coordination state: use
   `view show escalations` for owner attention, `view show pickup` for claimed-row state, and
   `view show execution` for done/now/next and current authored planning guidance with its
@@ -98,20 +106,32 @@ unseen — which makes messages the one delivery channel that never gets skipped
   producer-link advisory reading `no_activity_signal` means activity could not be determined;
   confirm by effect, never relaunch on it. A send or wake to a seat whose latest hook is a
   question waiting for a person is refused with `target_needs_input`, even when its screen
-  can't be read: read it with `rig capture` and get the question answered instead of retrying.
+  can't be read, and so is one to a Claude seat whose hook just reported it running while its
+  screen shows an MCP enablement menu, a question or a permission prompt: read it with
+  `rig capture` and get the question answered instead of retrying.
   `--wait-for-idle N` waits before it takes the seat's delivery lease, so other sends and wakes to
   that seat aren't held behind it; N is a deadline from the start of the wait.
   Over `--host` to an http-registered host, a send that may have reached the remote reads
   `remote-outcome-unknown` ("Delivery UNCONFIRMED"): check the target with `rig capture <session>
   --host <id>` before any resend. Only a host that was never reached reads as unreachable. A send
   whose caller goes away (Ctrl-C, or its own timeout) before input starts is refused with
-  `caller_cancelled` and never types later.
+  `caller_cancelled` and never types later. **`--urgent`** marks a message urgent, as does a row
+  at priority `urgent` or `critical`: its wake starts `Urgent (marked by …):`, and it gets through a
+  seat whose typing guard lets only urgent input type (`openrig-urgent` or `urgent-only`, below).
 - **`rig send --raw`** — send exact text or keystrokes without the From/To envelope;
   the interactive-prompt guard still applies. To deliberately drive an interactive prompt,
   **`--dangerously-interact --reason "<why>"`** is the explicit override and implies raw text.
   Inspect the prompt and establish authority for its effect before using that override. It types
-  exactly the bytes and keys you give it, in any state: Enter is added only for a complete answer
+  exactly the bytes and keys you give it: Enter is added only for a complete answer
   staged in a recognised Claude Code or Codex input box, so anywhere else put CR in the payload.
+  **On a managed seat it stops before typing into an input box that already holds typed or pasted
+  text**, and shows you that text, apart from a recognised dim suggestion; it types nothing. Clear
+  the box and retry, or add `--type-without-checking`, which reads and clears nothing and may join
+  or submit the existing text. Keys for a recognised native menu are sent as before, and collapsed
+  paste contents or an unrecognised input can't be read. Not yet checked on a live seat whose box
+  holds only a suggestion, or typed text beside one. Don't use it to type over a half-written box:
+  to reach a seat with something that can't wait, use `--urgent` where its typing-guard level lets
+  urgent input through.
   A send to a pane in tmux copy or view mode leaves the mode once and delivers; a pane that can't
   leave is refused with `pane_in_mode`. With `transport.verify_input_box` on (off by default),
   `--verify` to Claude Code or Codex reads verified only when the text was seen in the input box
@@ -144,7 +164,23 @@ unseen — which makes messages the one delivery channel that never gets skipped
   including an error answer from the daemon such as a removed rig, still end the wait.
 - **`rig stream emit` / `list` / `watch` / `archive`** — drop an observation somewhere the *next*
   agent will find it. Emitting costs nothing and does not interrupt anyone; the value appears when
-  someone lists the stream before starting.
+  someone lists the stream before starting. **`rig stream show <id>`** says what became of one:
+  its routing, linked work and that work's state. Items emitted from 0.7.1 on are kept 30 days or
+  the newest 20,000 (`retention.stream_days`, `retention.stream_max_items`) unless a record names
+  them, and a body over 16 KiB is stored truncated.
+- **`rig stream subscribe <seat>`** — let a seat read only what concerns it: items addressed to it
+  or matching its topics (`--tags`, any of; `--type` for one hint type; subscribing again keeps its
+  place). **`rig stream read`** then returns the calling seat's next bounded page (at most 20 items
+  and 64 KiB, with `more`, `unread` and any `gap`); `--reader <session>` names the seat from outside
+  one. `rig stream subscriptions` lists readers with their unread counts, and `rig stream
+  unsubscribe <seat>` stops one.
+- **`rig acp run <row> --cwd <dir> -- <command>`** — hand one queue row's task to an outside agent
+  that speaks ACP (for example `openclaw acp`) as a single turn. The row's notes get the agent and
+  session, progress, each permission request and its answer, and the outcome (completed, stopped,
+  cancelled, failed or unknown): the agent's report, not a judgment, so the row stays open for you to
+  judge and close. Each permission request is a row to `--permissions-to` (default: you). The guide
+  is `docs/reference/acp-agents.md` in the source repo, and `docs/reference/a2a-agents.md` covers
+  A2A agents.
 - **`rig terminal open <view>`** — open a desktop terminal with live agent tiles; a window is the
   default. **Opening `rig terminal open saved:kernel --window` is the step after install or start**:
   say you're opening it, run it on the daemon's desktop, then tell the person where it opened. Don't
@@ -165,6 +201,11 @@ unseen — which makes messages the one delivery channel that never gets skipped
   the failure. `--provider herdr` or `--provider cmux` adds tiles inside a workspace that is
   already visible, without opening a window; in `--json` output, `reusedWorkspace` with no new
   tiles means an existing view was reused, which is success.
+  Add `--session <name>` to select a Herdr session for that request; `--session default`
+  explicitly selects its default session. `rig terminal status --session <name>` inspects
+  the same endpoint. Omitting the flag keeps the daemon's configured endpoint. Herdr tiles come
+  back attached after a Herdr restart, except a tile over SSH: reopen that one with
+  `rig terminal open <view> --provider herdr`.
   In the TUI, **TERMINALS** keeps Saved views prominent and Derived groups collapsed until
   expanded. Names load before detailed readiness. Select a view to inspect its members,
   layout and pages; preview is passive. Saved membership requires deliberate setup.
@@ -232,7 +273,8 @@ your context, your compaction and your replacement — and it is the only thing
 - **`rig queue update`** — record what happened in a form the rest of the system can act on. A
   `--note` does not reopen a terminal row; terminal-to-active repair requires explicit `--reopen`
   with both `--state` and `--note`. `--summary` on its own corrects a row's subject in any state,
-  and a close with `--resolution "<outcome>"` stores the outcome on the row.
+  and a close with `--resolution "<outcome>"` stores the outcome on the row; `--state done
+  --evidence-ref <path>` also keeps the artifact's pointer on it.
 - **`rig queue handoff`** — pass work so the close and the create are **one transaction**, instead
   of closing yours, failing to create theirs, and stranding the work in between. A standing sweep
   checks recently closed rows (a 24-hour lookback) and flags a `handed_off_to` closure whose
@@ -273,7 +315,11 @@ you that is still running.
   asleep, compacted or finished. For a context wall, use the exact
   `--policy context-usage-threshold` rather than a hand-rolled transcript timer. A scheduled
   reminder arrives as the authored message under an explicit scheduler identity, not as YAML
-  syntax or anonymous agent input.
+  syntax or anonymous agent input. The context watch takes `--threshold-tokens` or
+  `--threshold-percent` (of the seat's context window), measured from the seat's own usage sample.
+- **`rig watchdog update <jobId>`** (`--interval-seconds`, `--message`, `--spec`) — retune a live
+  job in place. It keeps the job id, so a queue row's attachment still holds; don't stop and
+  re-register a job to change it. A stopped or finished job is refused, not restarted.
 - **`rig watchdog list` / `show` / `status` / `stop`** — did it fire, is it still live, did someone
   stop it. `list` defaults to active, compact, and 100; `--all --full` is the complete history.
   **Quiet skips are not recorded**, so a healthy idle job and a job that never ran look identical
@@ -415,9 +461,26 @@ not have to tear one down to change it, and you rarely have to start from nothin
   before launch; and a Claude seat slow to draw its screen ends `attention_required` with its pane
   kept, not failed. An `env:` block on the rig or a member in `rig.yaml` reaches every seat and
   carries into restores and handovers, and `rig up <spec> --env KEY=VALUE` adds one for a single
-  launch; the values aren't secret (they're stored and exported).
+  launch; the values aren't secret (they're stored and exported). **New seats don't inherit the
+  tmux server's global environment** (`terminal.inherit_tmux_environment`, default false), so a
+  value set with `tmux set-environment -g` no longer reaches them. A new seat starts from the
+  daemon's values for the names in tmux's `update-environment`, a fixed set (`LANG`, `LC_*`, `TZ`,
+  `TMPDIR`, `XDG_*`, `CLAUDE_CONFIG_DIR`), the launch environment (`PATH`, `HOME`, `USER`,
+  `CODEX_HOME`, `OPENRIG_*` and the allowlisted provider auth variables) and its own `env`. Put an
+  account or key in the seat's `env` or `rig up --env`, or set the key to true. Running seats are
+  untouched, and `rig setup` warns when it sees a custom tmux configuration.
+  **`rig up <spec> --name <rig>`** runs one spec as another rig under that name; the rig keeps the
+  name for `--existing`, snapshots and restore, and the spec file isn't changed.
+- **A Claude member can bring its own setup** in the rig spec: `agent_file`,
+  `append_system_prompt_file`, `plugin_dirs` and `advisor` (an Advisor model). They're copied into
+  that seat's own storage, never the project, so one seat in a shared repository can have its own
+  persona, prompt or plugins. A bundle's before-install view lists them.
 - **`rig community-harness list`**: list installed community-harness presets and declared limits
-  (not tested by OpenRig; launch-only).
+  (not tested by OpenRig). A preset can declare how its app reports the conversation each launch
+  made (`launch_result`), reopens one on resume (`resume`) or lets OpenRig name it
+  (`names_conversation`); without those it stays launch-only. A conversation
+  that's gone reads `missing`, never quietly replaced. Examples for Cursor, Hermes and OpenClaw are
+  in `docs/reference/community-harness-examples/`.
 - **`rig down`** — stop a rig's seats and take it out of the running set. It ends the agents'
   sessions and any work in progress; don't run it on a live team unless the person asked. In
   human mode it first prints one line with each agent's last known activity, or “unknown”: a
@@ -432,6 +495,10 @@ not have to tear one down to change it, and you rarely have to start from nothin
   exactly one existing seat. It uses no resume, fork, rebuild, snapshot, or restore packet;
   siblings and durable work stay put, and unmanaged ambiguity refuses. With `--stop`, a seat with a
   still-live older session is refused before anything is stopped; `--plan` previews it.
+- **A new seat's first startup message is OpenRig's identity context, not a task.** A seat with
+  nothing else to start with (no role file, no restore, no obligations) is asked to run
+  `rig whoami --json`, reply with its identity and readiness, and wait for an assignment.
+  Repository history and tool descriptions aren't assignments.
 - **`rig seat restart <seat> --keep-conversation --reason <why>`** — restart one Codex seat in its
   own pane on the same conversation, so it starts again on whatever account its Codex home now
   holds; it doesn't switch accounts itself. It refuses with nothing stopped unless the seat is a
@@ -448,6 +515,16 @@ not have to tear one down to change it, and you rarely have to start from nothin
 - **`rig add`** / **`rig expand`** — graft one more member, or a whole new pod, onto a rig that is
   already running. `rig add`, `rig grow` and `rig remove` take the rig's name or ID; a name two active rigs share is refused
   with `rig_ambiguous` and the candidates. `rig grow --new-pod` and `rig expand` are one ingress; choose by input shape.
+- **`rig edge add <rig> <from> <to> --kind <kind>`** / **`rig edge remove <rig> <edge-id>`** —
+  change one edge on a running rig, such as a replaced seat's, instead of taking the rig down.
+  `--plan` shows the change without writing, and a `delegates_to` change says when it moves who
+  work routes to.
+- **A rig's name works wherever a rig is named.** `archive`, `unarchive`, `release`, `shrink`,
+  `expand`, `snapshot` (and `snapshot list`), `export`, `restore --rig` and `restore status --rig`
+  take its name, as `launch`, `add`, `grow` and `remove` do, and so do the MCP tools `rig_down`,
+  `rig_snapshot_create`, `rig_snapshot_list`, `rig_restore`, `rig_rig_nodes`, `rig_add` and
+  `rig_bind`. A name two rigs share returns `rig_ambiguous` with the candidates. Don't look the id
+  up first.
 - **`rig remove`** / **`rig shrink`** — take a seat, or an entire pod, out of a running topology.
   If it holds active work, pass `--fallback <live-seat>` to reroute before mutation; without a
   valid fallback the command refuses rather than strand the rows.
@@ -464,9 +541,9 @@ not have to tear one down to change it, and you rarely have to start from nothin
   the system see the live process **without launching anything**. A running seat that refuses every
   send because its tmux pane was never recorded (one launched by an older OpenRig) takes
   `rig reconcile-session <seat> --repair-missing-pane --no-launch`: it fills only the missing pane,
-  keeps the session and resume token, never adopts, and refuses while typing protection is on.
-  Plain reconcile adopts the seat into a new session without its resume token; use the repair even
-  where a protected seat's compaction refusal still suggests plain reconcile.
+  keeps the session and resume token, and never adopts. Plain reconcile adopts: a new session row
+  (any running row for the seat is superseded); it re-captures the resume token if it can, and
+  conversation continuity stays unverified. Both refuse while typing protection is on.
 - **`rig unclaim` / `rig release`** — stop managing one adopted session, or all of them,
   **without killing the process or the agent inside it**. Handing something back to its human is a
   first-class move, not an abandonment.
@@ -493,7 +570,15 @@ version, from checking the environment to a useful report to the OpenRig team.
   Stop distinguishes process/listener exit from a clean asynchronous drain: inspect the matching
   `daemon-shutdown.json` and log when completion is incomplete or unverified. No target is a
   distinct no-op, and a timeout never proves down. Use command help for exact limits and recovery.
-  `/healthz` reports the daemon's effective UID as `euid`, beside `pid`.
+  `/healthz` reports the daemon's effective UID as `euid`, beside `pid`. Running several OpenRig
+  homes on one machine on purpose: `rig config set daemon.db_conflict stop` refuses a start whose
+  database another live daemon already holds (the default, `warn`, only warns), and
+  `rig daemon start --allow-db-conflict` allows one deliberate start.
+- **A busy daemon isn't a down one.** The CLI refuses only when the daemon is confirmed down
+  (stopped, stale, a refused probe), its probe is blocked, or it's a sibling home; a busy daemon
+  gets the real request. A write that then times out says its outcome is **unknown**: check its
+  effect before any retry, and don't restart the daemon because it didn't answer. `rig up` and
+  `rig start` no longer start a second daemon over a busy one.
 - **`rig doctor`** — is the *installation* wired up correctly, or are you chasing a bug that is
   really a broken install. It checks Claude and Codex installs, and a login or configured provider
   credential, the way setup does; it fails for a harness the person doesn't use, which they can
@@ -542,6 +627,11 @@ version, from checking the environment to a useful report to the OpenRig team.
   continue from the receipt. There is no `rig upgrade` verb, and `rig down` is not part of a
   continuity-preserving upgrade. After an upgrade, `rig context get reference/whats-new.md` says
   what behaves differently for an agent; the skill's last step reads it and tells the person.
+  Startup keeps a copy of every OpenRig plugin or skill file it replaces: before the refresh writes
+  the new copies, it saves each replaced file under `$OPENRIG_HOME/backups/managed-refresh/` and
+  logs `preserved previous contents of <file> at <copy> before managed refresh`, whether or not you
+  edited it (about 22 copies on the first start after a stock upgrade, so a copy doesn't mean
+  anything was changed). An edit you made isn't lost: reapply it from the copy.
 - **A seat's `compaction_strategy` is declared, not improvised at the wall.** Pair a threshold-
   managed seat with the `context-usage-threshold` watchdog above so continuity is arranged while
   the seat can still act.
@@ -587,13 +677,27 @@ version, from checking the environment to a useful report to the OpenRig team.
   touching its spec or its peers; nothing restarts. **`rig seat effort <seat>`** reports what was
   requested, what's saved, what the running process was launched with and what the session
   recorded (NOT VERIFIED until the seat takes a turn). It works for Pi seats too, sent as `--thinking`.
-- **`rig seat set-typing-guard <seat> --mode off|draft-aware|hold --reason <text>`** — choose
-  ordinary automatic delivery, immediate retention when input is busy/unreadable, or holding all automatic
-  input. `--enabled true|false` remains compatible: true selects hold, false selects off.
+- **`rig seat set-typing-guard <seat> --mode <mode> --reason <text>`** — choose how much automatic
+  input reaches a seat, for example while a person works in its terminal: `off` (ordinary
+  delivery), `draft-aware` (retained at once when the input box is busy or unreadable),
+  `sends-only` (deliberate sends from people and agents type; OpenRig's own notices are held),
+  `openrig-urgent` (OpenRig's own messages and anything marked urgent type), `urgent-only` (only
+  urgent messages type) or `hold` (no automatic input; one held notice per wake instead of
+  re-nudges). `--enabled true|false` remains compatible: true selects hold, false selects off.
+  Known limit: in `draft-aware`, a multi-line message to a Claude seat can stay unsubmitted when the
+  paste changes Claude's footer hint, and later sends wait behind it; check the seat's composer.
   `rig seat status` shows the requested/effective mode; wait for pending activation to finish.
   **`rig seat held-messages`** lists what was retained and **`rig seat retire-held-message`**
   retires one; changing mode does not replay old held messages. Draft-aware returns the exact
   refusal and original ID immediately; callers decide further action, with no daemon retry timer.
+- **`rig seat set-terminal-policy <seat> --preset no-peer-interventions|help-within-instructions|full-control
+  --reason <text>`** — choose how far OpenRig and peers may act on a seat: `--helper <addresses…>`
+  names helpers covered by the instruction, `--rig-default` sets the rig's choice for seats added
+  later, and exceptions take `allow` or `deny` (`--peer-compaction`, `--self-model`,
+  `--openrig-model` and the like; model covers effort too). So a seat can keep its saved model while
+  still allowing managed compaction. Managed compaction and saved model or effort changes are
+  checked, and a denial reads `terminal_policy_refused`; other interventions are guidance only. It
+  changes no native permissions or typing-guard level. `rig seat status` shows it.
 - **`rig compact-plan`** → **`rig compact`** — who is near the context wall, then act on it.
   **Ordering matters: running `compact` without the plan is guessing which seat needed it.**
   Managed compaction waits for the seat's restore map before compacting; `rig compact --state`,
@@ -611,6 +715,22 @@ version, from checking the environment to a useful report to the OpenRig team.
   hooks; a seat can give a slow refocus more time with `OPENRIG_REFOCUS_BUDGET_MS` (4500 to 52000).
   The refocus work packet stays off by default for Claude Code and Codex;
   `OPENRIG_REFOCUS_WORK_PACKET=1` turns it on, with each field bounded.
+  `policies.claude_compaction.preparation_root` (an absolute path) puts restore maps where seats
+  may write. A daemon restart picks a managed compaction up where it stopped: an owed restore step
+  resumes, a `/compact` that may have been sent is never sent again, and `rig compact --state`
+  shows anything stranded or owed.
+- **Codex seats get `openrig-core` too: its refocus after a compaction and its skills, with no
+  first-launch review stop.** OpenRig installs the plugin into Codex on boot and on a fresh launch.
+  On a first install, with no existing registration or cache, it trusts the plugin's six hooks by
+  their exact definition, after checking the packaged, vendored and installed copies byte for byte.
+  A fresh Codex seat starts ready unaided, and a 0.6.14 Codex home upgrades and resumes ready.
+  Activity still comes only from the four inline activity hooks, so events aren't duplicated. Your
+  choice stands: an install you left untrusted or declined stays in Codex's own review through
+  restart and upgrade, a plugin or hook you disabled stays disabled, and nothing outside those six
+  hooks is trusted. Limits: the files are checked only when trust is granted, so a later edit to a
+  cached hook keeps that trust, as with any hook trusted in Codex; the trust covers that
+  `CODEX_HOME`, so your own Codex sessions there load the plugin too, and its hooks do nothing
+  outside an OpenRig seat; adding your own Codex hook can trigger a re-review of one OpenRig hook.
 - **Know what compaction costs before you reach for it.** On some runtimes what comes back has
   enough context left to believe it knows everything and not enough to actually know anything — and
   **the compacted agent is the only one who knows it happened**, while every other seat keeps
@@ -743,6 +863,14 @@ scheme, and nothing downstream can see it.
   Write it with this command, not a file tool, so earlier recaps are kept.
 - **`rig project classify` / `list` / `show`** — turn a raw observation into a routed, typed,
   deduped record instead of hand-creating a row from a hunch.
+- **`rig project wake --decide`** (opt-in, off by default) — route stream observations to owned
+  work with typed decisions. Once `decisions.enabled` is true, `decisions.consumers` includes
+  `stream` and the intake seat has `OPENROUTER_API_KEY` in its process, each eligible observation
+  gets one bounded typed decision during that seat's wake: create a row for a supplied owner, join
+  supplied work, or record a duplicate or no action. Anything uncertain, refused or failed goes to
+  the intake seat as its own disposition, and the model isn't asked again. **`rig project decisions
+  status`** shows what a run would do without making a call. Without `--decide`, or with decisions
+  off, nothing changes, so intake stays by hand.
 
 ## Making a shape exist somewhere else
 
@@ -833,6 +961,38 @@ reaching them is ordinary work rather than an escalation.
   to the external participant, not a separate outbound route.
 - **`rig gateway human add`** — register a person and their connector binding. Registration or
   connector changes do not themselves authorize a message.
+- **Every ask to a person lands on the TUI's Feed**, where they can answer it (and on Steering for
+  anyone running the Steering app). Whether it also posts to Slack is their subscription:
+  `rig gateway human set <id> slack-subscription every-ask|urgent-only|unset` (`every-ask` is the
+  default). Under `urgent-only`, only an ask
+  created or handed off with `--alert` posts. `--alert` also makes an ask stand out in Slack (an
+  interrupt with a mention) under either setting, so keep it for something only they can do, or an
+  approval whose wait costs now. Don't assume every ask pings them on Slack.
+- **`rig gateway human quiet set <id> --daily HH:MM-HH:MM`** (or `--until <HH:MM|ISO>`, with
+  `--tz`) — hold a person's routine asks while they're away, and post each one once when they're
+  back. While quiet, a routine ask is held: nothing posts and nobody is mentioned, the row notes
+  `delivery-decision: quiet-hold …`, and its `waiting.nextBackstop` reads
+  `quiet-release:<windowId>`. Asks tagged `escalation` or `wake-escalation` still go through, and if
+  quiet hours can't be read, nothing posts to that person. `end` ("I'm back"; a daily rule stays for
+  tomorrow), `clear` and `show` manage it. Reach for it when a person says routine asks can wait;
+  don't build a hold yourself.
+- **`rig gateway human mode save <id> <name>` / `apply` / `current` / `end` / `account`** — a
+  person's agreed modes ("asleep", "out of office"). `save` takes `--availability
+  available|focus|away|off`, `--expected-back`, `--decision-room "<their words>"`, `--exclude`,
+  `--quiet`, `--tz` and `--account <where>`. `apply <id> <name> --until <time>` ends the mode on
+  time and files a `mode-scheduled-end` row for the kernel operator, falling back to the seat that
+  applied it. The account says, from records only, which effects ended, were kept or failed: never
+  tell the person "back to normal" while one reads `kept`, `pending` or `failed`. `rig mode`, the
+  rig's own posture, is a different thing.
+- **`rig gateway human mode room <id>`**, then **`rig gateway human mode decide <qitemId>
+  --application <id> --reason "<why>" (--reversible|--irreversible) [--choose q=opt…]`** — decide
+  your own pending ask on a person's behalf, inside the decision room their mode gives. It's
+  recorded as delegated, never as their answer, and the ask closes. Only the agent that asked can
+  decide. A permission prompt or an approval gate is never decided this way (`permission-prompt`);
+  other refusals include `no-active-mode`, `mode-changed`, `no-decision-room`,
+  `not-the-asking-agent` and `person-answering`. A late Slack click names who decided, and under
+  which mode. Check the room before you ask a person who has a mode on: the ask is created first,
+  so without quiet hours it can post before you decide it.
 - **During local-daemon outage, remote HTTP sender attribution still uses the originating
   instance's durable identity.** A selected remote or forwarded endpoint never becomes the origin.
   Missing local identity remains explicitly unknown; transport success is not operation success.
@@ -908,7 +1068,9 @@ your circumstances is configuration, and the ones that are not, another agent ca
 - **Project World declares the human authority boundary.** Read the current project and mission
   policy for actions requiring approval; the system mechanics do not impose a universal list.
 - **`rig auth list` / `validate` / `seats`** — is this seat's runtime actually logged in, which
-  accounts exist, and which account each seat is *supposed* to be on.
+  accounts exist, and which account each seat is *supposed* to be on. To act on a Codex home on
+  another machine, `rig auth status|list|switch` take `--host <id>` and `--codex-home <dir>`, and
+  `rig seat restart` takes `--host <id>`.
 - **`rig provider accounts` / `bindings` / `signals` / `switch`** — which seats are bound to which
   accounts, what the usage signals say, and whether a seat can be moved without stranding the
   conversation it is in the middle of. **`provider signals` reports anomalies rather than a
@@ -923,12 +1085,13 @@ your circumstances is configuration, and the ones that are not, another agent ca
   because nothing links a seat's reading to the login it used: read each window as that seat's
   reading, and don't tell a person an account has room from it. Each account row also carries a
   sign-in fact (`usable`, `needs sign-in` or `unknown`); a signed-in Claude login never reads
-  better than `unknown`. A Codex account's last reading, its reset and its last observed exhaustion
-  survive a daemon restart as history (`retained: "before_restart"`), never a current reading; a
+  better than `unknown`. A Claude seat signed in with a long-lived token (`claude setup-token`)
+  gets no usage reading (`not_subscription_login`). A Codex account's last reading, its reset and
+  its last observed exhaustion survive a daemon restart as history (`retained: "before_restart"`), never a current reading; a
   window whose reset has passed shows an `expectation`, which is planning, not a reading. Run `rig provider status --refresh`
-  before telling anyone an account has room. With `provider.subscription_moves`
-  on (off by default), `rig provider moves` records and lists moves of a Codex home's seats between
-  subscriptions.
+  before telling anyone an account has room. An agent that moves a Codex home between subscriptions files
+  what it did with `rig provider moves report` (a queue item to whoever asked, checked and never a move itself), and
+  `rig provider moves` reads the reports back.
 - **Codex configuration fragments** — a `codex_config_fragment` must open with a table header and
   never overrides a user-declared table; see `docs/reference/agent-spec.md`.
 - **`rig env`** — the real services behind a rig: are they up, what are they saying, how do you
@@ -938,6 +1101,9 @@ your circumstances is configuration, and the ones that are not, another agent ca
   views fall back to plain tmux) and on a Mac offers Ghostty once (`--ghostty` / `--no-ghostty`).
   It no longer installs cmux; an existing cmux still works. `--providers claude`, `codex` or
   `both` sets which harnesses it installs and checks; one not chosen reads `skipped`, never failed.
+  The choice is saved as `provider.selected`, and the kernel starts seats only for those providers
+  (empty, the default, means every signed-in one). `--router-line yes|no` decides whether OpenRig
+  adds its one line to shared guidance files (`skills.router_line.enabled`).
 - **`rig usage series`** — what a seat's token curve has looked like over time: climbing steadily,
   reset, or stopped reporting entirely. The last one is a signal, not a gap.
 - **`rig usage top`** — which of this machine's seats used the most tokens over a window (`--window
@@ -1006,13 +1172,21 @@ your circumstances is configuration, and the ones that are not, another agent ca
   shell command. Five queue tools (`rig_queue_create`, `rig_queue_show`, `rig_queue_list`,
   `rig_queue_claim`, `rig_queue_update`) act as the seat named by `OPENRIG_SESSION_NAME`, so an
   agent with no shell can hand work to the team and read the closing note as its answer. Nothing
-  wakes such an agent; it sees new work when it checks.
+  wakes such an agent; it sees new work when it checks. Its tools cover the whole delegation loop:
+  find its seat, team and lead (`rig_whoami`, `rig_team`), hand work on and follow the handoff's
+  successor, find finished work and read its artifact, decide inside a person's decision room,
+  follow a restore it started (`rig_restore_status`) and read the event log
+  (`rig_telemetry_events`). **`rig mcp serve --http`** serves the same tools to a client on another
+  host; `rig mcp token add <name> --seat <session>` gives each caller its own grant, acting as that
+  seat.
 - **`rig skill loadout --runtime <claude-code|codex>`** — inspect the exact catalog revision,
   selectors, target, and current/missing/shadowed/conflicting state for one working directory.
   `--apply` writes only the managed ownership set, is idempotent, and refuses local edits or
-  unowned collisions. Launch now delivers a selected plugin's skills into `.claude/skills/` or
-  `.agents/skills/`, so don't copy them by hand; read the `plugin_skill_*` warnings if one is
-  missing. TDD is no longer a default skill.
+  unowned collisions. `--seat <session|self>` does the same for one seat's own skills, which a
+  Claude or Codex team seat keeps in its own storage outside the project. Launch delivers a
+  selected plugin's skills there (into `.claude/skills/` or `.agents/skills/` only for a seat
+  without that storage), so don't copy them by hand; read the `plugin_skill_*` warnings if one
+  is missing. TDD is no longer a default skill.
 - **`rig startup-proof submit`** — answer an explicitly selected authenticated startup challenge.
   Startup adds no proof exercise by default. Declare `startup_proof` with `authenticated` or
   `none` in the applicable startup layers; see `docs/reference/rig-spec.md#startup-block/startup-proof-selection`.
@@ -1033,9 +1207,11 @@ database. It is one more set of primitives on a machine full of them.
   owes. **Neither knows the interesting cell.** Cross them and *alive, holding work, and not
   moving* falls out — which is the actual question behind every "is the rig stuck."
 - **"Is that seat stuck or thinking?"** — the row face answers this now (S04 pickup receipts):
-  every list/show projection carries a derived `pickup` state — `working`, `stalled-after-claim`
-  (with its evidence named: time since meaningful queue change and current activity confidence), `parked`, or
-  `unclaimed` — and `rig view show pickup` lists every claimed row with it. The old by-hand join
+  every list/show projection carries a derived `pickup` state — `working`, `needs-input` (claimed,
+  and its owner is waiting on input, with the reason: check that before waking it),
+  `stalled-after-claim` (with its evidence named: time since meaningful queue change and current
+  activity confidence), `parked`, or `unclaimed` — and `rig view show pickup` lists every claimed
+  row with it. The old by-hand join
   (capture + `claimedAt` arithmetic + `queue transitions`) is RETIRED as a first move; `rig
   capture` remains the second question (is the pane alive), never the state derivation.
 - **"Is this a park or a strand?"** — the row face answers the pickup half: `parked` means the row is blocked,
@@ -1084,6 +1260,6 @@ deliberate writing.
 
 **`rig --help`**, then `rig <verb> --help`.
 
-Eighty-eight verbs ship, and this page named most of them once. **You will not remember which — you
+Ninety verbs ship, and this page named most of them once. **You will not remember which — you
 are meant to remember only that the list is long enough to be worth reading before you build
 anything.** The question is never *how do I write this*; it is **does this already exist**.