@rig-c/create 1.2.1 → 1.3.0

package/docs/CHECKS.md

@@ -24,7 +24,7 @@ requires Bun 1.4 or later. See [Live review](LIVE-REVIEW.md).
 
 | Code | Finding and remedy |
 | --- | --- |
-| `JOB_PUBLISH_PENDING` | A committed `project.json` result awaits publication. Restore its bound host and sources, then run `job reconcile` before another participating write or close. |
+| `JOB_PUBLISH_PENDING` | A committed `project.json` result awaits publication. Restore its bound host and sources, then run `job reconcile` before another participating write or close. To abandon failed publications explicitly, `job close --retire-refused` archives their complete receipts under the private `retired-publications/` directory and closes without acknowledging them; unfailed pending publications still block close. |
 | `JOB_ROOT_REPLACED` | `project.json`: the managed Review state belongs to a replaced project directory, or its ownership/liveness cannot be established safely. Stop the original `job open` host in its terminal, then retry `job open` or `job reconcile`. With no pending publication or startup claim, both commands preserve the old state in a dated `.replaced-…` sibling only when its recorded PID is absent and its recorded loopback port refuses connections. Missing/unsafe metadata, an occupied port or uncertain liveness refuses without retiring state; restore the retained metadata or original directory before retrying. |
 | `JOB_HOST_ATTACH_REFUSED` | Strict reuse-only attach to the bound live host was refused. The pending receipt names the host `reason` and `phase` (including `incarnation-missing` on `record` or `probe`). Reopen or restore the bound live host before reconciling. |
 | `JOB_HOST_REUSE_MISMATCH` | The private binding's host tuple or `listenerIncarnation` (`jobId`, `origin`, `listenerIncarnation`, `root`, `stateDir`, `fingerprint`, `reviewer.id`, `reviewer.role`, `readerId`, `bindingId`, `partsEnumeratorId`, `partsEnumeratorVersion`, `apiSchema`, `actSchema`, `port`) differs. The pending receipt names the `field` and both `expected` and `actual` values. Restore the original host configuration before reconciling. |
@@ -1717,3 +1717,10 @@ checks remain in force; no source measurement is recomputed.
 new placement. Re-signing or adopting the split order on a later date alone
 does not retrofit it into historical interviews. Missing `turn` on an adopted
 interview is the existing `WAYPOINT_MISSING` refusal.
+
+### Relayed owner chat
+
+| Code | Meaning and remedy |
+| --- | --- |
+| `OWNER_CHAT_INVALID` | The named project.json answer/signoff lacks exact nonblank owner words, a valid explicit ISO said_at, relay identity, or the relayed source, or mixes chat and Review flags. Supply `--owner-chat`, `--said-at`, `--relayed-by` and owner `--by` together; keep at as the write time and omit act ids. |
+| `OWNER_CHAT_GATE_VISUAL` | The named project.json stage signoff has no accepted live verdict for the current draft, rig or post. Get the verdict first in the review tool with `job open --draft <id>` or `job open --rig <n>`, ingest it, then relay the signoff. |

package/docs/INTERVIEW.md

@@ -903,3 +903,23 @@ screens a corpus reproduction away. A new report needs a fresh shown set
 and explicit choice; the old choice and set remain history. Choices are
 local, never inherited from a collection. They may be recorded only in
 parts, but later signatures do not make a pending optional choice invalid.
+
+### Relayed owner chat
+
+All interview questions may use `interview-answer --owner-chat <words file>
+--said-at <ISO date> --relayed-by <operator> --by <owner>` alongside the
+existing `--set`, `--sha256` and explicit `--pick` flags. Shared context images
+are background and do not change this route. The writer retains generated
+pick text in `verbatim`, exact UTF-8 chat in `owner_words`, the owner's original
+`said_at`, the relay's `relayed_by`, and source `owner chat, relayed`.
+`at` remains the write time; no review act id is created. Empty or whitespace
+words, missing clocks or relay identity, and agent owners are refused.
+If options ever carry their own images, those sets leave the chat path;
+that requires a new Review contract outside this change.
+
+Stage signoffs use the same flags, retaining the exact words in `verbatim`.
+Parts-review, rig-review and direction-review first require the current
+accepted live verdict from the review tool; changes-requested does not count.
+Get that verdict with `job open --draft <id>` (parts) or `job open --rig <n>`
+(rig/post), then ingest it through the existing verdict writer. Verdict writers
+have no owner-chat route. Review remains available for picks and signoffs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rig-c/create",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "type": "module",
   "description": "Create a rig project: its folder, decision record, repository and pinned rig-c packages",
   "license": "MIT",

package/src/check.ts

@@ -1,3 +1,4 @@
+import { ownerChatFinding } from './owner-chat.ts';
 import { packageUpgradeFindings } from './package-upgrades.ts';
 import { checkPublicationGenerations } from './job-publication.ts';
 import { collectBarAmendments, effectiveBar } from './plan-bar-amendments.ts';
@@ -1001,6 +1002,15 @@ function checkProjectOnce(projectDirArg: string, candidate: JsonObject | undefin
   if (!hasStageOrder(project)) warnings.push(STAGE_ORDER_LEGACY_FINDING);
   checkInputs(ctx);
   checkChoices(ctx);
+  const checkChat = (value: Json | undefined, path: string): void => {
+    if (Array.isArray(value)) value.forEach((entry, index) => checkChat(entry, `${path}[${index}]`));
+    else if (isObject(value)) {
+      const finding = ownerChatFinding(value, path);
+      if (finding) ctx.refusals.push(finding);
+      for (const [key, entry] of Object.entries(value)) checkChat(entry, `${path}.${key}`);
+    }
+  };
+  checkChat(project, 'project.json');
   if (!options.recordPublication) checkCorrections(ctx, options.now);
   if (!options.recordPublication) checkScenes(ctx);
   if (!options.recordPublication) checkDirections(ctx, options.now);

package/src/choice-writers.ts

@@ -1,3 +1,4 @@
+import { OWNER_CHAT_FLAGS, readOwnerChat } from './owner-chat.ts';
 import { overrideFindings } from './overrides.ts';
 import { intakeItem, intakeWarnings, INTAKE_QUESTION } from './intake.ts';
 /** Public record writers; validation precedes every project write. */
@@ -20,6 +21,7 @@ interview-options --adopt [<dir>]
 interview-answer <question> [<dir>] --from-review <actId> [--why-file <file>]
 interview-answer <question> [<dir>] --set <path> --sha256 <shown sha> --by <human>
   [--pick <ask>=<option>...] [--other <ask>=<file> --other-fragment <ask>=<JSON file>]...
+  [--owner-chat <words file> --said-at <ISO date> --relayed-by <who>]
   [--note-file <file>] [--source <location>] [--why-file <file> for a member override]
 interview-decision <question> [<dir>] --by <agent> --reasoning-file <file>
   --fragment <ask>=<JSON file>...
@@ -139,8 +141,10 @@ export interface InterviewAnswerHooks {
 }
 export function interviewAnswerCommand(args: string[], now: number, hooks: InterviewAnswerHooks = {}): string { return run(() => {
   if (args.includes('--picks-file')) refuse('INTERVIEW_PICKS_FILE_REMOVED', 'project.json: --picks-file was removed; use interview-answer <question> --from-review <actId>', USAGE_EXIT);
-  const opts = parse(args,['--set','--sha256','--by','--note-file','--source','--from-review','--why-file'],['--pick','--other','--other-fragment']);
+  const opts = parse(args,['--set','--sha256','--by','--note-file','--source','--from-review','--why-file',...OWNER_CHAT_FLAGS],['--pick','--other','--other-fragment']);
   if (opts.positional.length > 2 || (!opts.one['--from-review'] && (!opts.one['--set'] || !opts.one['--sha256'] || !opts.one['--by']))) usage('question and --from-review, or --set/--sha256/--by required');
+  if (opts.one['--owner-chat'] !== undefined && opts.one['--by']?.toLowerCase() === 'agent') refuse('INTERVIEW_CHOICE_INVALID', 'project.json.interview: --by must name the owner; relay owner words without claiming agent authority');
+  const chat = readOwnerChat(opts.one, opts.one['--by'] ?? '', now, 'project.json.interview');
   const dir = resolve(opts.positional[1] ?? process.cwd());
   const release = acquireBoundJobWrite(dir);
   try {
@@ -208,6 +212,7 @@ export function interviewAnswerCommand(args: string[], now: number, hooks: Inter
     else if (opts.one['--note-file']) choice.note = readText(opts.one['--note-file']);
     const result = selection(set,choice);
     const answer: JsonObject = {delegated:result.delegated,by:payload?.by ?? opts.one['--by'],at:payload?.at ?? new Date(now).toISOString(),verbatim:choiceVerbatim(picks,choice.note),source:opts.one['--source'] ?? 'review questionnaire',choice,asks:result.asks};
+    if (chat) { answer.owner_words = chat.owner_words!; answer.said_at = chat.said_at!; answer.relayed_by = chat.relayed_by!; answer.source = chat.source!; }
     if (result.value !== undefined) answer.value = result.value;
     if (result.autos.length) answer.agent_decision = {covers:result.autos.join(',')};
     if (isObject(item.raw) && typeof item.raw.basis === 'string') answer.basis = item.raw.basis === 'inherited' ? (item.state.state === 'silent' ? 'own' : 'overridden') : item.raw.basis;

package/src/cli.ts

@@ -51,7 +51,7 @@ Usage:
   rig-create republish <rig> [<dir>] --reason <words>
   rig-create job open [<dir>] --reviewer <id> --role owner|delegate [--draft <id> | --rig <n> | --question <question> | --plan]
   rig-create job acts [<dir>] [--json]          list finalized acts and their ingest commands
-  rig-create job reconcile|close [<dir>]
+  rig-create job reconcile|close [<dir>] [--retire-refused (close only)]
 ${INPUT_CLI}  rig-create init <dir> [--no-install]              create a project folder, its repository and pinned packages
   rig-create init <dir> --painting <file> --origin <words> [--projects-root <dir>] [--same-artwork-reason <file>]
                                                     also register the painting; refuse a second project for one artwork
@@ -310,6 +310,7 @@ export function main(argv: string[], now: number): number {
           if (!value || value.startsWith('-') || options[arg]) refuse('JOB_BINDING_INVALID', 'project.json: job open requires one value for each reviewer option', USAGE_EXIT);
           options[arg] = value;
         } else if (action === 'open' && arg === '--plan' && !options[arg]) options[arg] = 'true';
+        else if (action === 'close' && arg === '--retire-refused' && !options[arg]) options[arg] = 'true';
         else if (action === 'acts' && arg === '--json' && !options[arg]) options[arg] = 'true';
         else if (arg.startsWith('-')) refuse('JOB_BINDING_INVALID', 'project.json: unsupported job option; see help', USAGE_EXIT);
         else positional.push(arg);
@@ -320,7 +321,7 @@ export function main(argv: string[], now: number): number {
       if (['--draft', '--rig', '--question', '--plan'].filter(flag => options[flag] !== undefined).length > 1) {
         refuse('JOB_BINDING_INVALID', 'project.json: job open takes one of --draft, --rig, --question or --plan; choose one recorded result', USAGE_EXIT);
       }
-      const stdin = Buffer.from(JSON.stringify({ root: positional[0] ?? process.cwd(), reviewer: options['--reviewer'], role: options['--role'], draft: options['--draft'], rig: options['--rig'], question: options['--question'], plan: options['--plan'] === 'true', json: options['--json'] === 'true', now }));
+      const stdin = Buffer.from(JSON.stringify({ root: positional[0] ?? process.cwd(), reviewer: options['--reviewer'], role: options['--role'], draft: options['--draft'], rig: options['--rig'], question: options['--question'], plan: options['--plan'] === 'true', json: options['--json'] === 'true', retireRefused: options['--retire-refused'] === 'true', now }));
       const runtime = join(import.meta.dir, 'job-runtime.ts');
       if (action === 'open') {
         const child = Bun.spawn(jobRuntimeCommand(action, runtime), {

package/src/job-close.ts

@@ -13,6 +13,7 @@ import {
   acquireJobLock,
   JOB_BINDING_FILE,
   pendingPublications,
+  retireRefusedPublications,
   readWriterBinding,
   type JobIdentity,
   type WriterBinding,
@@ -181,12 +182,14 @@ export async function attachCreateJobForClose(
 export async function closeCreateJob(
   root: string,
   startHost: (options: JobHostOptions) => Promise<JobOwnerHost> = startJobHost,
+  retireRefused = false,
 ): Promise<void> {
   root = realpathSync(root);
   const release = acquireJobLock(root)!;
   try {
-    if (pendingPublications(root).length) {
-      refuse('JOB_PUBLISH_PENDING', 'project.json: a committed publication remains pending; run rig-create job reconcile before closing');
+    const pending = pendingPublications(root);
+    if (pending.length && (!retireRefused || pending.some(entry => !entry.failure))) {
+      refuse('JOB_PUBLISH_PENDING', 'project.json: a committed publication remains pending; run rig-create job reconcile, or job close --retire-refused to archive failed publications and close without publishing them');
     }
     const binding = readWriterBinding(root);
     if (!binding) refuse('JOB_BINDING_INVALID', 'project.json: no writer-owned job binding; open the live job first');
@@ -216,6 +219,7 @@ export async function closeCreateJob(
       if (!current || !isDeepStrictEqual(current, binding)) {
         refuse('JOB_BINDING_INVALID', 'project.json: private live-job binding changed during close; restore the writer-owned binding');
       }
+      if (retireRefused) retireRefusedPublications(root, pending);
       rmSync(join(root, JOB_BINDING_FILE));
     } finally {
       host.stop();

package/src/job-host.ts

@@ -369,7 +369,7 @@ async function reconcileLocked(root: string, publish: (entry: PendingPublication
       const failure = error instanceof Refusal ? { code: error.code, message: error.message }
         : { code: 'JOB_PUBLISH_PENDING', message: 'project.json: host publication failed; restore the live host before rig-create job reconcile' };
       failPublication(root, entry, failure);
-      refuse('JOB_PUBLISH_PENDING', `project.json: record ${entry.recordHash} remains pending (${failure.code}: ${failure.message}); run rig-create job reconcile`);
+      refuse('JOB_PUBLISH_PENDING', `project.json: record ${entry.recordHash} remains pending (${failure.code}: ${failure.message}); run rig-create job reconcile after restoring the sources, or job close --retire-refused to archive failed publications and close without publishing them`);
     }
   }
   return { count: entries.length, outcomes };

package/src/job-outbox.ts

@@ -302,6 +302,18 @@ export function failPublication(root: string, entry: PendingPublication, failure
   writePrivateJson(pendingPath(root, entry.id), { ...entry, failure });
 }
 
+/** Explicit close recovery retains the complete failed receipt; it never acknowledges publication. */
+export function retireRefusedPublications(root: string, entries: PendingPublication[]): void {
+  for (const entry of entries) {
+    if (!entry.failure) refuse('JOB_PUBLISH_PENDING', 'project.json: an unfailed publication cannot be retired; run rig-create job reconcile first');
+    const directory = join(jobPrivateRoot(root), 'retired-publications');
+    privateDirectory(directory);
+    writePrivateJson(join(directory, `${entry.id}.json`), entry);
+    rmSync(pendingPath(root, entry.id));
+    syncDirectory(join(jobPrivateRoot(root), 'outbox'));
+  }
+}
+
 export async function reconcilePublication(root: string, entry: PendingPublication,
   publish: (entry: PendingPublication) => Promise<unknown>): Promise<void> {
   if (currentVersionHash(root, entry) !== entry.versionHash) {

package/src/job-publication.ts

@@ -328,8 +328,13 @@ export function readRecordPublished({ root, record, result, phase, parts: sealed
     return { label, parts, inputs, files, ...evidence,
       plan: { steps: steps.map(step => ({ id: String(step.id), hash: stepHash(step) })) }, subjects };
   } catch (error) {
-    if (error instanceof Refusal && (phase === 'retained' || ['JOB_RECORD_SUBJECT_INVALID', 'JOB_RECORD_COLLECTION_EXTERNAL', 'JOB_RECORD_PARTS_LOCK_MISSING', 'JOB_DIRECTION_VERDICT_REQUIRED', 'REVIEW_ACT_RECORD_TARGET_INVALID', 'REVIEW_ACT_TARGET_MISMATCH', 'INTERVIEW_SIGNOFF_NOT_CLEAN', 'INTERVIEW_SIGNOFF_PLAN_REQUIRED'].includes(error.code))) throw error;
-    refuse('JOB_RECORD_INCOMPLETE', `project.json: ${error instanceof Error ? error.message : String(error)}; restore the requested record and retained evidence, resolve check refusals and reconcile pending publications before publishing`);
+    const failure = error instanceof Refusal && (phase === 'retained' || ['JOB_RECORD_SUBJECT_INVALID', 'JOB_RECORD_COLLECTION_EXTERNAL', 'JOB_RECORD_PARTS_LOCK_MISSING', 'JOB_DIRECTION_VERDICT_REQUIRED', 'REVIEW_ACT_RECORD_TARGET_INVALID', 'REVIEW_ACT_TARGET_MISMATCH', 'INTERVIEW_SIGNOFF_NOT_CLEAN', 'INTERVIEW_SIGNOFF_PLAN_REQUIRED'].includes(error.code))
+      ? error
+      : new Refusal('JOB_RECORD_INCOMPLETE', `project.json: ${error instanceof Error ? error.message : String(error)}; restore the requested record and retained evidence, resolve check refusals and reconcile pending publications before publishing`);
+    // Review returns only a safe producer token. Its retained root is private and may
+    // be removed on refusal, so report here in the host terminal before it is lost.
+    if (phase === 'retained') console.error(`${failure.code}: ${failure.message}`);
+    throw failure;
   }
 }
 
@@ -608,8 +613,21 @@ export function prepareDraftManifest(root: string, project: JsonObject, id: stri
   if (existsSync(join(root, path))) {
     const existing = publicationFile(root, path);
     if (!existing.equals(bytes)) {
-      if (!existing.equals(legacyPanelsBytes) && !existing.equals(legacyBytes)) {
-        refuse('JOB_PUBLICATION_INVALID', `drafts[${id}]: retained publication manifest differs; restore it before reconciling`);
+      let orphaned = false;
+      try {
+        const retained: unknown = JSON.parse(existing.toString('utf8'));
+        if (isObject(retained as Json)) {
+          const prior = retained as JsonObject;
+          const revisions = asArray(project.drafts).filter(isObject).map(item => jobHash(`${JSON.stringify(item, null, 2)}\n`));
+          orphaned = prior.schema === 'rig-review/1' && prior.id === `create-draft-${id}`
+            && typeof prior.revision === 'string' && /^[a-f0-9]{64}$/.test(prior.revision)
+            && !revisions.includes(prior.revision)
+            && !pendingPublications(root).some(entry => !isRecordResult(entry.result)
+              && entry.result.path === path && entry.versionHash === prior.revision);
+        }
+      } catch { /* An unreadable manifest is never evidence of an orphaned revision. */ }
+      if (!existing.equals(legacyPanelsBytes) && !existing.equals(legacyBytes) && !orphaned) {
+        refuse('JOB_PUBLICATION_INVALID', `drafts[${id}]: retained publication manifest differs; restore it before reconciling, or run rig-create job close --retire-refused to retire a refused publication`);
       }
       const target = join(root, path);
       const tmp = `${target}.${process.pid}-${crypto.randomUUID()}.tmp`;

package/src/job-runtime.ts

@@ -17,7 +17,7 @@ export function publicationFailure(error: unknown, root: string): Refusal | unde
 }
 
 async function run(): Promise<void> {
-  const input = JSON.parse(readFileSync(0, 'utf8')) as { root: string; id?: string; reviewer?: string; role?: 'owner' | 'delegate'; draft?: string; rig?: string; question?: string; plan?: boolean; now: number; json?: boolean };
+  const input = JSON.parse(readFileSync(0, 'utf8')) as { root: string; id?: string; reviewer?: string; role?: 'owner' | 'delegate'; draft?: string; rig?: string; question?: string; plan?: boolean; now: number; retireRefused?: boolean; json?: boolean };
   const root = resolve(input.root);
   switch (process.argv[2]) {
     case 'publish': {
@@ -43,7 +43,7 @@ async function run(): Promise<void> {
       break;
     }
     case 'reconcile': console.log(`job: reconciled ${await reconcileCreateJob(root, undefined, input.now)} publication(s)`); break;
-    case 'close': await closeCreateJob(root); console.log('job: closed'); break;
+    case 'close': await closeCreateJob(root, undefined, input.retireRefused); console.log('job: closed'); break;
     case 'open': {
       if (!input.reviewer || !input.role) refuse('JOB_BINDING_INVALID', 'project.json: job open needs --reviewer and --role owner|delegate');
       requestedRecordResult(root, input.question, input.plan, input.now);

package/src/next.ts

@@ -1,3 +1,5 @@
+import { optionFile } from './choices.ts';
+import { ownerChatSignoffAllowed } from './owner-chat.ts';
 import { checkpointEnabled, checkpointRequired } from './plan-history.ts';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from './check-reads.ts';
@@ -238,7 +240,24 @@ function reviewCommands(dir: string, project: JsonObject, move: NextMove): NextM
     role: 'agent', field: move.field, awaits: move.awaits, command, act: description,
   });
   const root = shellWord(dir);
+  const chatMoves: NextMove[] = [];
+  const chatFlags = "--by '<owner>' --owner-chat '<words file>' --said-at '<ISO date>' --relayed-by '<operator>'";
+  if (act.kind === 'signoff' && ownerChatSignoffAllowed(dir, project, act.stage, act.draft_id, act.version_id?.slice(1))) {
+    const version = act.stage === 'rig-review' || act.stage === 'direction-review' ? ` --version ${shellWord(act.version_id?.slice(1) ?? '<current-version>')}` : '';
+    chatMoves.push({...move, command:`rig-create ${writer} ${root}${version} ${chatFlags}`, act:`${move.act}; or relay the owner chat signoff with exact words, owner date and relay identity`, review_act:undefined});
+  } else if (act.kind === 'interview-picks' && act.question_id) {
+    const item = collectItems(project, {collection:loadCollection(dir)}).find(item => item.id === act.question_id);
+    const binding = item?.record.pending_options;
+    if (isObject(binding) && typeof binding.path === 'string' && typeof binding.sha256 === 'string') {
+      try {
+        const {set} = optionFile(dir,binding);
+        const picks = asArray(set.asks).filter(isObject).map(ask => ` --pick ${shellWord(`${String(ask.id)}=<option-id>`)}`).join('');
+        chatMoves.push({...move, command:`rig-create ${writer} ${root} --set ${shellWord(binding.path)} --sha256 ${shellWord(binding.sha256)} ${chatFlags}${picks}`, act:`${move.act}; or relay the owner chat answer and explicit option ids from the displayed set`, review_act:undefined});
+      } catch { /* The check's named option-file refusal supplies the repair route. */ }
+    }
+  }
   return [
+    ...chatMoves,
     agent(`rig-create job open ${root} ${selector} --reviewer '<reviewer>' --role owner`, 'host this Review page; keep the host running in a separate terminal until job close'),
     move,
     agent(`rig-create job acts ${root} --json`, `after the person submits in Review, list exported acts and use the matching actId below${act.stage === 'parts-review' ? '; run its reported preconditions before ingestion (parts-review signoff includes structure-snapshot)' : ''}`),

package/src/owner-chat.ts

@@ -0,0 +1,67 @@
+/** Relayed words retain their own clock; at remains the writer's clock. */
+import { asArray, isObject, type Finding } from './check.ts';
+import { latestPartsReceipt, latestPartsVerdictFinding, recordedPartsVerdict } from './parts-verdict-record.ts';
+import { decodeReviewAct } from './review-act.ts';
+import { readVerbatim } from './record-input.ts';
+import { acceptedReviewVerdict, readVersions } from './review.ts';
+import { collectReopens, liveSignoff } from './reopen.ts';
+import { refuse, USAGE_EXIT } from './refusal.ts';
+import type { JsonObject } from './templates.ts';
+
+export const OWNER_CHAT_SOURCE = 'owner chat, relayed';
+export const OWNER_CHAT_FLAGS = ['--owner-chat', '--said-at', '--relayed-by'];
+const nonblank = (value: unknown): value is string => typeof value === 'string' && value.trim() !== '';
+
+export function ownerChatFinding(record: JsonObject, path: string): Finding | undefined {
+  if (record.source !== OWNER_CHAT_SOURCE && record.said_at === undefined && record.relayed_by === undefined && record.owner_words === undefined) return;
+  const said = record.said_at;
+  if (record.source !== OWNER_CHAT_SOURCE || !nonblank(record.owner_words ?? record.verbatim)
+    || !nonblank(record.by) || record.by.toLowerCase() === 'agent' || !nonblank(record.relayed_by)
+    || typeof said !== 'string' || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$/.test(said)
+    || !Number.isFinite(Date.parse(said)) || !Number.isFinite(Date.parse(String(record.at)))
+    || Date.parse(said) > Date.parse(String(record.at)) || record.actId !== undefined || record.act_id !== undefined) {
+    return {code:'OWNER_CHAT_INVALID',path,message:`${path}: relayed owner chat needs exact nonblank words, owner identity, ISO said_at, relayed_by and a separate write at without an act id; record the owner's words with --owner-chat --said-at --relayed-by`};
+  }
+}
+
+export function readOwnerChat(opts: Record<string,string>, by: string, now: number, path: string): JsonObject | undefined {
+  if (!OWNER_CHAT_FLAGS.some(flag => opts[flag] !== undefined)) return;
+  if (OWNER_CHAT_FLAGS.some(flag => !nonblank(opts[flag]))) refuse('OWNER_CHAT_INVALID', `${path}: --owner-chat, --said-at and --relayed-by are required together; supply the words file and explicit owner clock and relay`, USAGE_EXIT);
+  if (opts['--from-review'] !== undefined || opts['--verbatim-file'] !== undefined || opts['--source'] !== undefined) refuse('OWNER_CHAT_INVALID', `${path}: owner chat excludes --from-review, --verbatim-file and --source; retain the relayed source`, USAGE_EXIT);
+  const record: JsonObject = {by, at:new Date(now).toISOString(), owner_words:readVerbatim(opts['--owner-chat']!),
+    said_at:opts['--said-at']!,relayed_by:opts['--relayed-by']!,source:OWNER_CHAT_SOURCE};
+  const finding = ownerChatFinding(record,path);
+  if (finding) refuse(finding.code,finding.message);
+  return record;
+}
+
+/** Select the current subject as next does, then require an accepted verdict still live at this review stage. */
+export function ownerChatSignoffAllowed(dir: string, project: JsonObject, stage: string, draft?: string, version?: string): boolean {
+  const reopens = collectReopens(project,[]);
+  if (stage === 'parts-review') {
+    const current = asArray(project.drafts).filter(isObject).at(-1);
+    if (!current || typeof current.id !== 'string' || (draft !== undefined && draft !== current.id)) return false;
+    const receipt = latestPartsReceipt(project,current.id);
+    if (!receipt || latestPartsVerdictFinding(project,current.id,'signoffs.draft_id')) return false;
+    try {
+      const at = receipt.schema === 'rig-create/review-act@1' ? decodeReviewAct(String(receipt.bytes),'parts-verdict').at : receipt.at;
+      if (!Number.isFinite(Date.parse(String(at))) || !liveSignoff(reopens,'parts-review',Date.parse(String(at)))) return false;
+      recordedPartsVerdict(dir,project,current.id); return true;
+    } catch { return false; }
+  }
+  if (stage !== 'rig-review' && stage !== 'direction-review') return true;
+  const phase = stage === 'rig-review' ? 'rigging' : 'post';
+  const current = asArray(project.versions).filter(isObject).filter(v => v.kind === (stage === 'rig-review' ? 'rig' : 'post')
+    && (stage === 'rig-review' || liveSignoff(reopens,phase,Date.parse(String(v.at))))).at(-1);
+  if (!current || (version !== undefined && String(current.n) !== version)) return false;
+  if (stage === 'rig-review' && !readVersions(project).rigs.some(rig => rig.n === current.n && rig.live)) return false;
+  const index = acceptedReviewVerdict(current,stage);
+  const verdict = asArray(current.verdicts)[index];
+  return isObject(verdict) && liveSignoff(reopens,stage,Date.parse(String(verdict.at)));
+}
+
+export function assertOwnerChatSignoff(dir: string, project: JsonObject, stage: string, draft?: string, version?: string): void {
+  if (ownerChatSignoffAllowed(dir,project,stage,draft,version)) return;
+  const route = stage === 'parts-review' ? '--draft <current-draft>' : '--rig <current-version>';
+  refuse('OWNER_CHAT_GATE_VISUAL', `project.json.signoffs.${stage}: an accepted live verdict for the current subject is required; get the verdict in the review tool first with rig-create job open ${route}, ingest it, then relay the owner's signoff`);
+}

package/src/parts-sections.ts

@@ -46,8 +46,13 @@ export class PartsUnreadable extends Error {
   }
 }
 
-/** The create repository's own install, used when a project has none (running the check in this repo, or before `bun install` in a project). */
-export const OWN_NODE_MODULES = join(import.meta.dir, '..', 'node_modules');
+const load = createRequire(import.meta.url);
+
+/** Create's runtime-resolved dependency install, used when a project has none (running the check in this repo, or before `bun install` in a project). */
+const checkoutNodeModules = join(import.meta.dir, '..', 'node_modules');
+export const OWN_NODE_MODULES = existsSync(join(checkoutNodeModules, PARTS_PACKAGE, 'package.json'))
+  ? checkoutNodeModules
+  : dirname(dirname(dirname(load.resolve(`${PARTS_PACKAGE}/package.json`))));
 
 /**
  * Where the installed package is looked for, in order: the project's own
@@ -67,8 +72,6 @@ export function locateParts(projectDir: string): string | null {
   return null;
 }
 
-const load = createRequire(import.meta.url);
-
 function isSections(v: unknown): v is Sections {
   return Array.isArray(v) && v.length > 0 && v.every((s) => typeof s === 'string');
 }

package/src/signoff.ts

@@ -1,3 +1,4 @@
+import { OWNER_CHAT_FLAGS, readOwnerChat, assertOwnerChatSignoff } from './owner-chat.ts';
 import { latestPartsVerdictFinding, recordedPartsVerdict } from './parts-verdict-record.ts';
 import { selectAnswerHashes } from './signoff-answers.ts';
 import { selectSignoffTarget } from './signoff-target.ts';
@@ -34,6 +35,9 @@ export const SIGNOFF_HELP = `signoff:
                           (excludes --by, --verbatim-file and --steps on both routes)
   --by <who>              the person signing (agent is refused)
   --verbatim-file <file>  UTF-8 words unchanged, or - for stdin (default: stdin)
+  --owner-chat <file>     relay exact owner words (excludes --verbatim-file / --from-review)
+  --said-at <ISO date>    explicit owner clock; at remains the write time
+  --relayed-by <who>     operator relaying the owner chat
   --steps <id,id,...>      narrow parts plan, rigging-interview rig steps, or post steps
   --checkpoint <id>       sign an enabled checkpoint in this execution stage
   --from-review <actId>   with --checkpoint: record the passed Review checkpoint act (no --by or --verbatim-file)
@@ -75,7 +79,7 @@ export function signoffCommand(args: string[], now: number, hooks: SignoffHooks
       i++;
     } else if (arg.startsWith('--component=') || arg.startsWith('--diff-report=') || arg.startsWith('--triage-file=')) {
       hasDiffFlag = true;
-    } else if (['--version', '--draft', '--structure-file', '--by', '--verbatim-file', '--steps', '--checkpoint', '--from-review'].includes(arg)) {
+    } else if (['--version', '--draft', '--structure-file', '--by', '--verbatim-file', '--steps', '--checkpoint', '--from-review', ...OWNER_CHAT_FLAGS].includes(arg)) {
       const value = args[++i];
       if (arg in opts || value === undefined || value === '') refuse('SIGNOFF_OPTION_INVALID', `${arg} needs one non-empty value`, USAGE_EXIT);
       opts[arg] = value;
@@ -94,7 +98,7 @@ export function signoffCommand(args: string[], now: number, hooks: SignoffHooks
   }
   const actId = opts['--from-review'];
   if (actId !== undefined) {
-    const mixed = ['--by', '--verbatim-file', '--steps'].filter(flag => opts[flag] !== undefined);
+    const mixed = ['--by', '--verbatim-file', '--steps', ...OWNER_CHAT_FLAGS].filter(flag => opts[flag] !== undefined);
     if (mixed.length > 0) refuse('SIGNOFF_OPTION_INVALID', `project.json.review_acts: --from-review excludes ${mixed.join(', ')}; the person's identity, words and covered steps come from the review act`, USAGE_EXIT);
   }
   if (actId === undefined) return recordSignoff(stage, positional, opts, json, now, hooks);
@@ -114,7 +118,9 @@ function recordSignoff(stage: string, positional: string[], opts: Record<string,
   if (opts['--by'] === undefined && actId === undefined) refuse('SIGNOFF_OPTION_INVALID', 'signoff needs --by', USAGE_EXIT);
   if (by.toLowerCase() === 'agent') refuse('SIGNOFF_NOT_HUMAN', `stage ${stage}: signed by agent`);
   const dir = resolve(positional[1] ?? process.cwd());
+  const chat = readOwnerChat(opts, by, now, 'project.json.signoffs');
   const { file, project } = readProject(dir);
+  if (chat) assertOwnerChatSignoff(dir, project, stage, opts['--draft'], opts['--version']);
   const original = actId === undefined ? undefined : readFileSync(file);
   let ingest: CheckpointIngest | undefined;
   // Recorded checkpoint receipts replay before current eligibility, through the same immutable-byte validator.
@@ -224,7 +230,7 @@ function recordSignoff(stage: string, positional: string[], opts: Record<string,
       : checkpoint.state === 'delegated' && checkpoint.decided && isObject(checkpoint.answer.agent_decision) ? checkpoint.answer.agent_decision.value : undefined;
     if (typeof value !== 'boolean') refuse('SIGNOFF_CHECKPOINT_INVALID', `${String(step.id)}: checkpoint needs a boolean user answer or a decided boolean delegation`);
   }
-  const verbatim = review !== undefined ? String(review.human.verbatim) : ingest ? ingest.verbatim : readVerbatim(opts['--verbatim-file'] ?? '-');
+  const verbatim = review !== undefined ? String(review.human.verbatim) : ingest ? ingest.verbatim : chat ? String(chat.owner_words) : readVerbatim(opts['--verbatim-file'] ?? '-');
   const at = review !== undefined ? String(review.human.at) : ingest ? ingest.at : new Date(now).toISOString();
   const hashes: JsonObject = Object.create(null) as JsonObject;
   for (const step of covered) {
@@ -234,6 +240,7 @@ function recordSignoff(stage: string, positional: string[], opts: Record<string,
     hashes[step.id as string] = stepHash(step);
   }
   const signoff: JsonObject = { stage, checkpoint: checkpointId ?? null, by, at, verbatim };
+  if (chat) { signoff.source = chat.source!; signoff.said_at = chat.said_at!; signoff.relayed_by = chat.relayed_by!; }
   if (review !== undefined) signoff.source = review.human.source!;
   if (evidence !== undefined) signoff.evidence = evidence;
   if (phase !== undefined) {

package/templates/agent-guide.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per {{RESUME_LINK}}.
 

package/templates/example-chain/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/0a-interview-options/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/0a-interview-options.json

@@ -89,7 +89,7 @@
     },
     {
       "path": "AGENTS.md",
-      "sha256": "e37e5793e9233ff8c685076f42e002fbf614e460a56dedb3e56acead59a824f2"
+      "sha256": "143b357c86ac9573219f0e04cdb94170508ee116d91011a70fc7922f806b4ff7"
     },
     {
       "path": "CLAUDE.md",

package/templates/example-chain/checkpoints/0b-plan-pending/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/0b-plan-pending.json

@@ -31,7 +31,7 @@
     },
     {
       "path": "AGENTS.md",
-      "sha256": "e37e5793e9233ff8c685076f42e002fbf614e460a56dedb3e56acead59a824f2"
+      "sha256": "143b357c86ac9573219f0e04cdb94170508ee116d91011a70fc7922f806b4ff7"
     },
     {
       "path": "CLAUDE.md",

package/templates/example-chain/checkpoints/1-parts-verdict/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/1-parts-verdict.json

@@ -46,7 +46,7 @@
     },
     {
       "path": "AGENTS.md",
-      "sha256": "e37e5793e9233ff8c685076f42e002fbf614e460a56dedb3e56acead59a824f2"
+      "sha256": "143b357c86ac9573219f0e04cdb94170508ee116d91011a70fc7922f806b4ff7"
     },
     {
       "path": "CLAUDE.md",

package/templates/example-chain/checkpoints/2-rigging-answers/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/2-rigging-answers.json

@@ -88,7 +88,7 @@
     },
     {
       "path": "AGENTS.md",
-      "sha256": "e37e5793e9233ff8c685076f42e002fbf614e460a56dedb3e56acead59a824f2"
+      "sha256": "143b357c86ac9573219f0e04cdb94170508ee116d91011a70fc7922f806b4ff7"
     },
     {
       "path": "CLAUDE.md",

package/templates/example-chain/checkpoints/3-rig-review/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/3-rig-review.json

@@ -34,7 +34,7 @@
     },
     {
       "path": "AGENTS.md",
-      "sha256": "e37e5793e9233ff8c685076f42e002fbf614e460a56dedb3e56acead59a824f2"
+      "sha256": "143b357c86ac9573219f0e04cdb94170508ee116d91011a70fc7922f806b4ff7"
     },
     {
       "path": "CLAUDE.md",

package/templates/example-chain/checkpoints/4-direction-post/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).
 

package/templates/example-chain/checkpoints/4-direction-post.json

@@ -54,7 +54,7 @@
     },
     {
       "path": "AGENTS.md",
-      "sha256": "e37e5793e9233ff8c685076f42e002fbf614e460a56dedb3e56acead59a824f2"
+      "sha256": "143b357c86ac9573219f0e04cdb94170508ee116d91011a70fc7922f806b4ff7"
     },
     {
       "path": "CLAUDE.md",

package/templates/example-remesh/AGENTS.md

@@ -4,7 +4,7 @@ One painting; one rig and its takes.
 
 ## Start here
 
-1. Read `project.json`. Human acts go through Review; ingest exports. Never type human answers/signatures.
+1. Read `project.json`. Verdicts go through Review; interview picks and signoffs may relay owner words via `--owner-chat --said-at --relayed-by`. Never invent human words.
 2. Run `rig-create next` to derive the next moves and whose they are.
 3. Resume per [Resume](https://github.com/rig-c/create/blob/main/docs/PROJECT.md#how-an-agent-resumes-a-project).