@polderlabs/bizar 10.30.0 → 10.32.0

package/AGENTS.md

@@ -32,7 +32,9 @@ make session-end              # lifecycle compatibility target
 - **MUST** verify evidence before claiming completion.
 - **MUST NOT** commit `console.log`, `debugger`, `.only()`, credentials, generated secrets, or runtime logs.
 - **MUST NOT** use a persistent Claude daemon. Claude Code and the Agent SDK run in-process; background work uses Claude Code's Agent tool.
-- **MUST NOT** rebase or force-push under the default project policy.
+- **MUST NOT** rebase or force-push unless an explicit operator restriction or
+  host/runtime contract forbids it; Bizar itself does not gate high-impact
+  actions by impact.
 
 ### Worktree discipline
 
@@ -58,16 +60,16 @@ edit, test, and iterate without pausing for routine decisions. Routine
 decisions (file layout, naming, scope of a single commit, choosing between
 two equivalent stdlib calls, picking a verification command from the Makefile,
 or completing an OpenKan task after `make check` is green) do NOT require
-human approval and MUST NOT trigger a permission handoff. PreToolUse hooks
-still deny prohibited actions and escalate externally visible or irreversible
-actions with `permissionDecision: "ask"`; that escalation list is the
-authoritative floor, not a starting point.
-
-Mike performs bounded read-only orientation, then uses a native Agent team as
-the default for substantive work. Direct work is reserved for an unmistakably
-tiny single-target copy/style/format edit or the user's explicit `/quick`
-request. A single Agent or native workflow is used only when the user
-explicitly requests that mode or a durable workflow must be resumed. Ask one
+human approval and MUST NOT trigger a permission handoff. PreToolUse hooks may
+classify high-impact actions and add evidence guidance, but they must not deny
+or ask solely because an action is externally visible, irreversible, or
+powerful. Invalid target/schema/state is a typed contract error, not a
+permission handoff.
+
+Mike performs bounded read-only orientation, then chooses the smallest capable
+execution surface for the requested outcome. Direct work is the default when
+one agent can safely complete and verify the task; native Agent teams are used
+only when independent lanes materially improve throughput or correctness. Ask one
 concise clarification question only when a material choice, acceptance
 criterion, safety boundary, or unresolved constraint would change the work;
 otherwise continue autonomously. The team is host-side state under
@@ -86,46 +88,25 @@ default. If no enabled configured candidate exists, dispatch fails with an
 actionable configuration error. Bizar never retries a failed dispatch by cycling
 aliases, providers, or tiers.
 
-The authoritative hard approval list (cannot be auto-approved) is: pushes, pull-request
+The authoritative default is maximum autonomy; pushes, pull-request
 mutations, releases, package publication, deployments, production/shared-
 infrastructure writes, credential changes, public exposure, irreversible
-destruction. Everything else proceeds.
-
-Under F-176 the seven-category floor above is enforced by `permission-request.mjs`
-(the destructive subset: force-push, rebase, root deletion, system-destructive
-commands) and surfaced for the rest via `git-workflow-guard.mjs` as advisory
-reminders in `hookSpecificOutput.additionalContext`. `permissions.deny` and
-`permissions.ask` are emptied by design — the floor is enforced by hook output,
-not by Claude Code prompts.
-
-> Note: `config/claude/settings.json` ships `permissions.ask` moved into
-> `permissions.allow` so subagents do not prompt for commits, pushes, PRs,
-> or deploys. Operators who want HITL back can move the following exact
-> patterns from `permissions.allow` into `permissions.ask` in their local
-> `~/.claude/settings.json` override:
->
-> - `Bash(git push *)`
-> - `Bash(git -C * push *)`
-> - `Bash(git --git-dir=* push *)`
-> - `Bash(git push --force *)`
-> - `Bash(git push -f *)`
-> - `Bash(git rebase *)`
-> - `Bash(gh pr create *)`
-> - `Bash(gh pr merge *)`
-> - `Bash(gh release create *)`
-> - `Bash(npm publish *)`
-> - `Bash(bun publish *)`
-> - `Bash(pnpm publish *)`
-> - `Bash(vercel deploy *)`
-> - `Bash(wrangler deploy *)`
-> - `Bash(flyctl deploy *)`
+destruction proceed when explicitly requested and contract-valid. Stronger
+evidence and rollback handling are required; a permission prompt is not.
+
+The default maximum-autonomy profile is implemented by the host runtime;
+`permission-request.mjs` is a fail-open compatibility hook. The workflow and
+PreToolUse hooks may emit advisory evidence guidance but never create a Bizar
+approval gate.
+Historical F-176 approval-floor wording is retained only in superseded audit
+records. Operators may configure their host independently, but Bizar does not
+reintroduce an impact-based or role-based gate.
 
 > Note: `disableAutoCompact: false` is shipped by default so Claude Code can
 > compact automatically before the context limit. Hook `precompact-priorities.sh`
 > snapshots bounded state and preserves evidence and decisions on compaction.
-Local `git commit` is always allowed silently via `permissions.allow`; the seven
-HITL categories above are gated by `permission-request.mjs` plus the advisory
-hook chain.
+Local and external mutations follow the same action-contract path; hooks add
+evidence guidance only.
 
 Agents fetch current official documentation via WebSearch + WebFetch before
 acting on an external API, library, framework, CLI, configuration format, or
@@ -140,14 +121,11 @@ The autonomy and approval policy above governs this execution model. The project
 Every non-empty primary request enters Bizar through `office-manager` (`@mike`).
 The installer sets Claude Code's global `agent` setting to Mike's frontmatter
 name (`mike`),
-and the routing hook supplies the team-first coordination policy. For non-tiny
-work, Mike first gathers only bounded read-only context. When the inferred
-outcome, acceptance criteria, and safety boundary are clear, it forms the
-default Agent team and continues autonomously. It asks one concise
+and the routing hook supplies the coordination policy. Mike gathers bounded
+read-only context, selects direct execution or a narrowly scoped Agent team
+based on coordination value, and continues autonomously. It asks one concise
 clarification only when a material choice or unresolved constraint would
-change the work. `/quick` explicitly selects direct primary-session execution;
-single Agents and native workflows are explicit or resumed modes. Mike owns
-integration and final verification.
+change the work. Mike owns integration and final verification.
 A Bizar custom agent already executing its assigned role does not recursively
 dispatch itself.
 
@@ -202,3 +180,9 @@ not a general note vault, semantic search service, or knowledge-base API.
 3. `make verify-removed-surfaces`, `make verify-repo-structure`, `make check-arch`, `make test`, `make e2e`, `make clean-check`, and `make check` pass as applicable.
 4. The OpenKan task records fresh verification evidence and no required work remains.
 5. `/simplify` reviews the staged diff before the approval-gated commit.
+
+<!-- openwolf:begin -->
+# OpenWolf
+
+This project uses OpenWolf for context management. Read and follow .wolf/OPENWOLF.md at session start. Check .wolf/cerebrum.md before generating code. Grep .wolf/anatomy.md for a file's path before reading it (never read the whole index).
+<!-- openwolf:end -->

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="docs/assets/bizar-banner.svg" alt="Bizar: guarded autonomy for Agent Orchestrator" width="100%" />
+<img src="docs/assets/bizar-banner.svg" alt="Bizar: maximum autonomy for Agent Orchestrator" width="100%" />
 
 [![npm](https://img.shields.io/npm/v/%40polderlabs%2Fbizar?color=0f766e&label=npm)](https://www.npmjs.com/package/@polderlabs/bizar)
 [![license](https://img.shields.io/badge/license-MIT-0f172a)](LICENSE)
@@ -9,7 +9,7 @@
 ![OmniRoute routing](https://img.shields.io/badge/routing-OmniRoute-0ea5e9)
 [![Standalone planning](https://img.shields.io/badge/standalone%20planning-OpenKan-f59e0b)](https://www.npmjs.com/package/@polderlabs/openkan)
 
-### Guarded autonomy for Agent Orchestrator workers
+### Maximum autonomy for Agent Orchestrator workers
 
 Run focused Codex workers under Agent Orchestrator. Bizar supplies their
 repository policy, guardrails, skills, and verification evidence.
@@ -27,9 +27,10 @@ each worker's implementation and verification discipline explicit. AO owns
 multi-agent coordination, worktrees, branches, PR/review/CI feedback, previews,
 and browser state; Bizar does not duplicate those surfaces.
 
-It keeps the operator in control of model selection and high-impact actions.
-AO model choices live in the registered project's AO configuration. Standalone
-Claude aliases live in the global Claude configuration.
+It records evidence and rollback context for high-impact actions while keeping
+execution autonomous by default. AO model choices live in the registered
+project's AO configuration. Standalone Claude aliases live in global Claude
+configuration.
 
 | You want | Bizar provides |
 | --- | --- |
@@ -67,11 +68,16 @@ Install Bizar, then configure the repository with a running AO daemon.
 
 ```sh
 npm install -g @polderlabs/bizar
-bizar ao doctor
+bizar ao check
+bizar ao install
+bizar ao update
 bizar ao setup
 ```
 
-`bizar ao setup` preserves AO's existing project configuration while selecting
+`bizar ao check` runs AO health checks. `bizar ao install` and `bizar ao update`
+open AO through its supported lifecycle command; the AO desktop app owns
+installation and updates. `bizar ao setup` remains the separate, explicit
+repository configuration step: it preserves AO's existing project configuration while selecting
 Codex for both AO roles and materializing Bizar's managed repository-local
 worker rules at `.ao/bizar-worker-rules.md`.
 AO remains responsible for spawning workers, messaging, PR claims, review/CI
@@ -176,10 +182,10 @@ risk. It does not create parallel workers merely to look busy.
 | --- | --- |
 | Research, planning, implementation, review, verification | Architecture, accessibility, security, tests, documentation, performance, build repair, operations, and domain analysis |
 
-## Guardrails that stay out of the way
+## Evidence that stays in the loop
 
-Bizar is designed to be autonomous for local, reversible work and deliberate
-for consequential actions.
+Bizar executes valid operations autonomously and records stronger evidence and
+rollback context when the effect is consequential.
 
 | Category | Default behavior |
 | --- | --- |
@@ -187,12 +193,12 @@ for consequential actions.
 | Parallel code changes | Uses isolated worktrees and scoped task ownership |
 | Ambiguous material design choice | Asks one concise clarification before execution |
 | Commit | Locally allowed, with a fresh simplify review reminder |
-| Push, PR mutation, release, publish, deploy | Requires an explicit human decision |
-| Rebase, force-push, broad destructive commands | Denied or escalated by the safety floor |
+| Push, PR mutation, release, publish, deploy | Executes when requested and contract-valid; records evidence |
+| Rebase, force-push, broad destructive commands | Executes when requested and contract-valid; advisory context only |
 
-The goal is not to make Claude Code timid. It is to make its boundaries clear:
-Bizar works through local implementation and verification, then stops at the
-point where an external or difficult-to-reverse decision belongs to you.
+The goal is clear request fidelity: invalid targets, schemas, signatures, and
+lifecycle states fail deterministically, while explicit operator restrictions
+remain binding.
 
 ## What gets installed
 

package/cli/banner.mjs

@@ -14,7 +14,7 @@ export function showBanner() {
   console.log(chalk.hex('#6366f1').bold(RUNE_HELM));
   console.log(chalk.hex('#a855f7')('    Guarded autonomous agent system for Claude Code'));
   console.log();
-  console.log(chalk.dim('    84 agents · guarded autonomy · human approval gates · MCP · Skills CLI'));
+  console.log(chalk.dim('    84 agents · maximum autonomy · evidence verification · MCP · Skills CLI'));
   console.log();
 }
 

package/cli/commands/ao.mjs

@@ -10,7 +10,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { basename, dirname, resolve } from 'node:path';
 
-export const AO_RULES_FILE = '.ao/bizar-worker-rules.md';
+export const AO_RULES_FILE = '.ao/bizar-managed-rules.md';
 export const AO_ORCHESTRATOR_RULES = 'Use AO for coordination and Bizar as the Codex worker harness. Spawn focused AO workers for implementation; workers own changes, verification, commits, and PR follow-up.';
 const WORKER_RULES_TEMPLATE = resolve(dirname(fileURLToPath(import.meta.url)), '../../config/ao/worker-rules.md');
 
@@ -21,13 +21,15 @@ function optionValue(args, flag) {
 
 export function parseAoArgs(args = []) {
   const [first, ...rest] = args;
-  const subcommand = ['setup', 'doctor', 'status', 'sessions', 'help'].includes(first) ? first : 'forward';
+  const subcommand = ['check', 'install', 'update', 'setup', 'doctor', 'status', 'sessions', 'help'].includes(first) ? first : 'forward';
   return {
     subcommand,
     forward: subcommand === 'forward' ? args : rest,
     project: optionValue(args, '--project'),
     model: optionValue(args, '--model'),
     permissions: optionValue(args, '--permissions'),
+    workerAgent: optionValue(args, '--worker-agent'),
+    orchestratorAgent: optionValue(args, '--orchestrator-agent'),
     help: args.includes('--help') || args.includes('-h') || first === 'help',
   };
 }
@@ -42,8 +44,12 @@ export function defaultProjectId(cwd) {
 }
 
 export function configuredProjectConfig(current = {}, options = {}) {
-  const worker = { ...(current.worker || {}), agent: 'codex' };
-  const orchestrator = { ...(current.orchestrator || {}), agent: 'codex' };
+  const worker = { ...(current.worker || {}) };
+  const orchestrator = { ...(current.orchestrator || {}) };
+  if (!worker.agent) worker.agent = 'codex';
+  if (!orchestrator.agent) orchestrator.agent = 'codex';
+  if (options.workerAgent) worker.agent = options.workerAgent;
+  if (options.orchestratorAgent) orchestrator.agent = options.orchestratorAgent;
   const agentConfig = { ...(current.agentConfig || {}) };
   if (options.model) agentConfig.model = options.model;
   if (options.permissions) agentConfig.permissions = options.permissions;
@@ -116,6 +122,9 @@ function help(output = process.stdout) {
 bizar ao — Agent Orchestrator bridge (AO-primary)
 
 Usage:
+  bizar ao check
+  bizar ao install
+  bizar ao update
   bizar ao doctor
   bizar ao setup [--project <id>] [--model <id>] [--permissions <mode>]
   bizar ao status
@@ -123,7 +132,9 @@ Usage:
   bizar ao <any supported ao command> [args...]
 
 AO remains the sole owner of sessions, worktrees, PRs, review feedback,
-previews, and browser state. The setup command registers this repository with AO,
+previews, and browser state. Check runs AO's health checks. Install and update
+open AO through its supported lifecycle command; the AO desktop app owns updates.
+The setup command registers this repository with AO,
 selects Codex for both AO roles, and preserves existing AO project settings.
 It creates and configures the repository-local ${AO_RULES_FILE} as AO worker
 rules, preserving a file that is already present.
@@ -160,7 +171,9 @@ export function setupAo(options = {}) {
   projectId ||= defaultProjectId(cwd);
 
   if (!projectDetails) {
-    const added = runAo(['project', 'add', '--path', cwd, '--id', projectId, '--worker-agent', 'codex', '--orchestrator-agent', 'codex'], options);
+    const addArgs = ['project', 'add', '--path', cwd, '--id', projectId];
+    addArgs.push('--worker-agent', options.workerAgent || 'codex', '--orchestrator-agent', options.orchestratorAgent || 'codex');
+    const added = runAo(addArgs, options);
     if (!added.ok) return added;
     const details = runAo(['project', 'get', projectId, '--json'], options);
     if (!details.ok) return details;
@@ -188,6 +201,16 @@ export function doctorAo(options = {}) {
   };
 }
 
+export function checkAo(options = {}) {
+  return runAo(['doctor', '--json'], options);
+}
+
+export function installAo(options = {}) {
+  return runAo(['start', '--json'], options);
+}
+
+export const updateAo = installAo;
+
 export function run(args = [], options = {}) {
   const parsed = parseAoArgs(args);
   const output = options.output || process;
@@ -196,9 +219,15 @@ export function run(args = [], options = {}) {
     return true;
   }
   try {
+    if (parsed.subcommand === 'setup' && isAoSession(options.env || process.env) && !options.allowNested) {
+      throw new Error('AO_OWNED_OPERATION: AO setup cannot create competing lifecycle state from an AO worker');
+    }
     let result;
     if (parsed.subcommand === 'setup') result = setupAo({ ...options, ...parsed });
+    else if (parsed.subcommand === 'check') result = checkAo(options);
     else if (parsed.subcommand === 'doctor') result = doctorAo(options);
+    else if (parsed.subcommand === 'install') result = installAo(options);
+    else if (parsed.subcommand === 'update') result = updateAo(options);
     else if (parsed.subcommand === 'status') result = runAo(['status', '--json'], options);
     else if (parsed.subcommand === 'sessions') result = runAo(['session', 'ls', ...parsed.forward], options);
     else result = runAo(parsed.forward, options);

package/cli/commands/improve-proposal.mjs

@@ -37,7 +37,7 @@ import { createHash } from 'node:crypto';
  *   originalSha256: string,
  *   find: string,
  *   newText: string,
- *   verification: { command: string, cwd?: string, timeoutMs?: number, expectedExitCode?: number },
+ *   verification: { command?: string, argv?: string[], cwd?: string, timeoutMs?: number, expectedExitCode?: number },
  *   rollbackPlan: { kind: 'replace-back', note: string } | { kind: 'manual', note: string, manualCommand?: string },
  *   reason: string,
  *   createdAt: string,
@@ -98,8 +98,16 @@ export function validateProposal(raw) {
   if (raw.find === raw.newText) {
     throw new TypeError('Proposal.newText must differ from Proposal.find');
   }
-  if (typeof raw.verification !== 'object' || typeof raw.verification.command !== 'string' || raw.verification.command.length === 0) {
-    throw new TypeError('Proposal.verification.command must be a non-empty string');
+  if (typeof raw.verification !== 'object'
+    || (!Array.isArray(raw.verification.argv) && (typeof raw.verification.command !== 'string' || raw.verification.command.length === 0))) {
+    throw new TypeError('Proposal.verification requires a non-empty argv array or command string');
+  }
+  if (Array.isArray(raw.verification.argv)
+    && (raw.verification.argv.length === 0 || raw.verification.argv.some((arg) => typeof arg !== 'string' || arg.length === 0))) {
+    throw new TypeError('Proposal.verification.argv must contain non-empty strings');
+  }
+  if (typeof raw.verification.command === 'string' && /(?:^|[^\\])(?:;|&&|\|\||`|\$\()/.test(raw.verification.command) && !Array.isArray(raw.verification.argv)) {
+    throw new TypeError('Proposal.verification.command contains shell syntax; use verification.argv');
   }
   if (typeof raw.rollbackPlan !== 'object' || (raw.rollbackPlan.kind !== 'replace-back' && raw.rollbackPlan.kind !== 'manual')) {
     throw new TypeError('Proposal.rollbackPlan.kind must be "replace-back" or "manual"');
@@ -152,4 +160,4 @@ export function planRollback(proposal, currentBytes) {
     return { kind: 'replace-back', newBytes: currentBytes.replace(proposal.newText, proposal.find) };
   }
   return { kind: 'manual', manualCommand: proposal.rollbackPlan.manualCommand };
-}
+}

package/cli/commands/improve.mjs

@@ -56,7 +56,7 @@ import {
   statSync,
   writeFileSync,
 } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { ensureSecureDir } from './secure-dir.mjs';
 import {
@@ -145,19 +145,57 @@ function readCurrentFile({ file, cwd }) {
   return { abs, bytes: readFileSync(abs, 'utf8') };
 }
 
+/** Parse a deliberately small argv form without invoking a shell. */
+export function parseSimpleArgv(command) {
+  if (typeof command !== 'string' || !command.trim()) throw new TypeError('verification command must be non-empty');
+  if (/(?:;|&&|\|\||`|\$\(|>|<|\n|\r)/.test(command)) {
+    throw new TypeError('verification command contains shell syntax; use argv');
+  }
+  const argv = [];
+  let token = '';
+  let quote = null;
+  let escaped = false;
+  for (const char of command.trim()) {
+    if (escaped) { token += char; escaped = false; continue; }
+    if (char === '\\' && quote !== "'") { escaped = true; continue; }
+    if (quote) {
+      if (char === quote) quote = null;
+      else token += char;
+      continue;
+    }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (/\s/.test(char)) {
+      if (token) { argv.push(token); token = ''; }
+      continue;
+    }
+    token += char;
+  }
+  if (escaped || quote || !token && argv.length === 0) throw new TypeError('verification command has unterminated quoting');
+  if (token) argv.push(token);
+  return argv;
+}
+
+function runVerification(verification, cwd) {
+  const verifyCwd = verification.cwd || cwd;
+  const timeout = Number(verification.timeoutMs) || 60_000;
+  const argv = Array.isArray(verification.argv) ? verification.argv : parseSimpleArgv(verification.command);
+  return { result: spawnSync(argv[0], argv.slice(1), { cwd: verifyCwd, encoding: 'utf8', timeout, shell: false }), cwd: verifyCwd };
+}
+
 function doPropose({ flags, cwd }) {
   if (!flags.file || !flags.find || !flags.new || !flags.verify) {
     process.stderr.write('usage: bizar improve propose --file <path> --find <substr> --new <text> --verify <cmd> [--reason <why>]\n');
     process.exit(2);
   }
   const { abs, bytes } = readCurrentFile({ file: flags.file, cwd });
+  const argv = parseSimpleArgv(flags.verify);
   const proposal = {
     id: newProposalId({ targetFile: abs, cwd }),
     targetFile: abs,
     originalSha256: sha256Text(bytes),
     find: flags.find,
     newText: flags.new,
-    verification: { command: flags.verify, cwd, expectedExitCode: 0 },
+    verification: { command: flags.verify, argv, cwd, expectedExitCode: 0 },
     rollbackPlan: { kind: 'replace-back', note: `Reverse the find/newText swap on ${abs}` },
     reason: String(flags.reason ?? '(no reason supplied)'),
     createdAt: new Date().toISOString(),
@@ -218,12 +256,7 @@ function doRun({ flags, cwd }) {
   writeFileSync(abs, plan.newBytes, { mode: statSync(abs).mode & 0o777 });
 
   // Verify.
-  const verifyCwd = proposal.verification.cwd || cwd;
-  const verify = spawnSync('sh', ['-c', proposal.verification.command], {
-    cwd: verifyCwd,
-    encoding: 'utf8',
-    timeout: Number(proposal.verification.timeoutMs) || 60_000,
-  });
+  const { result: verify, cwd: verifyCwd } = runVerification(proposal.verification, cwd);
   const verifyExit = verify.status ?? -1;
   const verifyStdoutSha = sha256Text(verify.stdout ?? '');
   const verifyStderrSha = sha256Text(verify.stderr ?? '');
@@ -245,6 +278,7 @@ function doRun({ flags, cwd }) {
       rolledBackSha256: rollback.kind === 'replace-back' ? sha256Text(rollback.newBytes) : null,
       verification: {
         command: proposal.verification.command,
+        argv: proposal.verification.argv,
         cwd: verifyCwd,
         exitCode: verifyExit,
         stdoutSha256: verifyStdoutSha,
@@ -268,6 +302,7 @@ function doRun({ flags, cwd }) {
     afterSha256: summary.afterSha256,
     verification: {
       command: proposal.verification.command,
+      argv: proposal.verification.argv,
       cwd: verifyCwd,
       exitCode: verifyExit,
       stdoutSha256: verifyStdoutSha,
@@ -286,11 +321,7 @@ function doVerify({ flags, cwd }) {
   }
   const proposalPath = isAbsolute(flags.proposal) ? flags.proposal : resolve(cwd, flags.proposal);
   const proposal = validateProposal(JSON.parse(readFileSync(proposalPath, 'utf8')));
-  const verify = spawnSync('sh', ['-c', proposal.verification.command], {
-    cwd: proposal.verification.cwd || cwd,
-    encoding: 'utf8',
-    timeout: Number(proposal.verification.timeoutMs) || 60_000,
-  });
+  const { result: verify } = runVerification(proposal.verification, cwd);
   process.stdout.write(JSON.stringify({
     ok: (verify.status ?? -1) === (proposal.verification.expectedExitCode ?? 0),
     exitCode: verify.status ?? -1,

package/cli/commands/install.mjs

@@ -197,6 +197,16 @@ export async function update(args, isHelpRequest) {
     showUpdateHelp();
     return;
   }
+  const versionIndex = args.indexOf('--version');
+  if (versionIndex >= 0) {
+    const version = args[versionIndex + 1];
+    const artifactIndex = args.indexOf('--artifact-dir');
+    const artifactDir = artifactIndex >= 0 ? args[artifactIndex + 1] : undefined;
+    const { runVerifiedUpdate } = await import('../update.mjs');
+    const result = await runVerifiedUpdate(args, { artifactDir });
+    if (!result?.ok) process.exit(1);
+    return;
+  }
   // v10.19.6 — route update through the same flag-parsing + installer
   // pipeline as install so `--dry-run`, `--force`, `--yes`, etc. do
   // what they claim. See `runUpdateWithFlags` for the testable

package/cli/commands/openkan.mjs

@@ -18,7 +18,7 @@ function help() {
 bizar openkan — default durable planning and goals surface
 
 Usage:
-  bizar openkan install                 Install @polderlabs/openkan@latest from npm
+  bizar openkan install                 Install @polderlabs/openkan@0.5.0 from npm
   ok init                                Initialise .ok/ in this project
   ok task <add|list|show|update|...>     Manage durable tasks
   ok plan <add|list|show|update>         Manage plans and phases

package/cli/commands/release-provenance.mjs

@@ -25,7 +25,7 @@
  * The private key is operator-held. The CLI never persists it.
  */
 
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, generateKeyPairSync } from 'node:crypto';
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { join } from 'node:path';
@@ -49,8 +49,9 @@ export const USAGE = `
     --package-json <path> Root package.json (default: ./package.json).
     --sdk-package-json <path> SDK package.json (default: ./packages/sdk/package.json).
     --private-key <path>  PEM-encoded ed25519 private key. If omitted, the
-                          signature blob is generated with a deterministic
-                          test key so the operator can verify the layout.
+                          an ephemeral fixture key is generated and returned
+                          for tests; production releases must provide one.
+    --tarball <path>      Exact artifact bytes to bind to provenance/signature.
     --git-sha <sha>       Override the git sha (default: read from git rev-parse HEAD).
     --quiet               Suppress progress output.
 
@@ -87,16 +88,17 @@ function minisignEncode(sigB64, trustedComment = `signed by bizar ${CURRENT_RELE
     `untrusted comment: ${untrustedComment}`,
     sigB64,
     `trusted comment: ${trustedComment}`,
-    Buffer.from(trustedComment, 'utf8').toString('base64'),
+    Buffer.from(`trusted comment: ${trustedComment}\n`, 'utf8').toString('base64'),
     '',
   ].join('\n');
 }
 
-function deterministicTestKey() {
-  // Pure-JS test key — generates a valid signature so the layout is
-  // verifiable end-to-end. Operators MUST replace this with a
-  // private key they control via --private-key.
-  return Buffer.from('not-a-real-key', 'utf8').toString('base64').slice(0, 44);
+function ephemeralSigningKey() {
+  const pair = generateKeyPairSync('ed25519');
+  return {
+    privateKeyPem: pair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+    publicKeyPem: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString(),
+  };
 }
 
 /**
@@ -115,6 +117,8 @@ export function buildReleaseArtifacts({
   privateKeyPem,
   outDir,
   timestamp,
+  artifactBytes,
+  artifactName,
 }) {
   const sdkName = sdkPackageJson.name;
   const sdkVersion = sdkPackageJson.version;
@@ -142,9 +146,11 @@ export function buildReleaseArtifacts({
   // Use the SBOM as the artifact for provenance + signing so the
   // signed payload IS the SBOM. Operators can also sign the
   // tarball — adjust the `subject.name` accordingly.
+  const signedArtifact = artifactBytes ?? sbomBytes;
+  const signedArtifactSha256 = createHash('sha256').update(signedArtifact).digest('hex');
   const statement = buildProvenanceAttestation({
-    artifactName: `${rootPackageJson.name}-${version}.sbom.cdx.json`,
-    artifactSha256: sbomSha256,
+    artifactName: artifactName ?? `${rootPackageJson.name}-${version}.tgz`,
+    artifactSha256: signedArtifactSha256,
     version,
     gitSha,
     materialUri: `git+https://github.com/DrB0rk/BizarHarness@${gitSha}`,
@@ -154,20 +160,24 @@ export function buildReleaseArtifacts({
   const provenanceJsonl = JSON.stringify(statement) + '\n';
   const provenanceSha256 = createHash('sha256').update(provenanceJsonl, 'utf8').digest('hex');
 
-  // Signature: ed25519 over the SBOM. The keyId is the
-  // CURRENT_RELEASE_KEY_ID (8 ASCII bytes). When --private-key is
-  // omitted, we fall back to a deterministic test signature so
-  // operators can still see the layout.
-  const message = sbomBytes;
-  const keyId = Buffer.from(CURRENT_RELEASE_KEY_ID, 'utf8').subarray(0, 8);
+  // Signature: ed25519 over the exact artifact bytes. Production callers
+  // provide a private key; the generated key fallback is explicit and
+  // returns its public key so fixtures remain interoperable and auditable.
+  const trustedComment = `signed by bizar ${CURRENT_RELEASE_KEY_ID} sha256=${signedArtifactSha256}`;
+  // Minisign authenticates the trusted-comment envelope. Keep the exact
+  // bytes identical to the verifier so generated fixtures are interoperable.
+  const message = Buffer.from(`trusted comment: ${trustedComment}\n`, 'utf8');
+  const keyId = Buffer.from(CURRENT_RELEASE_KEY_ID, 'hex').subarray(0, 8);
   let sigB64;
+  let signingPublicKeyPem = null;
   if (privateKeyPem) {
     sigB64 = signWithEd25519(message, privateKeyPem, keyId);
   } else {
-    // Deterministic test signature — keeps the layout byte-stable.
-    sigB64 = deterministicTestKey();
+    const ephemeral = ephemeralSigningKey();
+    sigB64 = signWithEd25519(message, ephemeral.privateKeyPem, keyId);
+    signingPublicKeyPem = ephemeral.publicKeyPem;
   }
-  const minisigText = minisignEncode(sigB64);
+  const minisigText = minisignEncode(sigB64, trustedComment);
 
   mkdirSync(outDir, { recursive: true, mode: 0o700 });
   const sbomPath = join(outDir, `${version}.sbom.cdx.json`);
@@ -189,6 +199,8 @@ export function buildReleaseArtifacts({
     outDir,
     sdkName,
     sdkVersion,
+    signedArtifactSha256,
+    signingPublicKeyPem,
   };
 }
 
@@ -231,6 +243,7 @@ export async function run(subargs) {
   const privateKeyPem = flags['private-key']
     ? readFileSync(String(flags['private-key']), 'utf8')
     : null;
+  const artifactBytes = flags.tarball ? readFileSync(String(flags.tarball)) : undefined;
 
   const artifacts = buildReleaseArtifacts({
     version,
@@ -238,6 +251,8 @@ export async function run(subargs) {
     sdkPackageJson: sdkPkg,
     gitSha,
     privateKeyPem,
+    artifactBytes,
+    artifactName: flags.tarball ? `${rootPkg.name}-${version}.tgz` : undefined,
     outDir,
   });
 

package/cli/commands/worker.mjs

@@ -104,6 +104,9 @@ export async function run(name, args, isHelpRequest) {
     return true;
   }
   if (subcommand !== 'start') { usage(); return false; }
+  if (process.env.AO_SESSION_ID || process.env.AO_PROJECT_ID) {
+    throw new Error('AO_OWNED_OPERATION: bizar worker start is disabled inside an Agent Orchestrator worker; request AO coordination instead');
+  }
   const parsed = parseStart(args.slice(1));
   const plan = buildWorkerPlan({ repoRoot: process.cwd(), ...parsed });
   mkdirSync(workerRoot(), { recursive: true, mode: 0o700 });