@openrig/cli 0.6.14 → 0.7.1

package/daemon/dist/domain/rigspec-instantiator.js

@@ -81,6 +81,7 @@ export class RigInstantiator {
             const txn = this.db.transaction(() => {
                 const rig = this.rigRepo.createRig(spec.name);
                 rigId = rig.id;
+                opts?.recordCreated?.(rig.id);
                 if (opts?.nonInterruptive !== undefined)
                     this.rigRepo.setRigNonInterruptive(rig.id, opts.nonInterruptive);
                 for (const specNode of spec.nodes) {
@@ -89,6 +90,7 @@ export class RigInstantiator {
                         runtime: specNode.runtime,
                         model: specNode.model,
                         effort: specNode.effort,
+                        advisor: specNode.advisor,
                         cwd: specNode.cwd,
                         surfaceHint: specNode.surfaceHint,
                         workspace: specNode.workspace,
@@ -96,6 +98,7 @@ export class RigInstantiator {
                         packageRefs: specNode.packageRefs,
                     });
                     nodeIdMap[specNode.id] = node.id;
+                    opts?.recordCreated?.(rig.id, node.id);
                 }
                 for (const specEdge of spec.edges) {
                     this.rigRepo.addEdge(rig.id, nodeIdMap[specEdge.from], nodeIdMap[specEdge.to], specEdge.kind);
@@ -115,7 +118,7 @@ export class RigInstantiator {
         const launchedSessionNames = [];
         const instantiateWarnings = [];
         for (const logicalId of launchOrder) {
-            const result = await this.nodeLauncher.launchNode(rigId, logicalId);
+            const result = await this.nodeLauncher.launchNode(rigId, logicalId, opts?.env ? { env: opts.env } : undefined);
             if (result.ok) {
                 nodeResults.push({ logicalId, status: "launched" });
                 launchedSessionNames.push(result.sessionName);
@@ -263,13 +266,30 @@ import { RigSpecCodec as PodRigSpecCodec } from "./rigspec-codec.js";
 import { RigSpecSchema as PodRigSpecSchema, VALID_EDGE_KINDS } from "./rigspec-schema.js";
 import { rigPreflight, preflightValidatedSpec } from "./rigspec-preflight.js";
 import { resolveAgentRef } from "./agent-resolver.js";
-import { resolveNodeConfig, selectedPluginPaths } from "./profile-resolver.js";
+import { resolveAdvisorModel, resolveNodeConfig, selectedPluginPaths } from "./profile-resolver.js";
 import { resolveStartup } from "./startup-resolver.js";
+import { isCommunityHarnessRuntime } from "./built-in-runtimes.js";
 import { planProjection, claudeConflictTargetPath, projectionConflictWarnings, filterProtectedProjections } from "./projection-planner.js";
 import { ProjectionManifestStore } from "./projection-manifest-store.js";
 import { resolveConcreteHint } from "./runtime-adapter.js";
 import { installTopologyDefaults } from "./topology-defaults-installer.js";
 import { isKeptPluginSkill } from "./skill-catalog.js";
+import { claudeSeatSkillsNote, ensureSeatSkillPlugin, seatCatalogKeptNote, migrateLegacyProjectSkills, refusedSeatSkillsRootForNode, seatSkillLocation, seatSkillPaths, seatSkillPathsForNode, seatSkillPluginDirForNode, writeSeatSkillCatalog } from "./seat-skill-storage.js";
+import { carrySeatLaunchAdditions, prepareSeatLaunchAdditions } from "./seat-launch-additions.js";
+/** OPR.0.7.0.13: the constant seat-skills pointer, merged into the project's managed guidance for a Codex seat. It
+ *  names no seat, path or skill, so pod-mates share one identical block, and it tells a non-OpenRig agent it doesn't
+ *  apply. Each seat reads its own list with `rig skill loadout --seat self`. */
+function seatSkillsPointerStartupFile() {
+    const assetsRoot = nodePath.resolve(import.meta.dirname, "../../assets");
+    return {
+        path: "openrig-seat-skills.md",
+        absolutePath: nodePath.join(assetsRoot, "guidance/openrig-seat-skills.md"),
+        ownerRoot: assetsRoot,
+        deliveryHint: "guidance_merge",
+        required: false,
+        appliesOn: ["fresh_start", "restore"],
+    };
+}
 function defaultCultureStartupFile() {
     const assetsRoot = nodePath.resolve(import.meta.dirname, "../../assets");
     return {
@@ -414,6 +434,14 @@ export class PodRigInstantiator {
         if (!preflight.ready) {
             return { ok: false, code: "preflight_failed", errors: preflight.errors, warnings: preflight.warnings };
         }
+        // A pod added to a running rig inherits the rig's layers; stop before it exists if a required one is gone,
+        // when at least one added member reads startup files.
+        if (opts?.targetRigId && targetRig && rigSpec.pods.some((pod) => pod.members.some((m) => this.runtimeTakesStartupFiles(m.runtime)))) {
+            const missingInherited = this.inheritedStartupFileErrors(opts.targetRigId, targetRig.rig.name);
+            if (missingInherited.length > 0) {
+                return { ok: false, code: "preflight_failed", errors: missingInherited, warnings: preflight.warnings };
+            }
+        }
         return this.materializeValidatedSpec(rigSpec, rigRoot, preflight.warnings, opts);
     }
     /**
@@ -446,6 +474,7 @@ export class PodRigInstantiator {
                 if (!materializedRigId) {
                     const rig = this.deps.rigRepo.createRig(rigSpec.name);
                     materializedRigId = rig.id;
+                    opts?.recordCreated?.(rig.id);
                     persistedEvents.push(this.deps.eventBus.persistWithinTransaction({ type: "rig.created", rigId: materializedRigId }));
                 }
                 // PL-007: persist the rig's typed workspace block when declared.
@@ -456,6 +485,9 @@ export class PodRigInstantiator {
                 if (rigSpec.managedBlocks?.["claude-code"]) {
                     this.deps.rigRepo.setRigClaudeManagedBlockFile(materializedRigId, rigSpec.managedBlocks["claude-code"]);
                 }
+                // The rig's culture and startup layers, for seats added later (both rig-create sites; an expansion keeps them).
+                if (!opts?.targetRigId)
+                    this.persistRigStartupLayers(materializedRigId, rigSpec, rigRoot);
                 // OPR.0.4.8.3 Seam B: persist the rig-level permission_policy REF (raw, like role) —
                 // this is ONE of TWO rig-persist sites (materializeValidatedSpec + instantiate); missing
                 // either drops the rig ref on that path (map correction, independently verified).
@@ -488,7 +520,8 @@ export class PodRigInstantiator {
                     for (const member of pod.members) {
                         const qualifiedId = `${pod.id}.${member.id}`;
                         if (logicalIdToNodeId.has(qualifiedId)) {
-                            throw { code: "materialize_conflict", message: `Logical ID '${qualifiedId}' already exists in rig '${currentRig.rig.name}'` };
+                            throw { code: "materialize_conflict", message: `Logical ID '${qualifiedId}' already exists in rig '${currentRig.rig.name}'`,
+                                ...(opts?.recordCreated ? { existingNodeId: logicalIdToNodeId.get(qualifiedId) } : {}) };
                         }
                     }
                 }
@@ -524,6 +557,7 @@ export class PodRigInstantiator {
                             rigRoot,
                             cwdOverride: opts?.cwdOverride,
                         });
+                        opts?.recordCreated?.(materializedRigId, node.id);
                         logicalIdToNodeId.set(qualifiedId, node.id);
                         // Seam B R2: restart-stable provenance persists AT MATERIALIZE (a
                         // materialized-but-never-launched seat must still restore its posture).
@@ -617,7 +651,7 @@ export class PodRigInstantiator {
             if (err && typeof err === "object" && "code" in err && "message" in err) {
                 const typed = err;
                 if (typed.code === "materialize_conflict") {
-                    return { ok: false, code: "materialize_conflict", message: typed.message };
+                    return { ok: false, code: "materialize_conflict", message: typed.message, ...(typed.existingNodeId ? { existingNodeId: typed.existingNodeId } : {}) };
                 }
             }
             return { ok: false, code: "materialize_error", message: err instanceof Error ? err.message : String(err) };
@@ -652,7 +686,7 @@ export class PodRigInstantiator {
      * round-trip; launchMaterialized(yaml) is the parse/validate/normalize front
      * over it. Behaviour identical (loop body relocated verbatim).
      */
-    async launchValidatedSpec(rigSpec, rigRoot, targetRigId, cwdOverride) {
+    async launchValidatedSpec(rigSpec, rigRoot, targetRigId, cwdOverride, launchOpts) {
         const launchOrder = this.computePodLaunchOrder(rigSpec);
         const podWarnings = [];
         const nodeResults = [];
@@ -686,6 +720,7 @@ export class PodRigInstantiator {
                 qualifiedId: logicalId,
                 nodeId: node.id,
                 cwdOverride,
+                ...(launchOpts?.keepRecordedAdditions ? { keepRecordedAdditions: true } : {}),
             });
             if (launched.warnings?.length) {
                 podWarnings.push(...launched.warnings);
@@ -770,10 +805,12 @@ export class PodRigInstantiator {
         // colliding logical id would be a real seat collision — reject it honestly.
         // (validate's externalQualifiedIds only resolves edge targets; it does NOT
         // reject a member colliding with an existing node, so this guard is load-bearing.)
-        if (rig.nodes.some((node) => node.logicalId === qualifiedId)) {
+        const existingNode = rig.nodes.find((node) => node.logicalId === qualifiedId);
+        if (existingNode) {
             return {
                 ok: false,
                 code: "member_conflict",
+                ...(opts?.recordCreated ? { existingNodeId: existingNode.id } : {}),
                 message: `Member "${qualifiedId}" already exists in rig "${rig.rig.name}". Pick a different member id, or remove the existing seat first.`,
             };
         }
@@ -794,6 +831,13 @@ export class PodRigInstantiator {
         if (!preflight.ready) {
             return { ok: false, code: "preflight_failed", errors: preflight.errors, warnings: preflight.warnings };
         }
+        // 6b. Stop before a seat exists if a required file the rig or this pod declared is gone, for a runtime that reads startup files.
+        const missingInherited = this.runtimeTakesStartupFiles(member.runtime)
+            ? this.inheritedStartupFileErrors(rigId, rig.rig.name, podNamespace)
+            : [];
+        if (missingInherited.length > 0) {
+            return { ok: false, code: "preflight_failed", errors: missingInherited, warnings: preflight.warnings };
+        }
         // 7. Validate + resolve any declared pod-local edges BEFORE creating the
         // node, so a bad edge fails fast with no orphan seat. Two honest failure
         // classes: (a) DECLARATION validity (non-array / empty fields / a kind
@@ -841,6 +885,7 @@ export class PodRigInstantiator {
             suppressSummaryEvent: true,
             cwdOverride: opts?.cwdOverride,
             existingPodNamespace: podNamespace,
+            recordCreated: opts?.recordCreated,
         });
         if (!materialized.ok) {
             const message = "message" in materialized
@@ -849,13 +894,17 @@ export class PodRigInstantiator {
                     ? materialized.errors.join("; ")
                     : "member materialization failed";
             if (materialized.code === "materialize_conflict") {
-                return { ok: false, code: "member_conflict", message };
+                return { ok: false, code: "member_conflict", message, ...(opts?.recordCreated && materialized.existingNodeId ? { existingNodeId: materialized.existingNodeId } : {}) };
             }
             return { ok: false, code: "materialize_error", message };
         }
+        // A fork's launch additions go only into the seat just validated and created above (OPR.0.7.0.9).
+        const launchAdditions = opts?.launchAdditionsFrom && member.runtime === "claude-code"
+            ? carrySeatLaunchAdditions(opts.launchAdditionsFrom, seatSkillPaths({ rigId, logicalId: qualifiedId, runtime: member.runtime }))
+            : undefined;
         // 9. The shared launch effect owns startup projection + delivery +
         // readiness + `@rigged_*` for both expansion and ordinary growth.
-        const launchOutcome = await this.launchValidatedSpec(rigSpec, rigRoot, rigId, opts?.cwdOverride);
+        const launchOutcome = await this.launchValidatedSpec(rigSpec, rigRoot, rigId, opts?.cwdOverride, launchAdditions?.kept ? { keepRecordedAdditions: true } : undefined);
         if (!launchOutcome.ok) {
             const message = "message" in launchOutcome
                 ? launchOutcome.message
@@ -882,6 +931,7 @@ export class PodRigInstantiator {
                 },
                 edges: resolvedEdges,
                 warnings: [...(materialized.result.warnings ?? []), ...(launchOutcome.result.warnings ?? [])],
+                ...(launchAdditions ? { launchAdditions } : {}),
             },
         };
     }
@@ -939,7 +989,7 @@ export class PodRigInstantiator {
         const initialRefusal = eligible();
         if (initialRefusal)
             return refuse(initialRefusal);
-        const retainedFields = new Set(["id", "label", "agent_ref", "profile", "runtime", "model", "effort", "cwd", "role", "codex_config_profile", "permission_policy", "restore_policy"]);
+        const retainedFields = new Set(["id", "label", "agent_ref", "profile", "runtime", "model", "effort", "advisor", "cwd", "role", "codex_config_profile", "permission_policy", "restore_policy"]);
         if (Object.keys(memberFragment).some(key => !retainedFields.has(key)))
             return refuse("Retry accepts only retained member fields; topology and startup overrides require a separate change.");
         const rawSpec = { version: "0.2", name: rig.rig.name, pods: [{ id: podRow.namespace, label: podRow.label, members: [memberFragment], edges: [] }], edges: [] };
@@ -965,11 +1015,17 @@ export class PodRigInstantiator {
         if (!node.resolvedSpecHash || resolved.resolved.hash !== node.resolvedSpecHash)
             return refuse("Agent source hash differs from the failed first start.");
         const config = resolveNodeConfig({ baseSpec: resolved.resolved, importedSpecs: resolved.imports, collisions: resolved.collisions,
-            profileName: member.profile, specRoot: rigRoot, member, pod, rig: rigSpec, skillsRoot: this.resolveSkillsRoot(), ...this.systemWorldResolutionContext() });
+            profileName: member.profile, specRoot: rigRoot, member, pod, rig: this.withRigStartupLayers(rigSpec, this.rigStartupLayers(rigSpec, rigRoot, rigId)),
+            skillsRoot: this.resolveSkillsRoot(), ...this.systemWorldResolutionContext() });
         if (!config.ok)
             return refuse(config.errors.join("; "));
-        if (!same(config.config.model, node.model) || !same(config.config.effort, node.effort) || !same(config.config.cwd, node.cwd) || !same(config.config.restorePolicy, node.restorePolicy)) {
-            return refuse("Resolved model, effort, cwd or restore policy differs from the failed first start.");
+        // A seat whose first start failed before Advisor support recorded no Advisor, though its unchanged agent spec (the
+        // hash above) may name one. Its retry keeps the launch it recorded: no Advisor, stored and launched alike. Any
+        // other Advisor difference changes the launch and is refused below.
+        const launchConfig = node.advisor == null && member.advisor === undefined && config.config.advisor != null
+            ? { ...config, config: { ...config.config, advisor: undefined } } : config;
+        if (!same(launchConfig.config.model, node.model) || !same(launchConfig.config.effort, node.effort) || !same(launchConfig.config.advisor, node.advisor) || !same(launchConfig.config.cwd, node.cwd) || !same(launchConfig.config.restorePolicy, node.restorePolicy)) {
+            return refuse("Resolved model, effort, advisor, cwd or restore policy differs from the failed first start.");
         }
         const preflight = await preflightValidatedSpec(rigSpec, { rigRoot, fsOps: this.deps.fsOps, skillsRoot: this.resolveSkillsRoot(),
             ...this.systemWorldResolutionContext(), rigNameOverride: rig.rig.name, inheritedPermissionPolicy: this.inheritedPermissionPolicy(rigId), exec: this.deps.exec });
@@ -990,7 +1046,7 @@ export class PodRigInstantiator {
         if (finalRefusal)
             return refuse(finalRefusal);
         const result = await this.launchExistingAgentMember({ rigId, nodeId, qualifiedId: node.logicalId, rigSpec, rigRoot, pod, member,
-            resolveResult: resolved, configResult: config });
+            resolveResult: resolved, configResult: launchConfig, keepRecordedAdditions: true });
         if (result.status !== "launched")
             return { ok: false, code: result.status, message: result.error ?? "First-start retry did not reach readiness." };
         return { ok: true, rigId, nodeId, logicalId: node.logicalId, status: "launched", sessionName: result.sessionName, warnings: result.warnings };
@@ -1104,7 +1160,9 @@ export class PodRigInstantiator {
                             throw new GenerationChanged(rigSpec.name);
                     }
                 }
-                return this.deps.rigRepo.createRig(rigSpec.name, opts?.installRoot);
+                const rig = this.deps.rigRepo.createRig(rigSpec.name, opts?.installRoot);
+                opts?.recordCreated?.(rig.id);
+                return rig;
             });
             const rig = create();
             rigId = rig.id;
@@ -1121,6 +1179,7 @@ export class PodRigInstantiator {
             if (rigSpec.managedBlocks?.["claude-code"]) {
                 this.deps.rigRepo.setRigClaudeManagedBlockFile(rigId, rigSpec.managedBlocks["claude-code"]);
             }
+            this.persistRigStartupLayers(rigId, rigSpec, rigRoot);
             // OPR.0.4.8.3 Seam B: the SECOND rig-persist site (bootstrap instantiate path) —
             // both sites must write or the rig ref silently drops on one instantiate path.
             // Guard-F1: resolved rig attachment persists here too (declaringDir = rigRoot).
@@ -1228,7 +1287,7 @@ export class PodRigInstantiator {
         for (const { pod, member, podId, qualifiedId } of memberEntries) {
             // Terminal fast-path: skip agent resolution and profile resolution
             if (member.agentRef === "builtin:terminal") {
-                const termResult = await this.processTerminalMember(rigId, rigSpec, rigRoot, pod, member, podId, qualifiedId, nodeIdMap, launchedSessionNames, podInstantiateWarnings, opts?.cwdOverride, opts?.env);
+                const termResult = await this.processTerminalMember(rigId, rigSpec, rigRoot, pod, member, podId, qualifiedId, nodeIdMap, launchedSessionNames, podInstantiateWarnings, opts?.cwdOverride, opts?.env, opts?.recordCreated);
                 nodeResults.push(termResult);
                 continue;
             }
@@ -1275,6 +1334,7 @@ export class PodRigInstantiator {
                     runtime: member.runtime,
                     model: member.model ?? configResult.config.model,
                     effort: member.effort ?? configResult.config.effort,
+                    advisor: configResult.config.advisor,
                     codexConfigProfile: member.codexConfigProfile,
                     // OPR.0.4.8.3 Seam B: bootstrap inline addNode is the FOURTH node-creation
                     // site (see the role wire note above) — same member-ref persistence as
@@ -1301,6 +1361,7 @@ export class PodRigInstantiator {
                 const bootstrapAttachment = this.resolveMemberPolicyAttachment(member.permissionPolicy, rigSpec.permissionPolicy, rigRoot);
                 if (bootstrapAttachment)
                     this.persistNodePolicyProvenanceStrict(node.id, bootstrapAttachment);
+                opts?.recordCreated?.(rigId, node.id);
                 return node.id;
             });
             let nodeId;
@@ -1336,6 +1397,7 @@ export class PodRigInstantiator {
             nodeResults.push({
                 logicalId: qualifiedId,
                 status: launched.status,
+                code: launched.code,
                 error: launched.error,
                 evidence: launched.evidence,
                 sessionName: launched.sessionName,
@@ -1420,7 +1482,10 @@ export class PodRigInstantiator {
             else
                 await cleanup();
             const details = nodeResults.map((n) => `${n.logicalId}: ${n.error ?? "unknown"}`).join("; ");
-            return { ok: false, code: "instantiate_error", message: `all node launches/startups failed — ${details}${serviceCleanupError ? `; ${serviceCleanupError}` : ""}` };
+            return {
+                ok: false, code: "instantiate_error",
+                message: `all node launches/startups failed — ${details}${serviceCleanupError ? `; ${serviceCleanupError}` : ""}`,
+            };
         }
         if (hasAttention && !hasLaunched) {
             // All-attention_required path — rig + sessions PRESERVED; no
@@ -1453,8 +1518,9 @@ export class PodRigInstantiator {
                 message: `${attentionNodes.length} node${attentionNodes.length === 1 ? " requires" : "s require"} attention before becoming interactive. Inspect the affected sessions and reasons before choosing recovery.`,
                 rigId,
                 attentionNodes,
-                // #141: the replacement is kept on this path, so its archive notice must reach the user too.
-                ...(archivedGenerations.length > 0 ? { warnings: podInstantiateWarnings } : {}),
+                // The seats are kept on this path, so their warnings reach the person too: a replacement's archive notice (#141)
+                // and a one-off --env setting that stayed in a session.
+                ...(podInstantiateWarnings.length > 0 ? { warnings: podInstantiateWarnings } : {}),
             };
         }
         // Emit rig.imported
@@ -1550,24 +1616,28 @@ export class PodRigInstantiator {
         }
         return order;
     }
-    async processTerminalMember(rigId, rigSpec, rigRoot, pod, member, podId, qualifiedId, nodeIdMap, launchedSessionNames, warnings, cwdOverride, envOverride) {
+    async processTerminalMember(rigId, rigSpec, rigRoot, pod, member, podId, qualifiedId, nodeIdMap, launchedSessionNames, warnings, cwdOverride, envOverride, recordCreated) {
         const effectiveCwd = resolveLaunchCwd(member.cwd, rigRoot, cwdOverride);
         // Create node with sentinel values
         let nodeId;
         try {
-            const node = this.deps.rigRepo.addNode(rigId, qualifiedId, {
-                runtime: member.runtime,
-                model: member.model,
-                effort: member.effort,
-                env: member.env,
-                cwd: effectiveCwd,
-                restorePolicy: "checkpoint_only",
-                podId,
-                agentRef: member.agentRef,
-                profile: member.profile,
-                label: member.label,
-            });
-            nodeId = node.id;
+            nodeId = this.db.transaction(() => {
+                const node = this.deps.rigRepo.addNode(rigId, qualifiedId, {
+                    runtime: member.runtime,
+                    model: member.model,
+                    effort: member.effort,
+                    advisor: member.advisor,
+                    env: member.env,
+                    cwd: effectiveCwd,
+                    restorePolicy: "checkpoint_only",
+                    podId,
+                    agentRef: member.agentRef,
+                    profile: member.profile,
+                    label: member.label,
+                });
+                recordCreated?.(rigId, node.id);
+                return node.id;
+            })();
             nodeIdMap[qualifiedId] = nodeId;
         }
         catch (err) {
@@ -1593,6 +1663,7 @@ export class PodRigInstantiator {
         return {
             logicalId: qualifiedId,
             status: launched.status,
+            code: launched.code,
             error: launched.error,
         };
     }
@@ -1615,11 +1686,26 @@ export class PodRigInstantiator {
      */
     createMemberNode(input) {
         const effectiveCwd = resolveLaunchCwd(input.member.cwd, input.rigRoot, input.cwdOverride);
+        // Export and snapshot can run before launch. Resolve inherited Advisor values
+        // during creation; launch still re-resolves the original spec for later edits.
+        let advisor = resolveAdvisorModel(input.member.advisor);
+        if (advisor === undefined && input.member.agentRef !== "builtin:terminal") {
+            const resolved = resolveAgentRef(input.member.agentRef, input.rigRoot, this.deps.fsOps);
+            if (!resolved.ok) {
+                throw new Error(resolved.code === "validation_failed" ? resolved.errors.join("; ") : resolved.error);
+            }
+            const spec = resolved.resolved.spec;
+            const profile = spec.profiles[input.member.profile];
+            if (!profile)
+                throw new Error(`Profile "${input.member.profile}" not found in spec "${spec.name}"`);
+            advisor = resolveAdvisorModel(undefined, profile.preferences?.advisor, spec.defaults?.advisor);
+        }
         const node = this.deps.rigRepo.addNode(input.rigId, input.qualifiedId, {
             role: input.member.role,
             runtime: input.member.runtime,
             model: input.member.model,
             effort: input.member.effort,
+            advisor,
             codexConfigProfile: input.member.codexConfigProfile,
             // OPR.0.4.8.3 Seam B: the member's OWN raw ref persists on the node (like role);
             // rig-level lives on the rig row; precedence applies at RESOLUTION, not storage.
@@ -1669,6 +1755,86 @@ export class PodRigInstantiator {
             readFile: (p) => this.deps.fsOps.readFile(p),
         });
     }
+    /** Store the rig culture file and rig startup block the spec declares, with the absolute root they resolve against. */
+    persistRigStartupLayers(rigId, rigSpec, rigRoot) {
+        const podStartupFiles = {};
+        for (const pod of rigSpec.pods) {
+            if (pod.startup?.files.length)
+                podStartupFiles[pod.id] = pod.startup.files;
+        }
+        const hasPodFiles = Object.keys(podStartupFiles).length > 0;
+        if (!rigSpec.cultureFile && !rigSpec.startup && !hasPodFiles)
+            return;
+        this.deps.rigRepo.setRigStartupLayers(rigId, {
+            root: nodePath.resolve(rigRoot),
+            cultureFile: rigSpec.cultureFile,
+            startup: rigSpec.startup,
+            ...(hasPodFiles ? { podStartupFiles } : {}),
+        });
+    }
+    /** Whether a runtime reads startup files at all. A terminal seat's adapter delivers nothing, and a community harness
+     *  takes none (it only warns), so a missing file can't fail either; main adds them today and keeps doing so. */
+    runtimeTakesStartupFiles(runtime) {
+        return runtime !== "terminal" && !isCommunityHarnessRuntime(runtime);
+    }
+    /** Why an add must stop: a startup file the rig or the pod declared as required, or the rig's declared `culture_file`,
+     *  that the add would inherit but cannot read. Empty when nothing is recorded (a rig created before the record, or
+     *  one that declared nothing) or every such file reads. Optional files and files that apply only on restore are not checked. */
+    inheritedStartupFileErrors(rigId, rigName, podId) {
+        const layers = this.deps.rigRepo.getRigStartupLayers(rigId);
+        if (!layers)
+            return [];
+        const readable = (absolutePath) => {
+            try {
+                this.deps.fsOps.readFile(absolutePath);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        const errors = [];
+        const check = (path, owner, what) => {
+            const absolutePath = nodePath.resolve(layers.root, path);
+            if (!readable(absolutePath)) {
+                errors.push(`${what} "${path}" (${absolutePath}), declared by ${owner}, is missing or unreadable.`);
+            }
+        };
+        const rigOwner = `rig "${rigName}"`;
+        if (layers.cultureFile)
+            check(layers.cultureFile, rigOwner, "The rig's culture_file");
+        for (const f of layers.startup?.files ?? []) {
+            if (f.required && f.appliesOn.includes("fresh_start"))
+                check(f.path, rigOwner, "Required startup file");
+        }
+        for (const f of (podId ? layers.podStartupFiles?.[podId] : undefined) ?? []) {
+            if (f.required && f.appliesOn.includes("fresh_start"))
+                check(f.path, `pod "${podId}" of ${rigOwner}`, "Required startup file");
+        }
+        if (errors.length > 0)
+            errors.push("No seat was added. Restore the file, then run the command again.");
+        return errors;
+    }
+    /** The files a seat's pod contributes: the pod's own startup when the launching spec declares it (a declared seat),
+     *  else the pod files recorded when the rig was created (a seat added to that pod), resolved against the rig's stored root. */
+    podStartupResolvedFiles(pod, rigLayers, rigRoot) {
+        if (pod.startup) {
+            return pod.startup.files.map((f) => ({ ...f, absolutePath: nodePath.resolve(rigRoot, f.path), ownerRoot: rigRoot }));
+        }
+        return (rigLayers.podStartupFiles?.[pod.id] ?? []).map((f) => ({ ...f, absolutePath: nodePath.resolve(rigLayers.root, f.path), ownerRoot: rigLayers.root }));
+    }
+    /** The rig culture file and rig startup block a seat launches with, and the root they resolve against: the spec's
+     *  own when it declares them, else those stored when the rig was created. Expand, add-member and first-start retry
+     *  launch from a synthetic spec that declares neither, so an added seat gets the rig's layers as an original seat did. */
+    rigStartupLayers(rigSpec, rigRoot, rigId) {
+        if (rigSpec.cultureFile || rigSpec.startup)
+            return { root: rigRoot, cultureFile: rigSpec.cultureFile, startup: rigSpec.startup };
+        return this.deps.rigRepo.getRigStartupLayers(rigId) ?? { root: rigRoot };
+    }
+    /** The spec as the startup layering sees it: carrying the rig layers the seat launches with. */
+    withRigStartupLayers(rigSpec, layers) {
+        return { ...rigSpec, cultureFile: layers.cultureFile, startup: layers.startup };
+    }
     /** Seam B Guard-F2: the STRICT materialize/add-member persist — provenance here is
      *  LOAD-BEARING restart state; a real write failure must fail the surrounding
      *  transaction, never commit a node without it. (The repository setter itself still
@@ -1701,6 +1867,7 @@ export class PodRigInstantiator {
                 : resolveResult.error;
             return { status: "failed", error: msg };
         }
+        const rigLayers = this.rigStartupLayers(input.rigSpec, input.rigRoot, input.rigId);
         const configResult = input.configResult ?? resolveNodeConfig({
             baseSpec: resolveResult.resolved,
             importedSpecs: resolveResult.imports,
@@ -1710,7 +1877,7 @@ export class PodRigInstantiator {
             cwdOverride: input.cwdOverride,
             member: input.member,
             pod: input.pod,
-            rig: input.rigSpec,
+            rig: this.withRigStartupLayers(input.rigSpec, rigLayers),
             skillsRoot: this.resolveSkillsRoot(),
             ...this.systemWorldResolutionContext(),
         });
@@ -1742,6 +1909,45 @@ export class PodRigInstantiator {
         }
         const canonicalSessionName = deriveCanonicalSessionName(input.pod.id, input.member.id, input.rigSpec.name);
         const keptSkillWarnings = [];
+        // OPR.0.7.0.13 — a team seat's skills go to storage OpenRig owns for this rig and logical seat, not into the
+        // person's project: for Claude, reached through the seat's own plugin; for Codex, through the catalog its per-seat
+        // startup text delivers. Made for every Claude and Codex seat, so profile skills land there even with no loadout.
+        const seatRuntime = configResult.config.runtime === "claude-code" || configResult.config.runtime === "codex" ? configResult.config.runtime : undefined;
+        const seatSkills = seatRuntime ? seatSkillPaths({ rigId: input.rigId, logicalId: input.qualifiedId, runtime: seatRuntime }) : undefined;
+        let loadoutReceipts = 0;
+        if (seatSkills && seatRuntime === "claude-code") {
+            keptSkillWarnings.push(...ensureSeatSkillPlugin(seatSkills));
+            // OPR.0.7.0.9 — the member's own agent, prompt file and plugin folders, copied into the seat's storage. Asking for
+            // none removes an earlier request. A missing or refused source fails this seat by name; the rest still launch.
+            const beside = (path) => nodePath.resolve(input.rigRoot, path);
+            const prepared = input.keepRecordedAdditions ? { ok: true, notes: [] } : prepareSeatLaunchAdditions(seatSkills, {
+                ...(input.member.agentFile ? { agentFile: beside(input.member.agentFile) } : {}),
+                ...(input.member.appendSystemPromptFile ? { appendSystemPromptFile: beside(input.member.appendSystemPromptFile) } : {}),
+                ...(input.member.pluginDirs?.length ? { pluginDirs: input.member.pluginDirs.map(beside) } : {}),
+            });
+            // A linked seat-storage ancestor: the seat starts without its additions, each named; nothing goes through the link.
+            // A missing or refused source still fails the seat.
+            const linked = !prepared.ok && prepared.code === "seat_storage_refused" ? seatSkillLocation(seatSkills).refuseMutation?.() : undefined;
+            if (!prepared.ok && !linked)
+                return { status: "failed", error: prepared.message, sessionName: canonicalSessionName };
+            if (linked) {
+                const asked = [input.member.agentFile, input.member.appendSystemPromptFile, ...(input.member.pluginDirs ?? [])].filter((ref) => !!ref);
+                for (const ref of asked)
+                    keptSkillWarnings.push(`seat_launch_addition_not_delivered: ${ref}: ${linked}; the seat starts without it`);
+            }
+            keptSkillWarnings.push(...(prepared.ok ? prepared.notes ?? [] : []));
+        }
+        if (seatSkills && seatRuntime === "codex") {
+            // A catalog that can't be written is this seat's named result, never an error that escapes the rig's launch.
+            try {
+                const catalog = writeSeatSkillCatalog(seatSkills);
+                if (catalog.kept)
+                    keptSkillWarnings.push(seatCatalogKeptNote(catalog));
+            }
+            catch (error) {
+                keptSkillWarnings.push(`seat_catalog_not_written: ${seatSkills.catalogPath}: ${error.message}`);
+            }
+        }
         if (configResult.config.skillLoadout
             && this.deps.skillReconciler
             && (configResult.config.runtime === "claude-code" || configResult.config.runtime === "codex")) {
@@ -1751,6 +1957,7 @@ export class PodRigInstantiator {
                 cwd: configResult.config.cwd,
                 apply: true,
                 topologyOwner: canonicalSessionName,
+                ...(seatSkills ? { location: seatSkillLocation(seatSkills, seatRuntime) } : {}),
             });
             const loadout = configResult.config.skillLoadout;
             let projection = reconcile(loadout);
@@ -1763,14 +1970,28 @@ export class PodRigInstantiator {
                     projection = withoutPlugins;
                 }
             }
-            if (!projection.ok) {
+            // A seat whose storage a link refuses starts without its seat skills, and says what it lost: nothing is written
+            // through the link and nothing falls back into the project. Any other reconciliation error still fails the seat.
+            const refusedOnly = !projection.ok && projection.errors.every((error) => error.code === "seat_storage_refused");
+            if (refusedOnly) {
+                keptSkillWarnings.push(`seat_skills_not_delivered: ${loadout.entries.map((entry) => entry.id).join(", ")}: ${projection.errors.map((error) => `${error.code}: ${error.message}`).join("; ")}; the seat starts without these selected skills`);
+            }
+            else if (!projection.ok) {
                 return {
                     status: "failed",
                     error: projection.errors.map((error) => `${error.code}: ${error.message}`).join("; "),
                     sessionName: canonicalSessionName,
                 };
             }
-            for (const receipt of projection.receipts.filter(isKeptPluginSkill)) {
+            // OPR.0.7.0.13: copies this seat's earlier launches put in the project. They go only when the project's own
+            // loadout record names this seat as their sole owner and they are unchanged (the reconciler's own rule for a
+            // deselected skill); a skill the person installed for the project stays selected. While another seat still
+            // shares those copies, nothing is removed and the note says why.
+            if (seatSkills && seatRuntime === "claude-code" && projection.ok) {
+                keptSkillWarnings.push(...migrateLegacyProjectSkills({ reconcile: this.deps.skillReconciler, loadout, cwd: configResult.config.cwd, owner: canonicalSessionName }));
+            }
+            loadoutReceipts = projection.ok ? projection.receipts.length : 0;
+            for (const receipt of projection.ok ? projection.receipts.filter(isKeptPluginSkill) : []) {
                 keptSkillWarnings.push(`plugin_skill_kept: ${receipt.id}: ${receipt.detail.slice("kept: ".length)} (${receipt.target})`);
             }
         }
@@ -1784,7 +2005,7 @@ export class PodRigInstantiator {
             pluginPaths: selectedPluginPaths(configResult.config.selectedResources),
         });
         if (!launchResult.ok) {
-            return { status: "failed", error: launchResult.message };
+            return { status: "failed", code: launchResult.code, error: launchResult.message };
         }
         try {
             this.db.prepare("UPDATE sessions SET restore_policy = ? WHERE id = ?")
@@ -1800,6 +2021,13 @@ export class PodRigInstantiator {
         // overwrite). REAL store-backed lookup on this.db (never a mock/null — the
         // uninjected-service dead-invalidator class the P17 comment below records).
         const projectionManifest = new ProjectionManifestStore(this.db);
+        const claudeSeatPlugin = input.member.runtime === "claude-code" ? seatSkillPluginDirForNode(this.db, input.nodeId) : undefined;
+        const claudeSeatSkillsRoot = claudeSeatPlugin ? nodePath.join(claudeSeatPlugin, "skills") : undefined;
+        const codexSeatSkillsRoot = input.member.runtime === "codex" ? seatSkillPathsForNode(this.db, input.nodeId)?.skillsRoot : undefined;
+        // Where a link refused this seat's storage, its skills are planned (and refused) there, not in the project.
+        const refusedSeatSkillsRoot = claudeSeatSkillsRoot || codexSeatSkillsRoot ? undefined : refusedSeatSkillsRootForNode(this.db, input.nodeId)?.skillsRoot;
+        const claudeSkillTargetRoot = input.member.runtime === "claude-code" ? claudeSeatSkillsRoot ?? refusedSeatSkillsRoot : undefined;
+        const codexSkillTargetRoot = input.member.runtime === "codex" ? codexSeatSkillsRoot ?? refusedSeatSkillsRoot : undefined;
         const planResult = planProjection({
             config: configResult.config,
             collisions: resolveResult.collisions,
@@ -1811,10 +2039,13 @@ export class PodRigInstantiator {
             // the same source startNode binds for the write). An adapter that writes skills
             // outside the project tree (OMP's seat agent dir) names its own skill target.
             resolveTargetPath: (category, effectiveId, cwd, sourcePath) => input.member.runtime === "codex" && category === "skill"
-                ? nodePath.join(cwd, ".agents", "skills", effectiveId, "SKILL.md")
-                : category === "skill" && adapter.skillTargetPath
-                    ? adapter.skillTargetPath(launchResult.binding.tmuxSession, effectiveId)
-                    : claudeConflictTargetPath(category, effectiveId, cwd, sourcePath, input.member.runtime === "claude-code" ? this.deps.rigRepo.getRigClaudeManagedBlockFile(input.rigId) ?? undefined : undefined),
+                ? nodePath.join(codexSkillTargetRoot ?? nodePath.join(cwd, ".agents", "skills"), effectiveId, "SKILL.md")
+                // OPR.0.7.0.13: a Claude seat's skills are written to its own storage, so an edit there is what to protect.
+                : input.member.runtime === "claude-code" && category === "skill" && claudeSkillTargetRoot
+                    ? nodePath.join(claudeSkillTargetRoot, effectiveId, "SKILL.md")
+                    : category === "skill" && adapter.skillTargetPath
+                        ? adapter.skillTargetPath(launchResult.binding.tmuxSession, effectiveId)
+                        : claudeConflictTargetPath(category, effectiveId, cwd, sourcePath, input.member.runtime === "claude-code" ? this.deps.rigRepo.getRigClaudeManagedBlockFile(input.rigId) ?? undefined : undefined),
             lastHashLookup: (targetPath) => projectionManifest.lastHash(targetPath),
         });
         if (!planResult.ok) {
@@ -1828,12 +2059,31 @@ export class PodRigInstantiator {
         if (input.member.runtime === "codex" && !input.force) {
             planResult.plan.entries = planResult.plan.entries.filter(entry => entry.category !== "skill" || entry.classification !== "operator_conflict");
         }
-        const resolvedFiles = this.buildResolvedStartupFiles(resolveResult.resolved.spec, resolveResult.resolved.sourcePath, resolveResult.resolved.spec.profiles[input.member.profile], input.rigSpec, input.rigRoot, input.pod, input.member);
+        const resolvedFiles = this.buildResolvedStartupFiles(resolveResult.resolved.spec, resolveResult.resolved.sourcePath, resolveResult.resolved.spec.profiles[input.member.profile], rigLayers, input.rigRoot, input.pod, input.member);
         const managedDedupedFiles = this.dedupeProjectedManagedStartupFiles(planResult.plan, resolvedFiles);
         // P20 atom-4 PROTECT: hold back operator-edited skill targets (operator_conflict)
         // so the adapter never overwrites an operator's edit unless an internal caller sets
         // input.force. The warning names the source-edit/move-aside remedies available to users.
-        const dedupedResolvedFiles = filterProtectedProjections(managedDedupedFiles, planResult.plan, { force: input.force }).delivered;
+        const protectedFiltered = filterProtectedProjections(managedDedupedFiles, planResult.plan, { force: input.force }).delivered;
+        // OPR.0.7.0.13 (Codex C2): the seat's own catalog, through its per-seat startup text (the route role material takes,
+        // never the shared AGENTS.md). Fresh starts and fresh-primed restores send it; native resume and in-place restart
+        // replay nothing. The startup orchestrator rebuilds the file after this launch's projection.
+        // OPR.0.7.0.13: the compatibility limit, named rather than silent, whichever writer puts a skill in a Claude seat's
+        // storage (its loadout, a profile skill, a startup skill file). Nothing falls back to the project.
+        const versionNote = claudeSeatSkillsRoot
+            ? claudeSeatSkillsNote({ loadoutReceipts, planEntries: planResult.plan.entries, startupFiles: protectedFiltered }) : undefined;
+        if (versionNote)
+            (launchResult.warnings ??= []).push(`${canonicalSessionName}: ${versionNote}`);
+        // OPR.0.7.0.13 (router, R1.1): the one-line seat-skills bootstrap is part of a seat's saved startup files whenever it
+        // has its own skill storage. Each start decides from the person's saved answer whether to deliver it (startup
+        // orchestrator), so a later yes or no applies to restores too; a Codex seat's startup catalog below is unchanged.
+        const bootstrapLine = seatSkills && (codexSeatSkillsRoot || claudeSeatSkillsRoot) ? [seatSkillsPointerStartupFile()] : [];
+        const dedupedResolvedFiles = codexSeatSkillsRoot && seatSkills
+            ? [...protectedFiltered, ...bootstrapLine, {
+                    path: "openrig-seat-skills.md", absolutePath: seatSkills.catalogPath, ownerRoot: seatSkills.root,
+                    deliveryHint: "send_text", required: false, appliesOn: ["fresh_start", "restore"],
+                }]
+            : [...protectedFiltered, ...bootstrapLine];
         const binding = {
             id: launchResult.binding.id,
             nodeId: input.nodeId,
@@ -1848,6 +2098,7 @@ export class PodRigInstantiator {
             // The seat's saved effort choice wins over the authored value just written by
             // updateNodeResolvedConfig; a seat without one launches with exactly that authored value.
             effort: (readSeatEffort(this.deps.rigRepo.db, input.nodeId) ?? { effective: configResult.config.effort ?? null }).effective ?? undefined,
+            advisor: configResult.config.advisor,
             codexConfigProfile: input.member.codexConfigProfile,
             // OPR.0.4.8.3 Seam B: resolved launch posture (member > rig > persisted > FLOOR)
             // binds per-seat explicitly; adapters thread it into the yolo-mode helpers.
@@ -2046,7 +2297,7 @@ export class PodRigInstantiator {
         const canonicalSessionName = deriveCanonicalSessionName(input.pod.id, input.member.id, input.rigSpec.name);
         const launchResult = await this.deps.nodeLauncher.launchNode(input.rigId, input.qualifiedId, { sessionName: canonicalSessionName, env: input.envOverride });
         if (!launchResult.ok) {
-            return { status: "failed", error: launchResult.message };
+            return { status: "failed", code: launchResult.code, error: launchResult.message };
         }
         try {
             this.db.prepare("UPDATE nodes SET restore_policy = ? WHERE id = ?")
@@ -2058,16 +2309,17 @@ export class PodRigInstantiator {
                 .run("checkpoint_only", launchResult.session.id);
         }
         catch { /* best-effort */ }
+        const terminalRigLayers = this.rigStartupLayers(input.rigSpec, input.rigRoot, input.rigId);
         const startup = resolveStartup({
             specStartup: { files: [], actions: [] },
             profileStartup: undefined,
-            rigCultureFile: input.rigSpec.cultureFile,
-            rigStartup: input.rigSpec.startup,
+            rigCultureFile: terminalRigLayers.cultureFile,
+            rigStartup: terminalRigLayers.startup,
             podStartup: input.pod.startup,
             memberStartup: input.member.startup,
             operatorStartup: undefined,
         });
-        const resolvedFiles = this.buildTerminalResolvedStartupFiles(input.rigSpec, input.rigRoot, input.pod, input.member);
+        const resolvedFiles = this.buildTerminalResolvedStartupFiles(terminalRigLayers, input.rigRoot, input.pod, input.member);
         const binding = {
             id: launchResult.binding.id,
             nodeId: input.nodeId,
@@ -2136,38 +2388,36 @@ export class PodRigInstantiator {
             else {
                 this.deps.rigRepo.clearNodeEffort(nodeId);
             }
+            // Removing Advisor from the resolved spec must also remove its persisted launch flag.
+            this.deps.rigRepo.setNodeAdvisor(nodeId, config.advisor ?? null);
         }
         catch {
             /* best-effort */
         }
     }
-    buildTerminalResolvedStartupFiles(rigSpec, rigRoot, pod, member) {
+    buildTerminalResolvedStartupFiles(rigLayers, rigRoot, pod, member) {
         const files = [];
         // Skip layers 1-2 (agent base, profile) — terminal nodes have no agent spec
         // Layer 3: OpenRig culture floor, then the rig-specific overlay.
         files.push(defaultCultureStartupFile());
-        if (rigSpec.cultureFile) {
+        if (rigLayers.cultureFile) {
             files.push({
-                path: rigSpec.cultureFile,
-                absolutePath: nodePath.resolve(rigRoot, rigSpec.cultureFile),
-                ownerRoot: rigRoot,
+                path: rigLayers.cultureFile,
+                absolutePath: nodePath.resolve(rigLayers.root, rigLayers.cultureFile),
+                ownerRoot: rigLayers.root,
                 deliveryHint: "auto",
                 required: true,
                 appliesOn: ["fresh_start", "restore"],
             });
         }
         // Layer 4: Rig startup
-        if (rigSpec.startup) {
-            for (const f of rigSpec.startup.files) {
-                files.push({ ...f, absolutePath: nodePath.resolve(rigRoot, f.path), ownerRoot: rigRoot });
+        if (rigLayers.startup) {
+            for (const f of rigLayers.startup.files) {
+                files.push({ ...f, absolutePath: nodePath.resolve(rigLayers.root, f.path), ownerRoot: rigLayers.root });
             }
         }
         // Layer 5: Pod startup
-        if (pod.startup) {
-            for (const f of pod.startup.files) {
-                files.push({ ...f, absolutePath: nodePath.resolve(rigRoot, f.path), ownerRoot: rigRoot });
-            }
-        }
+        files.push(...this.podStartupResolvedFiles(pod, rigLayers, rigRoot));
         // Layer 6: Member startup
         if (member.startup) {
             for (const f of member.startup.files) {
@@ -2176,7 +2426,7 @@ export class PodRigInstantiator {
         }
         return this.resolveAutoHints(files);
     }
-    buildResolvedStartupFiles(agentSpec, agentSourcePath, profile, rigSpec, rigRoot, pod, member) {
+    buildResolvedStartupFiles(agentSpec, agentSourcePath, profile, rigLayers, rigRoot, pod, member) {
         const files = [];
         // nodePath imported at top level (ESM)
         // 1. Agent base startup
@@ -2191,28 +2441,24 @@ export class PodRigInstantiator {
         }
         // 3. OpenRig culture floor, then the rig-specific overlay.
         files.push(defaultCultureStartupFile());
-        if (rigSpec.cultureFile) {
+        if (rigLayers.cultureFile) {
             files.push({
-                path: rigSpec.cultureFile,
-                absolutePath: nodePath.resolve(rigRoot, rigSpec.cultureFile),
-                ownerRoot: rigRoot,
+                path: rigLayers.cultureFile,
+                absolutePath: nodePath.resolve(rigLayers.root, rigLayers.cultureFile),
+                ownerRoot: rigLayers.root,
                 deliveryHint: "auto",
                 required: true,
                 appliesOn: ["fresh_start", "restore"],
             });
         }
         // 4. Rig startup
-        if (rigSpec.startup) {
-            for (const f of rigSpec.startup.files) {
-                files.push({ ...f, absolutePath: nodePath.resolve(rigRoot, f.path), ownerRoot: rigRoot });
+        if (rigLayers.startup) {
+            for (const f of rigLayers.startup.files) {
+                files.push({ ...f, absolutePath: nodePath.resolve(rigLayers.root, f.path), ownerRoot: rigLayers.root });
             }
         }
         // 5. Pod startup
-        if (pod.startup) {
-            for (const f of pod.startup.files) {
-                files.push({ ...f, absolutePath: nodePath.resolve(rigRoot, f.path), ownerRoot: rigRoot });
-            }
-        }
+        files.push(...this.podStartupResolvedFiles(pod, rigLayers, rigRoot));
         // 6. Member startup
         if (member.startup) {
             for (const f of member.startup.files) {
@@ -2298,7 +2544,7 @@ export class PodRigInstantiator {
                 return f;
             try {
                 const content = this.deps.fsOps.readFile(f.absolutePath);
-                return { ...f, deliveryHint: resolveConcreteHint(f.path, content) };
+                return { ...f, deliveryHint: resolveConcreteHint(f.path, content, f.orientation) };
             }
             catch {
                 // If file can't be read, default to send_text (safest — delivered after harness ready)