@polderlabs/bizar 10.31.0 → 10.33.0

package/AGENTS.md

@@ -32,7 +32,9 @@ make session-end              # lifecycle compatibility target
 - **MUST** verify evidence before claiming completion.
 - **MUST NOT** commit `console.log`, `debugger`, `.only()`, credentials, generated secrets, or runtime logs.
 - **MUST NOT** use a persistent Claude daemon. Claude Code and the Agent SDK run in-process; background work uses Claude Code's Agent tool.
-- **MUST NOT** rebase or force-push under the default project policy.
+- **MUST NOT** rebase or force-push unless an explicit operator restriction or
+  host/runtime contract forbids it; Bizar itself does not gate high-impact
+  actions by impact.
 
 ### Worktree discipline
 
@@ -58,16 +60,16 @@ edit, test, and iterate without pausing for routine decisions. Routine
 decisions (file layout, naming, scope of a single commit, choosing between
 two equivalent stdlib calls, picking a verification command from the Makefile,
 or completing an OpenKan task after `make check` is green) do NOT require
-human approval and MUST NOT trigger a permission handoff. PreToolUse hooks
-still deny prohibited actions and escalate externally visible or irreversible
-actions with `permissionDecision: "ask"`; that escalation list is the
-authoritative floor, not a starting point.
-
-Mike performs bounded read-only orientation, then uses a native Agent team as
-the default for substantive work. Direct work is reserved for an unmistakably
-tiny single-target copy/style/format edit or the user's explicit `/quick`
-request. A single Agent or native workflow is used only when the user
-explicitly requests that mode or a durable workflow must be resumed. Ask one
+human coordination and MUST NOT trigger a permission handoff. PreToolUse hooks may
+classify high-impact actions and add evidence guidance, but they must not deny
+or ask solely because an action is externally visible, irreversible, or
+powerful. Invalid target/schema/state is a typed contract error, not a
+permission handoff.
+
+Mike performs bounded read-only orientation, then chooses the smallest capable
+execution surface for the requested outcome. Direct work is the default when
+one agent can safely complete and verify the task; native Agent teams are used
+only when independent lanes materially improve throughput or correctness. Ask one
 concise clarification question only when a material choice, acceptance
 criterion, safety boundary, or unresolved constraint would change the work;
 otherwise continue autonomously. The team is host-side state under
@@ -86,46 +88,25 @@ default. If no enabled configured candidate exists, dispatch fails with an
 actionable configuration error. Bizar never retries a failed dispatch by cycling
 aliases, providers, or tiers.
 
-The authoritative hard approval list (cannot be auto-approved) is: pushes, pull-request
+The authoritative default is maximum autonomy; pushes, pull-request
 mutations, releases, package publication, deployments, production/shared-
 infrastructure writes, credential changes, public exposure, irreversible
-destruction. Everything else proceeds.
-
-Under F-176 the seven-category floor above is enforced by `permission-request.mjs`
-(the destructive subset: force-push, rebase, root deletion, system-destructive
-commands) and surfaced for the rest via `git-workflow-guard.mjs` as advisory
-reminders in `hookSpecificOutput.additionalContext`. `permissions.deny` and
-`permissions.ask` are emptied by design — the floor is enforced by hook output,
-not by Claude Code prompts.
-
-> Note: `config/claude/settings.json` ships `permissions.ask` moved into
-> `permissions.allow` so subagents do not prompt for commits, pushes, PRs,
-> or deploys. Operators who want HITL back can move the following exact
-> patterns from `permissions.allow` into `permissions.ask` in their local
-> `~/.claude/settings.json` override:
->
-> - `Bash(git push *)`
-> - `Bash(git -C * push *)`
-> - `Bash(git --git-dir=* push *)`
-> - `Bash(git push --force *)`
-> - `Bash(git push -f *)`
-> - `Bash(git rebase *)`
-> - `Bash(gh pr create *)`
-> - `Bash(gh pr merge *)`
-> - `Bash(gh release create *)`
-> - `Bash(npm publish *)`
-> - `Bash(bun publish *)`
-> - `Bash(pnpm publish *)`
-> - `Bash(vercel deploy *)`
-> - `Bash(wrangler deploy *)`
-> - `Bash(flyctl deploy *)`
+destruction proceed when explicitly requested and contract-valid. Stronger
+evidence and rollback handling are required; a permission prompt is not.
+
+The default maximum-autonomy profile is implemented by the host runtime;
+`permission-request.mjs` is a fail-open compatibility hook. The workflow and
+PreToolUse hooks may emit advisory evidence guidance but never create a Bizar
+approval gate.
+Historical F-176 approval-floor wording is retained only in superseded audit
+records. Operators may configure their host independently, but Bizar does not
+reintroduce an impact-based or role-based gate.
 
 > Note: `disableAutoCompact: false` is shipped by default so Claude Code can
 > compact automatically before the context limit. Hook `precompact-priorities.sh`
 > snapshots bounded state and preserves evidence and decisions on compaction.
-Local `git commit` is always allowed silently via `permissions.allow`; the seven
-HITL categories above are gated by `permission-request.mjs` plus the advisory
-hook chain.
+Local and external mutations follow the same action-contract path; hooks add
+evidence guidance only.
 
 Agents fetch current official documentation via WebSearch + WebFetch before
 acting on an external API, library, framework, CLI, configuration format, or
@@ -140,14 +121,11 @@ The autonomy and approval policy above governs this execution model. The project
 Every non-empty primary request enters Bizar through `office-manager` (`@mike`).
 The installer sets Claude Code's global `agent` setting to Mike's frontmatter
 name (`mike`),
-and the routing hook supplies the team-first coordination policy. For non-tiny
-work, Mike first gathers only bounded read-only context. When the inferred
-outcome, acceptance criteria, and safety boundary are clear, it forms the
-default Agent team and continues autonomously. It asks one concise
+and the routing hook supplies the coordination policy. Mike gathers bounded
+read-only context, selects direct execution or a narrowly scoped Agent team
+based on coordination value, and continues autonomously. It asks one concise
 clarification only when a material choice or unresolved constraint would
-change the work. `/quick` explicitly selects direct primary-session execution;
-single Agents and native workflows are explicit or resumed modes. Mike owns
-integration and final verification.
+change the work. Mike owns integration and final verification.
 A Bizar custom agent already executing its assigned role does not recursively
 dispatch itself.
 
@@ -201,4 +179,10 @@ not a general note vault, semantic search service, or knowledge-base API.
 2. Documentation and OpenKan task/plan/PRD state describe the actual code.
 3. `make verify-removed-surfaces`, `make verify-repo-structure`, `make check-arch`, `make test`, `make e2e`, `make clean-check`, and `make check` pass as applicable.
 4. The OpenKan task records fresh verification evidence and no required work remains.
-5. `/simplify` reviews the staged diff before the approval-gated commit.
+5. `/simplify` reviews the staged diff before the evidence-backed commit.
+
+<!-- openwolf:begin -->
+# OpenWolf
+
+This project uses OpenWolf for context management. Read and follow .wolf/OPENWOLF.md at session start. Check .wolf/cerebrum.md before generating code. Grep .wolf/anatomy.md for a file's path before reading it (never read the whole index).
+<!-- openwolf:end -->

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src="docs/assets/bizar-banner.svg" alt="Bizar: guarded autonomy for Agent Orchestrator" width="100%" />
+<img src="docs/assets/bizar-banner.svg" alt="Bizar: maximum autonomy for Agent Orchestrator" width="100%" />
 
 [![npm](https://img.shields.io/npm/v/%40polderlabs%2Fbizar?color=0f766e&label=npm)](https://www.npmjs.com/package/@polderlabs/bizar)
 [![license](https://img.shields.io/badge/license-MIT-0f172a)](LICENSE)
@@ -9,7 +9,7 @@
 ![OmniRoute routing](https://img.shields.io/badge/routing-OmniRoute-0ea5e9)
 [![Standalone planning](https://img.shields.io/badge/standalone%20planning-OpenKan-f59e0b)](https://www.npmjs.com/package/@polderlabs/openkan)
 
-### Guarded autonomy for Agent Orchestrator workers
+### Maximum autonomy for Agent Orchestrator workers
 
 Run focused Codex workers under Agent Orchestrator. Bizar supplies their
 repository policy, guardrails, skills, and verification evidence.
@@ -27,9 +27,10 @@ each worker's implementation and verification discipline explicit. AO owns
 multi-agent coordination, worktrees, branches, PR/review/CI feedback, previews,
 and browser state; Bizar does not duplicate those surfaces.
 
-It keeps the operator in control of model selection and high-impact actions.
-AO model choices live in the registered project's AO configuration. Standalone
-Claude aliases live in the global Claude configuration.
+It records evidence and rollback context for high-impact actions while keeping
+execution autonomous by default. AO model choices live in the registered
+project's AO configuration. Standalone Claude aliases live in global Claude
+configuration.
 
 | You want | Bizar provides |
 | --- | --- |
@@ -181,10 +182,10 @@ risk. It does not create parallel workers merely to look busy.
 | --- | --- |
 | Research, planning, implementation, review, verification | Architecture, accessibility, security, tests, documentation, performance, build repair, operations, and domain analysis |
 
-## Guardrails that stay out of the way
+## Evidence that stays in the loop
 
-Bizar is designed to be autonomous for local, reversible work and deliberate
-for consequential actions.
+Bizar executes valid operations autonomously and records stronger evidence and
+rollback context when the effect is consequential.
 
 | Category | Default behavior |
 | --- | --- |
@@ -192,12 +193,12 @@ for consequential actions.
 | Parallel code changes | Uses isolated worktrees and scoped task ownership |
 | Ambiguous material design choice | Asks one concise clarification before execution |
 | Commit | Locally allowed, with a fresh simplify review reminder |
-| Push, PR mutation, release, publish, deploy | Requires an explicit human decision |
-| Rebase, force-push, broad destructive commands | Denied or escalated by the safety floor |
+| Push, PR mutation, release, publish, deploy | Executes when requested and contract-valid; records evidence |
+| Rebase, force-push, broad destructive commands | Executes when requested and contract-valid; advisory context only |
 
-The goal is not to make Claude Code timid. It is to make its boundaries clear:
-Bizar works through local implementation and verification, then stops at the
-point where an external or difficult-to-reverse decision belongs to you.
+The goal is clear request fidelity: invalid targets, schemas, signatures, and
+lifecycle states fail deterministically, while explicit operator restrictions
+remain binding.
 
 ## What gets installed
 

package/cli/banner.mjs

@@ -14,7 +14,7 @@ export function showBanner() {
   console.log(chalk.hex('#6366f1').bold(RUNE_HELM));
   console.log(chalk.hex('#a855f7')('    Guarded autonomous agent system for Claude Code'));
   console.log();
-  console.log(chalk.dim('    84 agents · guarded autonomy · human approval gates · MCP · Skills CLI'));
+  console.log(chalk.dim('    84 agents · maximum autonomy · evidence verification · MCP · Skills CLI'));
   console.log();
 }
 

package/cli/bin.mjs

@@ -103,10 +103,12 @@ function showHelp() {
     update              Update Claude Code, Bizar, and the SDK
     doctor              Check the BizarHarness install for health issues
     repair              Fix common install issues
+    uninstall           Remove Bizar-owned files safely (dry-run supported)
     heads-up <subcommand>  Manage pre-push / pre-release heads-ups
     browser                Install, update, and verify agent-browser
     artifact               Toggle global browser completion artifacts
-    learn                  Manage bounded global preferences and project lessons
+    learn                  Manage bounded global preferences and OpenWolf project memory
+    memory                 Manage OpenWolf project memory/context (current project by default)
     tools                  Inventory installed agents, skills, hooks, commands, and MCP tools
     upgrade-defaults       Reapply safe Bizar-owned Claude defaults
     backup                 Create / list / verify / delete backups of BizarHarness state
@@ -266,6 +268,18 @@ async function main() {
       break;
     }
 
+    case 'uninstall': {
+      const { runUninstall, showUninstallHelp } = await import('./uninstall.mjs');
+      if (isHelpRequest) showUninstallHelp();
+      else {
+        const result = await runUninstall({ dryRun: cmdArgs.includes('--dry-run'), keepState: cmdArgs.includes('--keep-state'), purgeOpenWolfRuntime: cmdArgs.includes('--purge-openwolf-runtime') });
+        for (const path of [...result.removed, ...result.restored]) console.log(`  ${result.dryRun ? 'would change' : 'changed'} ${path}`);
+        for (const path of result.conflicts) console.log(`  ! preserved modified file ${path}`);
+        if (!result.ok) process.exit(EXIT_ERROR);
+      }
+      break;
+    }
+
 
     case 'validate': {
       const mod = await importCommand('validate');
@@ -529,6 +543,13 @@ async function main() {
       break;
     }
 
+    case 'memory': {
+      const mod = await importCommand('openwolf-memory-command');
+      if (!mod) { process.exit(EXIT_ERROR); return; }
+      await mod.run(cmd, cmdArgs, isHelpRequest);
+      break;
+    }
+
     case 'tools':
     case 'upgrade-defaults': {
       const mod = await importCommand(cmd);

package/cli/capabilities.mjs

@@ -0,0 +1,21 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { BIZAR_HOME } from './provision.mjs';
+
+export function readCapabilitySnapshot() {
+  try { return JSON.parse(readFileSync(join(BIZAR_HOME(), 'capabilities.json'), 'utf8')); } catch { return null; }
+}
+
+export function selectAvailableCapabilities(intent, snapshot = readCapabilitySnapshot()) {
+  if (!snapshot) return [];
+  const terms = String(intent || '').toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  return (snapshot.capabilities || [])
+    .filter((capability) => capability.availability === 'available')
+    .map((capability) => ({ capability, score: terms.reduce((score, term) => {
+      const haystack = `${capability.name} ${capability.description || ''} ${(capability.tags || []).join(' ')}`.toLowerCase();
+      return score + (haystack.includes(term) ? 1 : 0);
+    }, 0) }))
+    .filter(({ score }) => score > 0)
+    .sort((a, b) => b.score - a.score)
+    .map(({ capability }) => capability);
+}

package/cli/commands/ao.mjs

@@ -10,7 +10,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { basename, dirname, resolve } from 'node:path';
 
-export const AO_RULES_FILE = '.ao/bizar-worker-rules.md';
+export const AO_RULES_FILE = '.ao/bizar-managed-rules.md';
 export const AO_ORCHESTRATOR_RULES = 'Use AO for coordination and Bizar as the Codex worker harness. Spawn focused AO workers for implementation; workers own changes, verification, commits, and PR follow-up.';
 const WORKER_RULES_TEMPLATE = resolve(dirname(fileURLToPath(import.meta.url)), '../../config/ao/worker-rules.md');
 
@@ -28,6 +28,8 @@ export function parseAoArgs(args = []) {
     project: optionValue(args, '--project'),
     model: optionValue(args, '--model'),
     permissions: optionValue(args, '--permissions'),
+    workerAgent: optionValue(args, '--worker-agent'),
+    orchestratorAgent: optionValue(args, '--orchestrator-agent'),
     help: args.includes('--help') || args.includes('-h') || first === 'help',
   };
 }
@@ -42,8 +44,12 @@ export function defaultProjectId(cwd) {
 }
 
 export function configuredProjectConfig(current = {}, options = {}) {
-  const worker = { ...(current.worker || {}), agent: 'codex' };
-  const orchestrator = { ...(current.orchestrator || {}), agent: 'codex' };
+  const worker = { ...(current.worker || {}) };
+  const orchestrator = { ...(current.orchestrator || {}) };
+  if (!worker.agent) worker.agent = 'codex';
+  if (!orchestrator.agent) orchestrator.agent = 'codex';
+  if (options.workerAgent) worker.agent = options.workerAgent;
+  if (options.orchestratorAgent) orchestrator.agent = options.orchestratorAgent;
   const agentConfig = { ...(current.agentConfig || {}) };
   if (options.model) agentConfig.model = options.model;
   if (options.permissions) agentConfig.permissions = options.permissions;
@@ -165,7 +171,9 @@ export function setupAo(options = {}) {
   projectId ||= defaultProjectId(cwd);
 
   if (!projectDetails) {
-    const added = runAo(['project', 'add', '--path', cwd, '--id', projectId, '--worker-agent', 'codex', '--orchestrator-agent', 'codex'], options);
+    const addArgs = ['project', 'add', '--path', cwd, '--id', projectId];
+    addArgs.push('--worker-agent', options.workerAgent || 'codex', '--orchestrator-agent', options.orchestratorAgent || 'codex');
+    const added = runAo(addArgs, options);
     if (!added.ok) return added;
     const details = runAo(['project', 'get', projectId, '--json'], options);
     if (!details.ok) return details;
@@ -211,6 +219,9 @@ export function run(args = [], options = {}) {
     return true;
   }
   try {
+    if (parsed.subcommand === 'setup' && isAoSession(options.env || process.env) && !options.allowNested) {
+      throw new Error('AO_OWNED_OPERATION: AO setup cannot create competing lifecycle state from an AO worker');
+    }
     let result;
     if (parsed.subcommand === 'setup') result = setupAo({ ...options, ...parsed });
     else if (parsed.subcommand === 'check') result = checkAo(options);

package/cli/commands/improve-proposal.mjs

@@ -37,7 +37,7 @@ import { createHash } from 'node:crypto';
  *   originalSha256: string,
  *   find: string,
  *   newText: string,
- *   verification: { command: string, cwd?: string, timeoutMs?: number, expectedExitCode?: number },
+ *   verification: { command?: string, argv?: string[], cwd?: string, timeoutMs?: number, expectedExitCode?: number },
  *   rollbackPlan: { kind: 'replace-back', note: string } | { kind: 'manual', note: string, manualCommand?: string },
  *   reason: string,
  *   createdAt: string,
@@ -98,8 +98,16 @@ export function validateProposal(raw) {
   if (raw.find === raw.newText) {
     throw new TypeError('Proposal.newText must differ from Proposal.find');
   }
-  if (typeof raw.verification !== 'object' || typeof raw.verification.command !== 'string' || raw.verification.command.length === 0) {
-    throw new TypeError('Proposal.verification.command must be a non-empty string');
+  if (typeof raw.verification !== 'object'
+    || (!Array.isArray(raw.verification.argv) && (typeof raw.verification.command !== 'string' || raw.verification.command.length === 0))) {
+    throw new TypeError('Proposal.verification requires a non-empty argv array or command string');
+  }
+  if (Array.isArray(raw.verification.argv)
+    && (raw.verification.argv.length === 0 || raw.verification.argv.some((arg) => typeof arg !== 'string' || arg.length === 0))) {
+    throw new TypeError('Proposal.verification.argv must contain non-empty strings');
+  }
+  if (typeof raw.verification.command === 'string' && /(?:^|[^\\])(?:;|&&|\|\||`|\$\()/.test(raw.verification.command) && !Array.isArray(raw.verification.argv)) {
+    throw new TypeError('Proposal.verification.command contains shell syntax; use verification.argv');
   }
   if (typeof raw.rollbackPlan !== 'object' || (raw.rollbackPlan.kind !== 'replace-back' && raw.rollbackPlan.kind !== 'manual')) {
     throw new TypeError('Proposal.rollbackPlan.kind must be "replace-back" or "manual"');
@@ -152,4 +160,4 @@ export function planRollback(proposal, currentBytes) {
     return { kind: 'replace-back', newBytes: currentBytes.replace(proposal.newText, proposal.find) };
   }
   return { kind: 'manual', manualCommand: proposal.rollbackPlan.manualCommand };
-}
+}

package/cli/commands/improve.mjs

@@ -56,7 +56,7 @@ import {
   statSync,
   writeFileSync,
 } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { ensureSecureDir } from './secure-dir.mjs';
 import {
@@ -145,19 +145,57 @@ function readCurrentFile({ file, cwd }) {
   return { abs, bytes: readFileSync(abs, 'utf8') };
 }
 
+/** Parse a deliberately small argv form without invoking a shell. */
+export function parseSimpleArgv(command) {
+  if (typeof command !== 'string' || !command.trim()) throw new TypeError('verification command must be non-empty');
+  if (/(?:;|&&|\|\||`|\$\(|>|<|\n|\r)/.test(command)) {
+    throw new TypeError('verification command contains shell syntax; use argv');
+  }
+  const argv = [];
+  let token = '';
+  let quote = null;
+  let escaped = false;
+  for (const char of command.trim()) {
+    if (escaped) { token += char; escaped = false; continue; }
+    if (char === '\\' && quote !== "'") { escaped = true; continue; }
+    if (quote) {
+      if (char === quote) quote = null;
+      else token += char;
+      continue;
+    }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (/\s/.test(char)) {
+      if (token) { argv.push(token); token = ''; }
+      continue;
+    }
+    token += char;
+  }
+  if (escaped || quote || !token && argv.length === 0) throw new TypeError('verification command has unterminated quoting');
+  if (token) argv.push(token);
+  return argv;
+}
+
+function runVerification(verification, cwd) {
+  const verifyCwd = verification.cwd || cwd;
+  const timeout = Number(verification.timeoutMs) || 60_000;
+  const argv = Array.isArray(verification.argv) ? verification.argv : parseSimpleArgv(verification.command);
+  return { result: spawnSync(argv[0], argv.slice(1), { cwd: verifyCwd, encoding: 'utf8', timeout, shell: false }), cwd: verifyCwd };
+}
+
 function doPropose({ flags, cwd }) {
   if (!flags.file || !flags.find || !flags.new || !flags.verify) {
     process.stderr.write('usage: bizar improve propose --file <path> --find <substr> --new <text> --verify <cmd> [--reason <why>]\n');
     process.exit(2);
   }
   const { abs, bytes } = readCurrentFile({ file: flags.file, cwd });
+  const argv = parseSimpleArgv(flags.verify);
   const proposal = {
     id: newProposalId({ targetFile: abs, cwd }),
     targetFile: abs,
     originalSha256: sha256Text(bytes),
     find: flags.find,
     newText: flags.new,
-    verification: { command: flags.verify, cwd, expectedExitCode: 0 },
+    verification: { command: flags.verify, argv, cwd, expectedExitCode: 0 },
     rollbackPlan: { kind: 'replace-back', note: `Reverse the find/newText swap on ${abs}` },
     reason: String(flags.reason ?? '(no reason supplied)'),
     createdAt: new Date().toISOString(),
@@ -218,12 +256,7 @@ function doRun({ flags, cwd }) {
   writeFileSync(abs, plan.newBytes, { mode: statSync(abs).mode & 0o777 });
 
   // Verify.
-  const verifyCwd = proposal.verification.cwd || cwd;
-  const verify = spawnSync('sh', ['-c', proposal.verification.command], {
-    cwd: verifyCwd,
-    encoding: 'utf8',
-    timeout: Number(proposal.verification.timeoutMs) || 60_000,
-  });
+  const { result: verify, cwd: verifyCwd } = runVerification(proposal.verification, cwd);
   const verifyExit = verify.status ?? -1;
   const verifyStdoutSha = sha256Text(verify.stdout ?? '');
   const verifyStderrSha = sha256Text(verify.stderr ?? '');
@@ -245,6 +278,7 @@ function doRun({ flags, cwd }) {
       rolledBackSha256: rollback.kind === 'replace-back' ? sha256Text(rollback.newBytes) : null,
       verification: {
         command: proposal.verification.command,
+        argv: proposal.verification.argv,
         cwd: verifyCwd,
         exitCode: verifyExit,
         stdoutSha256: verifyStdoutSha,
@@ -268,6 +302,7 @@ function doRun({ flags, cwd }) {
     afterSha256: summary.afterSha256,
     verification: {
       command: proposal.verification.command,
+      argv: proposal.verification.argv,
       cwd: verifyCwd,
       exitCode: verifyExit,
       stdoutSha256: verifyStdoutSha,
@@ -286,11 +321,7 @@ function doVerify({ flags, cwd }) {
   }
   const proposalPath = isAbsolute(flags.proposal) ? flags.proposal : resolve(cwd, flags.proposal);
   const proposal = validateProposal(JSON.parse(readFileSync(proposalPath, 'utf8')));
-  const verify = spawnSync('sh', ['-c', proposal.verification.command], {
-    cwd: proposal.verification.cwd || cwd,
-    encoding: 'utf8',
-    timeout: Number(proposal.verification.timeoutMs) || 60_000,
-  });
+  const { result: verify } = runVerification(proposal.verification, cwd);
   process.stdout.write(JSON.stringify({
     ok: (verify.status ?? -1) === (proposal.verification.expectedExitCode ?? 0),
     exitCode: verify.status ?? -1,

package/cli/commands/install.mjs

@@ -24,11 +24,10 @@ export function showInstallHelp() {
   Usage:
     bizar install                       Install (or refresh) every component
     bizar install --dry-run             Print what would happen, change nothing
-    bizar install --force               Full clean install: wipe Bizar-managed dirs,
-                                        back up settings env vars, re-sync everything
-                                        from the repo. Preserves ~/.config/bizar/
-                                        login state. Combine with --yes to skip prompts.
-    bizar install --deep                Alias for --force (clean-install semantics)
+    bizar install --force               Repair Bizar-owned files from the ownership ledger.
+    bizar install --really-reset-global-claude-config
+                                        Explicit emergency reset of the global Claude config.
+    bizar install --deep                Alias for --force (ownership-safe repair)
     bizar install --yes                 Non-interactive install (CI/script friendly)
     bizar install --non-interactive     Alias for --yes
     bizar install --help                Show this help
@@ -38,8 +37,9 @@ export function showInstallHelp() {
     difference is just mode=install vs mode=update. Every step is
     idempotent — running this twice is safe.
 
-    F-183 (v10.16.2+) — --force promotes the install from
-    overwrite+prune-stale to a fully clean install. It wipes:
+    Ownership-safe repair means --force removes/replaces only unchanged files
+    recorded by Bizar. It preserves user and third-party siblings. The explicit
+    emergency flag is the only path that wipes:
       - ~/.claude/{agents,skills,commands,hooks,rules,workflows,plugins}/
       - ~/.agents/ (shared skill-registry + lock)
       - ~/.claude/settings.json (env vars backed up to BIZAR_SAVED_ENV)
@@ -69,7 +69,8 @@ export function showInstallHelp() {
        URL and key only when they are not already configured. Fresh setups
        can also choose a default model, agent teams, OpenKan home, and whether
        to initialise the current project's .ok/ workspace.
-    9. Runs 'bizar doctor' as a post-install health check.
+    9. Required invariants are checked during provisioning; use 'bizar doctor'
+       explicitly for the full diagnostic.
 
     Provider settings are global (~/.claude/settings.json), so they work from
     every project. Key input is hidden. Use --yes or --non-interactive to skip
@@ -86,9 +87,8 @@ export function showUpdateHelp() {
   Usage:
     bizar update                       Refresh every Bizar-managed surface
     bizar update --dry-run             Print what would happen, change nothing
-    bizar update --force | --deep      Full clean re-emit: wipe Bizar-managed
-                                        dirs, back up settings env vars,
-                                        re-sync everything from the repo
+    bizar update --force | --deep      Ownership-safe repair of Bizar-managed
+                                        files from the ledger
     bizar update --yes | -y            Assume yes for any non-destructive prompt
     bizar update --non-interactive     Alias for --yes
     bizar update --help                Show this help
@@ -100,18 +100,15 @@ export function showUpdateHelp() {
     1. Ensures the bundled default OpenKan planning runtime is present and current.
     2. Re-emits skills, commands, rules, hooks, agents, and workflows
        from the repo source into ~/.claude/ (or $CLAUDE_CONFIG_DIR),
-       overwriting only the Bizar-managed surface and pruning stale
-       entries (F-141).
+       overwriting only the Bizar-managed surface and pruning unchanged
+       ledger-owned stale entries.
     3. Writes the install marker so subsequent runs short-circuit when
        nothing has changed.
-    4. With --force, re-runs the F-183 clean-install flow: wipes
-       ~/.claude/{agents,skills,commands,hooks,rules,workflows,plugins}/
-       and ~/.agents/, stashes the prior settings.json env block into
-       BIZAR_SAVED_ENV, then re-emits settings.json with the operator's
-       ANTHROPIC_* and BIZAR_* keys union-merged back in (so gateway
-       URL, auth token, and BIZAR_HOME are preserved across the wipe).
-    5. Runs 'bizar doctor' after a successful update so config
-       regressions surface before the next Claude Code session.
+    4. With --force, repairs only unchanged files recorded in the ownership
+       ledger. The emergency global reset option is intentionally documented
+       on bizar install, not routine updates.
+    5. Runs the narrow installer invariants; use 'bizar doctor' for the full
+       diagnostic when needed.
     6. Repairs stale bin symlinks so the operator picks up the new code
        on the next shell prompt.
 
@@ -150,13 +147,19 @@ export function showUpdateHelp() {
 async function runPostInstallerRepair({ runRepair: runRepairDep = runRepair } = {}) {
   try {
     const r = await runRepairDep({});
+    if (r?.ok === false) {
+      console.error(chalk.red(`  ✗ Repair failed: ${(r?.notes || []).join(' ') || 'active bizar could not be verified'}`));
+      return r;
+    }
     if (r.fixed.length > 0) {
       console.log(chalk.cyan('\n  Repair: repointed stale bin symlinks:'));
       for (const f of r.fixed) console.log(`    ${f}`);
       console.log(chalk.dim('    Re-run your shell or `hash -r` to pick up the new path.'));
     }
+    return r;
   } catch (err) {
     console.log(chalk.dim(`  Repair skipped: ${err.message}`));
+    return { ok: false, error: err.message };
   }
 }
 
@@ -171,8 +174,8 @@ export async function install(args, isHelpRequest) {
   // parser for the installer family. Reusing it keeps install and
   // update in lockstep on flag semantics. --deep is parsed as an
   // alias for --force (clean-install semantics, F-183).
-  const { mode, dryRun, force, yes } = parseFlags(args);
-  const result = await runInstaller({ mode, dryRun, force, yes });
+  const { mode, dryRun, force, reallyResetGlobalClaudeConfig, yes } = parseFlags(args);
+  const result = await runInstaller({ mode, dryRun, force, reallyResetGlobalClaudeConfig, yes });
   // F-183 — print a one-line summary of the wipe scope so operators
   // can see at a glance what changed without re-reading the verbose
   // step list.
@@ -186,10 +189,10 @@ export async function install(args, isHelpRequest) {
   }
   // v4.4.3 — After install, repair any stale bin symlinks so the
   // user picks up the new code.
-  await runPostInstallerRepair();
+  const repairResult = await runPostInstallerRepair();
   // v10.19.6 — propagate install failure to the parent shell so
   // `bizar install && bizar doctor` short-circuits on install errors.
-  if (!result?.ok) process.exit(1);
+  if (!result?.ok || repairResult?.ok === false) process.exit(1);
 }
 
 export async function update(args, isHelpRequest) {
@@ -197,6 +200,16 @@ export async function update(args, isHelpRequest) {
     showUpdateHelp();
     return;
   }
+  const versionIndex = args.indexOf('--version');
+  if (versionIndex >= 0) {
+    const version = args[versionIndex + 1];
+    const artifactIndex = args.indexOf('--artifact-dir');
+    const artifactDir = artifactIndex >= 0 ? args[artifactIndex + 1] : undefined;
+    const { runVerifiedUpdate } = await import('../update.mjs');
+    const result = await runVerifiedUpdate(args, { artifactDir });
+    if (!result?.ok) process.exit(1);
+    return;
+  }
   // v10.19.6 — route update through the same flag-parsing + installer
   // pipeline as install so `--dry-run`, `--force`, `--yes`, etc. do
   // what they claim. See `runUpdateWithFlags` for the testable
@@ -232,9 +245,12 @@ export async function runUpdateWithFlags({
   parseFlags: parseFlagsDep = parseFlags,
   runRepair: runRepairDep = runRepair,
 } = {}) {
-  const { mode, dryRun, force, yes } = parseFlagsDep(args);
-  const result = await runInstallerDep({ mode, dryRun, force, yes });
-  await runPostInstallerRepair({ runRepair: runRepairDep });
+  const { mode, dryRun, force, reallyResetGlobalClaudeConfig, yes } = parseFlagsDep(args);
+  const installerOpts = { mode, dryRun, force, yes };
+  if (reallyResetGlobalClaudeConfig) installerOpts.reallyResetGlobalClaudeConfig = true;
+  const result = await runInstallerDep(installerOpts);
+  const repairResult = await runPostInstallerRepair({ runRepair: runRepairDep });
+  if (repairResult && repairResult.ok === false) process.exit(1);
   if (!result?.ok) process.exit(1);
   return result;
 }