@openrig/cli 0.7.0 → 0.7.1

package/daemon/docs/reference/whats-new.md

@@ -1,7 +1,7 @@
-# What changed in OpenRig 0.7.0
+# What changed in OpenRig 0.7.1
 
-This note is for an agent on an install that was just upgraded to 0.7.0. It lists only what behaves differently from
-0.6.14 and what to do about it. For everything OpenRig can do, read the capability map:
+This note is for an agent on an install that was just upgraded to 0.7.1. It lists only what behaves differently from
+0.7.0 and what to do about it. For everything OpenRig can do, read the capability map:
 `rig context get onboarding-width/public-what-you-can-do.md`. Each release replaces this file, so
 `rig context get reference/whats-new.md` describes the installed version once the upgraded daemon is running. Without
 a running daemon, read `$OPENRIG_HOME/reference/whats-new.md`. The daemon refreshes that copy when it starts, so right
@@ -9,134 +9,183 @@ after an upgrade it can still hold the previous version's note.
 
 ## After the upgrade
 
-- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Six migrations run on the first start (116, 118,
-  119, 121, 122 and 123). Two settings are added, `terminal.history_limit` (default 10000) and
-  `terminal.inherit_tmux_environment` (default false), and `provider.subscription_moves` is removed.
-- **The bundled openrig-core plugin goes from 0.1.15 to 0.1.17.** Startup replaces installed copies of managed plugins and
-  marked global skills. It first copies every file it replaces under `$OPENRIG_HOME/backups/managed-refresh/<id>/`,
-  whether or not anyone edited it, and logs `[plugin-vendor] preserved previous contents of <file> at <copy> before
-  managed refresh` for each one. A stock upgrade from 0.6.14 copies about 22 files (about 250 KB), and a later start with
-  no new version copies none. The copies matter only for files someone changed: the copy keeps the bytes, but the change
-  may no longer be active after the refresh. Keep the log line, because it names the original file and the copy's folder
-  doesn't. If a copy fails, that plugin or skill isn't refreshed, its files are kept, and the log says so. Copies aren't
-  cleaned up.
-- **If you gave new agents accounts or API keys through tmux's global environment** (`tmux set-environment -g …`), new
-  agents no longer inherit it (below). Put the values in the seat's `env`, pass `rig up --env KEY=VALUE`, or keep the old
-  behaviour with `rig config set terminal.inherit_tmux_environment true`. Running agents aren't affected.
-- **If you write queue rows to another machine by its self-id** (`member@rig@<self-id>`), run `rig host doctor <alias>`
-  once per host: bindings learned before 0.7.0 have no address.
+- **Restart the daemon** (`rig daemon stop`, then `rig daemon start`). Eight migrations run on the first start (124, 125,
+  127, 128, 129, 130, 131 and 135). Nine settings are added: `policies.claude_compaction.preparation_root` (unset),
+  `skills.router_line.enabled` (off), `decisions.enabled` (false), `decisions.consumers`, `decisions.template_dir`,
+  `retention.stream_days` (30), `retention.stream_max_items` (20000), `provider.selected` (empty) and
+  `daemon.db_conflict` (`warn`). None is removed.
+- **Stream retention is on.** Stream items emitted after the upgrade are deleted after 30 days, or beyond the newest
+  20,000, unless a record names them (a classification, duplicate link, attempt or disposition). History from before the
+  upgrade is kept. Raise `retention.stream_days` or `retention.stream_max_items` to keep more.
+- **The bundled openrig-core plugin goes from 0.1.17 to 0.1.18.** Startup replaces the installed plugin's changed files:
+  its Claude hook definitions, three hook scripts and the pre-compaction hook (so hooks start on a seat whose PATH has
+  no Node), and the `openrig-user`, `messaging-the-human` and `forming-an-openrig-mental-model` skills. As in
+  0.7.0, it first copies each file it replaces under `$OPENRIG_HOME/backups/managed-refresh/<id>/`, edited or not, and
+  logs `[plugin-vendor] preserved previous contents of <file> at <copy> before managed refresh`. A copy doesn't mean
+  anyone edited the file; if someone did, reapply the change from the copy.
+- **Claude seats need Claude Code 2.1.280 or newer to see their team skills,** which now arrive as a per-seat plugin
+  through `CLAUDE_CODE_PLUGIN_DIRS` (below). OpenRig doesn't check the version. A running seat gets the new layout at its
+  next launch, restore or handover.
+- **If a worktree's `.claude/settings.local.json` says `"defaultMode": "acceptEdits"` and the person didn't choose it,**
+  an earlier OpenRig wrote it when it added or freshly launched a managed Claude seat. 0.7.1 no longer writes it but
+  doesn't repair it; ask the person which mode they want and set it once.
 
 ## New things you can do
 
-- **Hold a person's routine asks while they're away:** `rig gateway human quiet set <id> --daily HH:MM-HH:MM` or
-  `--until <time>` (`--tz`), and `end`, `clear` or `show`. A held ask posts once, without a mention, when quiet ends.
-  Asks tagged `escalation` or `wake-escalation` are not held.
-- **Apply a person's mode** ("asleep", "out of office"): `rig gateway human mode save <id> <name>` (with
-  `--availability`, `--expected-back`, `--decision-room "<their words>"`, `--exclude`, `--quiet`), then `apply <id>
-  <name> [--until …]`, `current`, `end` and `account`. Never tell the person "back to normal" while the account shows an
-  effect `kept`, `pending` or `failed`.
-- **Decide an ask inside a person's decision room:** check `rig gateway human mode room <id>`, then `rig gateway human
-  mode decide <qitemId> --application <id> --reason "…" --reversible|--irreversible`. It's recorded as delegated, never
-  as their answer, and only the agent that asked can decide. Permission prompts are refused (`permission-prompt`).
-- **Pass a rig's name instead of its id** to `archive`, `unarchive`, `release`, `shrink`, `expand`, `snapshot`,
-  `export` and `restore --rig`. A name two rigs share is refused and the matching ids are named: with `--json`,
-  `archive`, `unarchive`, `release`, `shrink`, `expand` and `restore status --rig` return `rig_ambiguous`.
-- **Stop a managed compaction's follow-up after `/compact` was sent:** `rig compact --cancel` now also disarms the
-  restore and audit prompts that would follow. It sends no input and can't undo the `/compact`.
-- **See your work candidates:** `rig queue whoami` adds `currentWorkChoice` when current work isn't settled.
-- **See why a wake didn't land:** `rig queue show --json` adds `lastNudgeInputBox`.
-- **See each seat's configured effort:** the TUI agent table's `CFG EFF` column, and `effort` and `effortSource` in
-  `rig ps --nodes --full --json`. It's the configured level, not what the model ran.
+- **Choose how much automatic input reaches a seat:** `rig seat set-typing-guard <seat> --mode <mode> --reason "…"`, where
+  `<mode>` adds `openrig-urgent` (OpenRig's own notices and anything urgent) and `urgent-only` between `off` and `hold`.
+  Mark a message urgent with `rig send --urgent`, or create the row at priority `urgent` or `critical`. Held input stays
+  readable (`rig seat held-messages`) and is never replayed.
+- **Choose how far OpenRig and peers may act on a seat:** `rig seat set-terminal-policy <seat> --preset
+  no-peer-interventions|help-within-instructions|full-control --reason "…"`, with `--helper <addresses…>`,
+  `--rig-default` (seats added later), and exceptions such as `--peer-compaction deny` or `--openrig-model allow`.
+  Managed compaction and saved model or effort changes are checked; a denial is `terminal_policy_refused`. Other
+  interventions are guidance only.
+- **Read a seat's planned permissions:** `rig seat status <seat>` shows what its next fresh managed launch will pass and
+  where each part comes from, and its terminal policy. `rig setup --router-line yes|no` decides whether OpenRig adds its
+  one line to shared guidance files.
+- **Let a person choose whether every ask reaches Slack:** `rig gateway human set <id> slack-subscription
+  every-ask|urgent-only|unset`. Every ask is on the TUI's Feed either way. Under `urgent-only`, only an ask
+  created or handed off with `--alert` posts. An ask marked `--alert` stands out in Slack (an interrupt with a mention)
+  under either setting, so use it only for something only they can do, or an approval whose wait costs now.
+- **Give one Claude member its own setup** in the rig spec: `agent_file`, `append_system_prompt_file`, `plugin_dirs` and
+  `advisor` (an Advisor model). They're copied into that seat's storage, never the project.
+- **See a seat's own skills:** `rig skill loadout --seat <session|self>`.
+- **Reach the team from an assistant without a shell:** the MCP server has 34 tools, including `rig_whoami`,
+  `rig_restore_status`, `rig_team`, `rig_telemetry_events`, following a handoff, reading a finished item's artifact and
+  deciding inside a person's decision room. `rig mcp serve --http` serves them over HTTP; `rig mcp token add <name>
+  --seat <session>` gives each caller its own seat.
+- **Hand a row's task to an outside agent:** `rig acp run <row>` for an ACP agent (Hermes, OpenClaw).
+  `docs/reference/a2a-agents.md` covers A2A agents.
+- **Run a community harness that names, reports or reopens its conversations:** preset fields `launch_result`, `resume`,
+  `names_conversation` and `startup_assisted`, with examples for Cursor, Hermes and OpenClaw under
+  `docs/reference/community-harness-examples/`.
+- **Change one edge on a running rig:** `rig edge add <rig> <from> <to> --kind <kind>` and `rig edge remove <rig>
+  <edge-id>` (`--plan`, `--json`). A `delegates_to` change says when it moves who work routes to.
+- **Run one spec as several rigs:** `rig up <spec> --name <rig>`.
+- **Retune a watchdog in place:** `rig watchdog update <jobId> [--interval-seconds n] [--message text] [--spec path]`
+  keeps its id and attachments. The context watch takes `--threshold-tokens` or `--threshold-percent`.
+- **Put restore maps where seats may write:** `rig config set policies.claude_compaction.preparation_root <abs path>`.
+- **Pick a Herdr session:** `rig terminal open <view> --provider herdr --session <name>`.
+- **Close a row with its artifact:** `rig queue update <id> --state done --evidence-ref <path>`.
+- **File and read subscription move reports:** `rig provider moves report` and `rig provider moves`. `--host <id>` and
+  `--codex-home <dir>` on `rig auth status|list|switch` and `rig seat restart` act on another machine's Codex home.
+- **Route stream observations with typed decisions (opt-in, off by default):** once `decisions.enabled` is true,
+  `decisions.consumers` includes `stream` and the intake seat has `OPENROUTER_API_KEY`, `rig project wake --decide`
+  gives each eligible stream observation one bounded typed decision during that seat's wake: create a row for a supplied
+  owner, join supplied work, or record a duplicate or no action. Anything uncertain, refused or failed goes to the
+  intake seat as its own disposition, and the model isn't asked again. `rig project decisions status` shows the state
+  without making a call. Without `--decide`, or with decisions off, nothing changes; turning decisions off no longer
+  strands an accepted create or join whose effect hadn't landed.
+- **Read the stream as a subscriber:** `rig stream subscribe <seat>` (`--tags`, `--type`; re-subscribing keeps the
+  place), then `rig stream read` returns the next bounded page for the calling seat (at most 20 items and 64 KiB, with
+  `more`, `unread` and any `gap`). `rig stream subscriptions` lists readers; `rig stream unsubscribe <seat>` stops one.
+  `rig stream show <id>` says what became of an observation.
+- **Keep the kernel to the harnesses you chose:** `rig setup --providers <list>` is now saved as `provider.selected`, and
+  the kernel starts seats only for those.
+- **Stop a second daemon on a live database:** `rig config set daemon.db_conflict stop` refuses a start whose database a
+  matching live daemon already holds (the default `warn` only warns). `rig daemon start --allow-db-conflict` allows one
+  deliberate start.
 
 ## Behaviour that changed
 
-- **New agents start from a clean environment, not tmux's global one.** A new seat or handover successor gets:
-  - the launch environment: `PATH`, `HOME`, `USER`, `LOGNAME`, `CODEX_HOME`, `OPENRIG_HOME`, `OPENRIG_URL`,
-    `OPENRIG_PORT`, `OPENRIG_HOST`, the seat's own identity values (such as `OPENRIG_SESSION_NAME`) and the allowed
-    provider sign-in variables. Not `OPENRIG_DB` or `TMUX_TMPDIR` (see Known gaps);
-  - the daemon's `LANG`, `LC_ALL`, `LC_CTYPE`, `TZ`, `TMPDIR`, `XDG_CONFIG_HOME`, `XDG_DATA_HOME`, `XDG_CACHE_HOME` and
-    `CLAUDE_CONFIG_DIR`;
-  - the values named in tmux's `update-environment`;
-  - its own `env`.
-
-  Shell startup still runs. `rig setup` warns when it sees a custom tmux configuration.
-- **After a reboot, the daemon restores a kernel whose seats are all detached** (and still bound to their sessions), in
-  the background, as `rig up kernel --existing` would. `OPENRIG_NO_KERNEL=1` still skips it, and `rig start --json` reports `kernelRestore`.
-- **A seat missing a required startup file no longer blocks its rig's restore:** `rig up <rig> --existing` holds that
-  seat and restores the others (`partially_restored`).
-- **Seats added to a running rig** with `rig expand`, `rig grow` or add-member get its culture file and rig-level
-  startup, for rigs created on 0.7.0 or later. Older rigs get no backfill.
-- **A busy daemon gets the real request.** The CLI refuses only when the daemon is stopped or stale, the connection is
-  refused or blocked, or the daemon answering belongs to another OpenRig home. A slow daemon is no longer read as down.
-- **A new seat's first startup message** says it's OpenRig's identity context, not a task. A seat whose startup sends
-  nothing else is asked to run `rig whoami --json` and say it's ready for an assignment.
-- **A new Claude seat's first startup text** waits briefly (about five seconds) for Claude's input box before it's
-  sent.
-- **Codex seats that select openrig-core get the plugin installed into Codex.** While Codex hooks are on
-  (`runtime.codex.hooks_enabled`, default on), OpenRig installs it with Codex's own marketplace and plugin commands at
-  daemon start and at a fresh launch, unless the person's Codex configuration disables it.
-  - **A first install only** (no earlier install or plugin cache): OpenRig checks the installed hook files against its own
-    copy, then trusts the plugin's six shipped hooks by their exact definitions, so the seat starts without Codex's hook
-    review.
-    The file check happens only when trust is granted: a later edit to the cached hook scripts keeps that trust, as with any hook trusted in Codex.
-  - **An existing install keeps the person's choices.** A plugin or hook they disabled stays disabled. One they left
-    untrusted stays under Codex's review: Codex records nothing for "continue without trusting", so OpenRig doesn't read a
-    missing trust record as permission.
-  - **What it adds:** the four managed inline hooks stay the only activity reporters; the plugin adds refocus and its
-    skills.
-- **Watchdog delivery is recorded as it happened:** `rig watchdog status` outcomes are `sent`, `refused`, `failed`,
-  `skipped` or `terminal` (0.6.14 had `sent`, `skipped` or `terminal`). Every reminder carries "Delivery may repeat after
-  an unconfirmed attempt." under its header line, and two refusals in a row at one seat's prompt raise that seat's prompt
-  alert. A park wake shows the continuation its park recorded (`Recorded continuation: …`), so record one when you park.
-- **Slack:** a thread reply answers a parked question only if it was written after the question posted, and a message
-  Slack rejects as `invalid_blocks` isn't posted again.
-- **Claude Code team agents are asked for permission less often.** Housekeeping commands such as `archive`, `attach`,
-  `bind`, `release`, `reconcile-session`, `config set` and `seat continue` no longer prompt. `seat restart` and `policy
-  permissions apply` now do.
-- **`rig up --plan` waits as long as an apply** (120 seconds). An unanswered plan exits 1 and is safe to run again.
-- **`rig setup` keeps 10,000 rows of tmux history**, down from 50,000 (`terminal.history_limit`, 2000 to 1000000).
+- **Team skills live in each seat's own storage** (`$OPENRIG_HOME/state/seats/<rig id>/<logical seat>/<runtime>/`), not
+  in the project's `.claude/skills` or `.agents/skills`. Claude seats get them as a generated plugin (`openrig:<id>`),
+  Codex seats as their own catalog. If a link sits in that path, the seat starts without them and the result names
+  what wasn't delivered.
+- **Urgent wakes are labelled:** an urgent or critical row's wake starts with `Urgent (marked by …):` at every seat. A
+  seat on `hold` gets one held notice per wake instead of re-nudges, and lifecycle work is refused at the middle levels as
+  at `hold`.
+- **A daemon restart picks up a managed compaction where it stopped.** An owed restore step resumes, a `/compact` that
+  may have been sent is never sent again, and `rig compact --state` shows anything stranded or owed.
+- **A Claude seat whose startup turn is refused** (an expired login, say) holds the rest of its startup context as owed
+  instead of typing it.
+- **`rig send` refuses with `target_needs_input`** when a Claude seat's hook has just reported it running and its screen
+  shows an MCP enablement menu, a question or a permission prompt.
+- **`rig down` asks before stopping the caller's own rig.** Without a terminal it exits 1, stops nothing and prints the
+  `--yes` command.
+- **`rig up --plan` doesn't start a stopped daemon:** it exits 1 with `daemon_not_running` and names `rig daemon start`
+  and `--no-kernel`.
+- **`rig daemon start`** waits up to 20 seconds for a slow daemon, and starts with a warning when only a secondary
+  listener, such as Tailscale's, can't be verified.
+- **A seat joined with `rig attach` as an outside app** (Claude Desktop) stays attached through `rig down` and restore
+  (`left_attached`). To replace it, `rig unclaim <name>`, then launch.
+- **New seats get the daemon's `OPENRIG_DB` and `TMUX_TMPDIR`.**
+- **A rebuilt Codex seat keeps its observed permissions,** and a read-only Codex profile launches without OpenRig's
+  writable roots.
+- **A seat's own role** goes only to that seat, never into a shared `CLAUDE.md` or `AGENTS.md`, and `rig down` returns
+  guidance files byte for byte.
+- **Workflow actions** (`project`, `route`, `resume`, `abort`) record the calling agent; a request with neither identity
+  nor actor gets the shared `actor_required` error.
+- **`rig provider moves` is back** for subscription move reports. It switches nothing.
+- **`--dangerously-interact` into a seat's input box stops first** when the box already holds typed or pasted text: it
+  shows that text (apart from suggestions) and types nothing. Clear the box and retry, or pass `--type-without-checking`,
+  which clears nothing. Keys for a recognized native menu are sent as before.
+- **A terminal seat gets exactly the text sent to it,** without the From/To lines (the result says `envelopeOmitted`).
+  A queue wake to a terminal seat types nothing and fails `failed:terminal-seat`; the row stays queued.
+- **A daemon restart that can't see the seats' tmux server** no longer detaches seats whose recorded process still
+  runs, so it doesn't relaunch them beside themselves.
+- **Provider credentials and the activity-hook token stay off tmux, shell and `env` command lines** at launch and
+  handover. A launch whose staging fails stops instead of falling back.
+- **An answer retried from Slack or Steering** after an interrupted close reuses the first reply and finishes the
+  request once.
+- **One bad row no longer stops the stuck sweep** from flagging the others; **a malformed unrelated diagnosis row** no
+  longer stops health diagnoses from listing.
 
 ## Output that changed shape
 
-- **`rig gateway human list`** shows each person's availability (`available`, `focus`, `away` or `off`) where it showed
-  `away` or `available`, plus a `quiet:` line; JSON adds `availability` and `quiet`.
-- **`rig attach`** prints `Sender:` (and `Tmux:` when the names differ), and `rig whoami` adds `identity.senderAddress`.
-  A clashing member name is refused with `address_conflict`.
-- **Send results** carry `managedCompaction`, and the CLI prints a `Notice:` line.
-- **`rig ps --rig <unknown>`** exits 1, and `--host H --rig X` filters by rig.
+- **`rig ps --nodes`** separates every cell with one space (the default row is 5 columns wider), adds an `ATTN` column
+  (`yes`, `no` or `?`) before `REASON`, and marks a `running` seat whose tmux couldn't be reached as unconfirmed.
+- **`rig queue show --json`** no longer has `lastNudgeInputBox`, and send results no longer describe the input box.
+- **`rig queue show` and `rig queue whoami`** print their human notices on stderr, so stdout is the JSON.
+- **A claimed row whose owner waits on a person** reads pickup `needs-input`, with the reason.
+- **`rig down --json`** adds `leftRunning`; `rig reconcile-session` says whether resume metadata was recorded.
+- **`rig compact-plan`** labels its thresholds as its own and says whether automatic compaction is on.
+- **A send held for a draft** in the seat's input box reports `inputPhase: "not_reached"`: it was never typed.
+- **A stream body over 16 KiB** is stored truncated, ending `[truncated by OpenRig: kept N of M bytes]`, and reads mark it
+  `bodyTruncated`. `rig stream list --after <sortKey>` from a pruned item returns 410 `stream_cursor_expired`, naming
+  `--since` to resume, instead of an empty list.
 
 ## What to stop doing
 
-- **Don't use `rig provider moves`:** it's gone with its setting. Report a subscription move as a queue item to whoever
-  asked.
-- **Don't steer a new seat's account or keys through tmux globals.** Use the seat's `env` or `rig up --env`.
-- **Don't close a row `done` with `--closure-reason blocked_on`.** It's refused with `invalid_closure_reason`; use `rig
-  queue block <id> --on <child>`.
-- **Don't treat "daemon did not respond" as down.** Check the effect before any retry or restart.
-- **Don't look up a rig id first** for the commands above; pass the name.
-- **Don't restart the daemon to stop a managed compaction's follow-up prompts.** Use `rig compact --cancel`.
-- **Don't run `rig up kernel --existing` by hand after a reboot** before checking `rig status`.
-- **Don't reuse a `deliveryId` to deduplicate a send,** and don't pass `--reason` or `--actor` to `rig slack verify`.
-
-## Known gaps in 0.7.0
+- **Don't read `lastNudgeInputBox`.** It's gone.
+- **Don't parse `rig ps --nodes` by column position.** Use `--json`, with `--fields` to pick fields.
+- **Don't look for a team seat's skills in the project folders.** Use `rig skill loadout --seat`.
+- **Don't stop and re-register a watchdog to change it.** Use `rig watchdog update`.
+- **Don't take a rig down to fix one edge.** Use `rig edge add` or `remove`.
+- **Don't print `OPENRIG_ACTIVITY_*` values** while looking for identity. Use `rig whoami`.
+- **Don't use `--dangerously-interact` to type over a half-written input box.** It stops and shows the text; choose
+  explicitly, or use `rig send --urgent` where the seat's interruption level allows it.
 
-- **A new seat doesn't get the daemon's `OPENRIG_DB` or `TMUX_TMPDIR`.** A tool in the seat that reads `OPENRIG_DB`
-  directly can fall back to the default database. If you rely on either, pass it in the seat's `env` or with `rig up
-  --env`.
-- **A launch that warns "Scoped tmux environment unavailable; retaining the previous environment"** didn't give that seat
-  the clean environment, and the seat may lack OpenRig's variables. Check `env` in the seat before relying on them.
-- **A Slack channel-mapping change needs a daemon restart** (`rig daemon stop`, then `rig daemon start`). Don't use `rig
-  slack disable` then `enable` for it: enabling marks any alerts waiting to post to Slack as already seen, so open
-  exchanges miss them.
+## Known gaps in 0.7.1
 
 - **A new Claude seat's startup text can stay in its input box unsent.** If a fresh Claude seat sits idle with text at
   its prompt, press Enter in its pane, or ask the person to.
-- **The TUI's terminal button refuses inside a Herdr pane reached over SSH.** Start the TUI with `env -u SSH_CONNECTION
-  -u SSH_CLIENT -u SSH_TTY rig tui`, or run `rig terminal open '<view>' --provider herdr`.
 - **Claude seats on a macOS native install can read as needing attention after a restore.** Check the pane before
   acting on it.
-- **Ubuntu 22.04's stock tmux 3.2a can crash its whole server** when OpenRig checks a pane that has just closed. Avoid
-  tmux 3.2a for OpenRig (`tmux -V`).
+- **A Slack channel-mapping change needs a daemon restart.** Don't use `rig slack disable` then `enable` for it: enabling
+  marks any alerts waiting to post to Slack as already seen.
+- **Ubuntu 22.04's tmux 3.2a:** the query known to crash its server is gone, but a narrower race remains. Avoid 3.2a
+  (`tmux -V`).
+- **`rig daemon start` can take 20 to 40 seconds** before its listener warning, longer than the TUI's 30-second "restore
+  everything" wait. On a slow host, start the daemon yourself first.
+- **A launch that warns "Scoped tmux environment unavailable; retaining the previous environment"** didn't give that seat
+  the clean environment. Check `env` in the seat before relying on OpenRig's variables.
+- **Going back to 0.7.0 with a Slack subscription set:** 0.7.0 can't read a person file that holds one, and its people
+  registry stops loading. Save the choice first (`rig gateway human show <id> --json > <id>.json`), then run
+  `rig gateway human set <id> slack-subscription unset` (`urgent-only` becomes every-ask, as on 0.7.0); set it again after
+  returning to 0.7.1. A person file still holding a `subscriptions:` entry fails on 0.7.0 too. Don't restore an older
+  gateway folder or database instead: that can lose newer people, bindings and delivery records.
+- **A Herdr tile over SSH** doesn't come back by itself after a Herdr restart. Reopen it with `rig terminal open <view>
+  --provider herdr`.
 - **Delegated decisions:** the ask is created before the decision, so without quiet hours it can post to the person
   first. Pair a decision room with quiet hours, or decide before asking.
 - **`restore-check` still treats a missing startup file as rig-wide.** Trust `rig up --existing`'s per-seat result.
+- **Managed Claude launch requires `/usr/bin/env` support for `-0` and `-u`** (option support checked on GNU coreutils
+  and macOS 15; BusyBox and older macOS unverified). Without the required option support, launch stops instead of
+  falling back to credential-bearing command-line arguments.
+- **In draft-aware mode, an agent's multi-line message to a Claude seat can remain unsubmitted when the paste changes
+  Claude's footer hint.** OpenRig withholds Enter, leaving the text in the composer and later sends waiting. Observed on
+  Claude 2.1.309 with both 0.7.0 and the 0.7.1 pre-cut build; #14 remains open.
+- **A Claude seat signed in with a long-lived token (`claude setup-token`) gets no usage reading.** The reader accepts
+  only claude.ai subscription logins and reports `not_subscription_login`.

package/daemon/specs/agents/shared/runtime/claude-settings.fragment.json

@@ -1,7 +1,4 @@
 {
-  "permissions": {
-    "defaultMode": "acceptEdits"
-  },
   "enabledMcpjsonServers": [
     "exa",
     "context7"

package/daemon/specs/agents/shared/skills/core/messaging-the-human/SKILL.md

@@ -71,6 +71,20 @@ rig queue create --destination <entityId>@external \
   --evidence-ref <durable-evidence> --verify --json
 ```
 
+An ask is on Steering and the TUI, where the person can answer it, choosing an
+option or typing a reply; it comes back to you exactly as a Slack answer does.
+Whether it also posts to Slack is the person's Slack subscription (`rig gateway
+human show <id>`, `slack-subscription`): by default (`every-ask`) every ask
+posts, and with `urgent-only` only an ask marked `--alert` does. So forgetting
+`--alert` never hides an ask from someone who reads Slack.
+
+Add `--alert` when the ask is urgent: something only they can do, or an approval
+whose wait costs now. A sign-in, a credential or an approval that expires needs
+it; a question that can wait for their next look doesn't. An alerted ask stands
+out in Slack (an interrupt with a mention, within their quiet hours and
+availability), and it's the only kind that reaches someone on `urgent-only`.
+An update (`--human-intent update`) posts as before and takes no `--alert`.
+
 Before asking a **decision**, check whether the person has a mode on with a
 decision room: what they said the team may decide for them meanwhile.
 
@@ -125,8 +139,8 @@ posts as a new message.
 A **decision** with a few clear choices can carry `--human-questions-file <path>`:
 a JSON array of 1–4 questions, each
 `{"id", "question", "options": [{"id", "label", "recommended"?}]}` with 2–4
-options (labels up to 75 characters, at most one recommended). Slack shows each
-question as a row of buttons. Each click records that answer on the item, and
+options (labels up to 75 characters, at most one recommended). The TUI lists
+each question with its options, and Slack (when alerted) shows each as a row of buttons. Each click records that answer on the item, and
 the decision resolves once every question has one. You then receive one reply
 row listing the answers. In `humanAnswers`, clicked answers are option-id strings.
 A whole typed reply is an object:
@@ -148,8 +162,9 @@ well would issue another notification for the same decision.
 
 The row persists before bounded delivery verification. Read its qitem ID and
 verification result; `posted` proves connector posting, **not human readership**.
-`transport-failed`, `never-posted`, or a pending/indeterminate result leaves the
-row intact. Inspect that same row and its next action; never create a second row
+`not-alerted` means the person's Slack subscription is `urgent-only`, so the ask is
+on Steering and the TUI without a Slack post, as they chose; it isn't a failure. `transport-failed`, `never-posted`, or a pending/indeterminate result
+leaves the row intact. Inspect that same row and its next action; never create a second row
 or blindly resend because verification timed out.
 
 ```bash

package/daemon/specs/agents/shared/skills/core/openrig-herdr/SKILL.md

@@ -111,6 +111,9 @@ system-clipboard copy works immediately (it's server-wide).
 - **Inner tmux status bar** is hidden by default (herdr provides the chrome); one config key
   (`terminal.status_bar`) flips it back on for raw-tmux / no-provider surfaces, and the flip applies
   to **future launches only**.
+- **After a Herdr server restart or update** (without `--handoff`), Herdr restores the layout and
+  labels but not the processes, so OpenRig's tiles come back as empty shells while the seats keep
+  running. Reopen the view: `rig terminal open <view> --provider herdr`.
 
 ## Saved views — the library (`terminal-views.yaml`)
 

package/daemon/specs/agents/shared/skills/core/openrig-software-factory/references/worked-example.md

@@ -504,7 +504,7 @@ At each completed step, the **current packet owner** projects its own result. Ex
 
 ```sh
 rig workflow project --instance <instance-id> --current-packet <inspect-packet> \
-  --exit handoff --actor-session dev-build@starter \
+  --exit handoff \
   --result-note 'Inspection contract implemented; exact candidate and checks recorded' \
   --evidence-ref <absolute-slice-01-proof-path> --json
 ```
@@ -515,7 +515,7 @@ For a **real unresolved blank-cell product choice**, ask the user the concrete q
 
 ```sh
 rig workflow project --instance <instance-id> --current-packet <cli-packet> \
-  --exit waiting --actor-session dev-build@starter \
+  --exit waiting \
   --blocked-on external:user/blank-required-cells \
   --result-note 'Need the user decision recorded in mission NOTES before selecting CLI behavior' \
   --evidence-ref <absolute-mission-notes-path> --json

package/daemon/specs/rigs/launch/kernel/agents/operator/agent/guidance/role.md

@@ -83,7 +83,8 @@ configurations, as below; do not take the pin from a cached page summary.
 1. **Goal first.** Use a goal and folder already supplied, including a handoff
    from the installing agent; do not ask for them again. If the goal is missing,
    ask once: "What would you like to build or change?" If they already named a
-   team, use it and skip the questions it answers.
+   team, use it and skip the questions it answers. Keep any choice the
+   handoff carries, such as a trust or hook-review prompt they declined.
 2. **Where it works.** If the folder is missing, ask which folder the team should
    work in (usually a clone of their repository) and use its absolute path. Your
    own working directory is OpenRig's workspace, not their project, so never launch with
@@ -157,8 +158,13 @@ configurations, as below; do not take the pin from a cached page summary.
      `rig specs preview <team> --kind rig --json`: draw members and runtimes
      from `graph.nodes` and edges from `graph.edges`, with one line on each
      role. For workshop, draw from its `rig.yaml` at the pinned commit.
-5. **Fit it to their providers.** Infer which tools they have from the
-   kernel's own runtimes (`rig ps --nodes --rig kernel --json`), or ask. Check
+5. **Fit it to their providers.** Start from the choice they made at setup:
+   `rig config get provider.selected` prints `claude`, `codex` or
+   `claude,codex` when `rig setup --providers` recorded one. A kernel that
+   boots after that choice runs only those providers; one that booted earlier
+   keeps its seats (check `rig ps --nodes --rig kernel`). When it's empty,
+   infer which tools they have from
+   the kernel's own runtimes (`rig ps --nodes --rig kernel --json`), or ask. Check
    only the providers the team needs (`claude auth status` or
    `codex login status`). If you run in Claude Code, the kernel launch allows
    both checks; say in one line that it can still ask them to approve it if
@@ -196,11 +202,11 @@ configurations, as below; do not take the pin from a cached page summary.
    --plan` (for workshop, with its `--target ~/rigs/workshop`) and tell them
    what will start: how many agents, which providers, in which folder.
    Say too what launching into their folder changes for their own agent
-   there. A Claude Code team usually adds files such as a `CLAUDE.md`, its
-   skills, `.mcp.json` and `.openrig/`, and its `.claude/settings.local.json`
-   makes their own Claude Code in that folder start in accept-edits mode, with
-   the `exa` and `context7` MCP servers and OpenRig's activity hooks; what a
-   given team writes depends on its configuration. If they'd rather keep
+   there. A Claude Code team usually adds OpenRig's blocks to `CLAUDE.md`,
+   plus `.mcp.json` and `.openrig/`, and its `.claude/settings.local.json`
+   gives their own Claude Code in that folder the `exa` and `context7` MCP
+   servers, OpenRig's activity hooks and its status line; what a given team
+   writes depends on its configuration. `rig setup` lists these writes. If they'd rather keep
    their folder as it is, offer a separate copy, such as a git worktree.
    If the plan declares non-interruptive or broad access, say so plainly before asking for their yes.
    If they keep permission prompts on, say what that will be like before
@@ -208,6 +214,9 @@ configurations, as below; do not take the pin from a cached page summary.
    don't already cover, the asks come often, especially early, and each one
    needs their answer, in the seat's pane or through you. Their yes starts
    the team; it isn't a yes to those later asks.
+   For a team that already exists, `rig seat status <seat>` shows each seat's
+   planned permissions: the native mode, where it comes from, what OpenRig
+   adds and what isn't known. Read it to them as planned, not observed.
    Use `applying-a-permission-policy`; for an unset policy, recommend the team
    default rather than `none`. Starting the team, `rig up` without `--plan`,
    waits on their yes to this plan; a yes they already gave for this same
@@ -215,9 +224,18 @@ configurations, as below; do not take the pin from a cached page summary.
 7. **Report readiness honestly.** Read each seat's `startupStatus` in
    `rig ps --nodes --rig <team> --json`: `pending` means still starting, not
    ready; only `ready` is ready; `attention_required` and `failed` need the
-   person or a fix. If `rig up` reports `Status: partial` with
+   person or a fix. `ready` says the seat started; it can still wait at a
+   prompt afterwards (step 10). If `rig up` reports `Status: partial` with
    `Startup attention (<seat>): <reason>`, tell them what that seat is waiting
    for and the command its reason ends with.
+   A trust, hook-review or permission prompt is theirs to answer, unless an
+   operation they asked for names that prompt and its answer, or they told
+   you outright to decide that kind of prompt (step 10). Your launch
+   grants and the team's default permissions aren't their consent, and a
+   prompt they declined for one seat isn't a yes for another. Pass their
+   answer by step 10's route, then run that command. Until they answer,
+   report the seat as not ready and what it waits on; never answer it with
+   `tmux send-keys`.
    Relay any untracked-file warnings from `rig up` to the person, including the
    paths and suggested local exclude lines. Those files were created by the
    launch, so describe them as OpenRig additions rather than pre-existing work.
@@ -261,7 +279,15 @@ configurations, as below; do not take the pin from a cached page summary.
 10. **Tell them when a seat waits on them.** A team seat waiting at a prompt
     shows `needs_input` as its `agentActivity.state` in
     `rig ps --nodes --rig <team> --json --fields canonicalSessionName,agentActivity,tmuxAttachCommand`,
-    and nothing else tells the person.
+    and nothing else tells the person. The kernel's own seats can wait too,
+    so check them the same way:
+    `rig ps --nodes --rig kernel --json --fields canonicalSessionName,agentActivity,tmuxAttachCommand`.
+    A Claude seat at its usage-limit menu ("What do you want to do?" with
+    "Stop and wait for limit to reset") reads `needs_input` with reason
+    `selection_prompt`: its account is out of usage until the reset the menu
+    names. Tell them it's a usage limit, which seat, and when it resets, with
+    the menu's choices in its own words. One of them may spend usage credits,
+    so the choice is theirs.
     When you see one, tell them where they already are: which seat, what its
     prompt asks (`rig capture <session>` with the seat's
     `canonicalSessionName` shows it) and the seat's `tmuxAttachCommand`, or

package/daemon/specs/rigs/launch/kernel/agents/queue/worker/guidance/role.md

@@ -22,6 +22,17 @@ fleet can pick them up.
   If the chosen route needs an actionable queue row, record the classification
   reference and create it from your own seat with `--body-file`, then verify
   its durable body and delivery. A stream item is not a sender identity.
+- When typed decisions are on (`rig project decisions status` shows the
+  `stream` consumer enabled), `rig project wake --decide` with the same
+  options handles routine items in your turn: an accepted answer becomes owned
+  work (created or joined) or a recorded no-action or duplicate. Everything
+  else stays yours: the result's `forIntake` items, and anything you or an
+  earlier version abstained on. Decide those as above. With decisions off,
+  the manual path above is the whole path, and `--decide` still applies any
+  effect that was already accepted.
+- `rig stream show <id>` tells a poster what became of an item. Hub readers
+  use `rig stream subscribe` and `rig stream read`; their read progress is
+  theirs, not a classification.
 - When ambiguity is real, escalate to `advisor.lead` — don't
   guess destinations.
 

package/daemon/specs/rigs/launch/kernel/agents/queue/worker/startup/context.md

@@ -7,7 +7,9 @@ classify stream-to-queue substrate.
 
 `rig whoami --json` to confirm identity, then `rig stream list
 --limit 20` to see what's already in the intake without a clear
-destination.
+destination. `rig project decisions status` says whether typed decisions
+are on for the `stream` consumer; when they are, `rig project wake
+--decide` takes the routine items and leaves you the rest (see your role).
 
 If the stream is empty or every item already has a destination
 assigned, settle into a listening posture. Confirm an actual configured wake

package/daemon/specs/rigs/launch/secrets-manager/secrets-manager.compose.yaml

@@ -9,7 +9,7 @@ services:
       VAULT_DEV_ROOT_TOKEN_ID: "openrig-dev-token"
       VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
     ports:
-      - "8200:8200"
+      - "127.0.0.1:8200:8200"
     healthcheck:
       test: ["CMD", "vault", "status", "-address=http://127.0.0.1:8200"]
       interval: 5s