@rosthq/cli 0.5.15 → 0.5.17

package/dist/index.js

@@ -41637,7 +41637,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-06-18.2",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -41689,7 +41689,13 @@ The graph is also where you land after onboarding \u2014 it is the mission contr
 - **Structure** \u2014 seat type and reporting lines.
 - **Cascade** \u2014 whether each seat's goal branch is on track.
 - **Signal** \u2014 the worst measurable state per seat.
-- **Scoreboard** \u2014 two live numbers on every seat: work done (agent runs) and cost over the last 30 days. A seat whose cost is a clear outlier above the rest of the fleet is flagged as cost drift (labelled, not colour-only). Human seats and seats with no runs read calmly as no agent cost rather than a bare zero. For a small fleet the Scoreboard also leads with a two-tile summary \u2014 total work and total cost \u2014 framed as the single question that matters: is it earning its keep.
+- **Scoreboard** \u2014 direct work and direct cost on each seat, plus a separate team/subtree rollup for manager seats. The tenant summary counts direct agent work once, so a parent seat's team cost does not double-count the same run again. A seat whose direct cost is a clear outlier above the rest of the fleet is flagged as cost drift (labelled, not colour-only). Human seats and seats with no direct or team runs read calmly rather than showing a bare zero. For a small fleet the Scoreboard also leads with a two-tile summary \u2014 total work and total cost \u2014 framed as the single question that matters: is it earning its keep.
+
+The graph also carries a mission-control panel. It pulls the same operational state visible on the agent and setup-health surfaces: held actions that need steward decisions, failed runs, open Friction, pending Signal readings, stale agents, and setup recommendations. Each item can focus the affected seat on the canvas and links to the route where the operator can act.
+
+## Review an agent seat's delivered work
+
+Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat.
 
 ## First-pass structure
 
@@ -41824,7 +41830,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-06-19.2",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -41885,6 +41891,12 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
 - Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, and product-visible run errors; \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card.
 
+## Review readiness before go-live
+
+The fleet page and seat page should make readiness inspectable, not implied. A staffed agent row shows whether the Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state are complete. Each missing item links to the exact setup surface that fixes it: seat staffing, the Charter Builder, agent operations, runner settings, vault settings, or tool configuration.
+
+After an agent runs, review its completed work as well as its telemetry. Seat pages combine explicit deliverables, work-log evidence, and successful run summaries into a readable output trail with safe evidence links labelled as internal, Linear, GitHub, or external. Held confirmations and escalations remain visible until decided or expired: confirmations can be approved or rejected from the seat page, while escalations link to the Steward queue for the human decision.
+
 ## When to stop for confirmation
 
 \`agent.create_from_template\`, \`agent.create_custom\`, \`staffing.assign_user\`, \`agent.go_live\`, \`agent.update_schedule\`, and \`mcp_token.create\` are \`human_required\`; \`agent.configure_tools\` and \`credential.ingress\` are \`credential_flow\` (both gate through the vault-backed credential path with human approval; \`agent.configure_tools\` stages the request and only \`credential.ingress\` takes the raw secret, as a vault reference); \`agent.decommission\` is \`dangerous\`. \`agent.run_now\` is not human-gated because it does not expand authority or change the schedule; it only queues an immediate run for an already-live agent. An agent may draft, configure (with vault refs), dry-run, and request an on-demand run; the human approves go-live, credentials, schedule changes, and decommission. \`run_dry_run\` is ungated by human approval, but it is **precondition-gated**: the seat's permission manifest must be signed first (\`charter.sign_manifest\`). Attempting a dry run before sign-off returns a clean \`COMMAND_PRECONDITION_FAILED\` naming \`charter.sign_manifest\`, not a generic failure. Go-live after a passed dry run is \`human_required\`. See the confirmations guide.
@@ -42053,7 +42065,7 @@ The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provide
     order: 80,
     title: "Sync rhythm playbook",
     summary: "How Signal, Friction, Cascade, and Sync Briefs turn weekly meetings into decision time.",
-    version: "2026-06-20.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -42100,6 +42112,10 @@ The Sync Brief should answer:
 
 On screen the brief reads in plain terms: Signal exceptions, goal progress, task review, ranked Friction, and agent activity. Where a section has no source data, it lists gaps to confirm \u2014 the missing inputs a human should know about before the meeting \u2014 rather than a blank section.
 
+Before the first brief exists, the Sync pages are readiness views. They show the next scheduled compile and the source areas that will feed it: Signal, Cascade, Tasks, Friction, and Agents. Use those links to add the missing source data; there is no manual compile button until the system has an idempotent persisted operation to run.
+
+The same readiness model appears around the meeting loop. Steward shows the governance loop even when no decision is waiting: which agent seats are stewarded, how many escalations are open, and recent raised/decided counts. Tasks explains when nothing is due and points to recently completed or agent-blocked work when it exists. The agent fleet shows configuration completeness per staffed agent seat \u2014 steward chain, lane/trigger/substrate, credentials, tools, model, dry run, and go-live \u2014 with links to the exact setup surface rather than a generic action button.
+
 ## During Sync
 
 Start with the exceptions, not a tour of every seat. Resolve the highest-value Friction first. Convert decisions into handoffs with owners and dates. Clarify Charters when ownership is ambiguous.
@@ -42123,7 +42139,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-06-20.3",
+    version: "2026-06-20.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -42215,20 +42231,20 @@ Before an agent goes live, the sandbox dry run rehearses this against fake data
 
 ## What humans should review
 
-The Agents page shows fleet health first: live state, recent runs, failed runs, open held actions, last activity, cost, and the next operator action. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason.
+The Agents page shows fleet health first: live state, recent runs, failed runs, open held actions, last activity, cost, and the next operator action. It also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason.
 
-Review the first dry runs, fleet overview, tool-call audit rows, escalations, and Signal impact. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
+Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
   },
   {
     slug: "tool-access-and-vault",
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-06-20.4",
+    version: "2026-06-20.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
-    relatedCommandIds: ["charter.sign_manifest", "credential.ingress", "agent.configure_tools", "integration.list", "integration.status", "integration.test", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "confirmation.approve"],
+    relatedCommandIds: ["charter.sign_manifest", "credential.ingress", "agent.configure_tools", "integration.list", "integration.readiness", "integration.status", "integration.test", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "confirmation.approve"],
     legal: {
       publicRisk: "low",
       notes: [
@@ -42278,6 +42294,8 @@ Google can be connected from Settings once the workspace OAuth app is configured
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
 
+\`integration.readiness\` / \`{{cli}} integration readiness --provider google --json\` / \`rost_check_integration_readiness\` returns the same setup checklist Settings shows: OAuth env and callback status, tenant connection state, granted scopes, latest test state, external verification/CASA caveats, handler availability, and the next Linear issue or action. The checklist is metadata-only. It never returns access tokens, refresh tokens, client secrets, vault refs, or raw provider responses.
+
 ## One write-only credential flow across every surface
 
 There is exactly one way to give a connected tool its credential, and it is the same on every surface (agent setup, Charter Builder, CLI, MCP). Connecting a tool only authorizes the access \u2014 it never captures a secret. When a connected tool needs a credential, you stage a vault-backed *request* (provider, scope, and a credential name \u2014 all labels, never the secret). You then provide the actual secret separately through the vault-backed ingress flow from Settings. No {{brand}} surface ever has a field that accepts raw secret material, so a secret can never reach a prompt, log, event, or tool argument.
@@ -42307,7 +42325,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-06-20.3",
+    version: "2026-06-20.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42341,6 +42359,10 @@ There is exactly one way to give a connected tool its credential, and it is the
 
 Start from the seat's responsibility, not the tool list. If a tool does not directly support a responsibility or measurable, do not connect it yet.
 
+## Skills and tool dependencies
+
+Skills are reusable procedures a seat can learn from; they are not tools and they never grant authority. A skill package may declare required or optional tool dependencies so setup can identify blockers before assignment. Those dependencies are checked against the discoverable \`tool.catalog\` ids and scope tiers, then compared to the seat's Charter permission manifest. Missing required tools block approval; optional tools produce setup warnings. A published skill version is immutable, so later corrections create a new version instead of rewriting what a run may have used.
+
 ## How agents should request tools
 
 Agents should explain the job, the required tool category, the minimum permission needed, and the escalation boundary. Humans approve or decline the request.
@@ -42356,7 +42378,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-20.8",
+    version: "2026-06-20.11",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42395,7 +42417,11 @@ External connectors are being rolled out provider by provider, conservatively (r
       "agent.fleet_digest",
       "agent.get_run",
       "agent.list_runs",
-      "agent.list_tool_calls"
+      "agent.list_tool_calls",
+      "integration.list",
+      "integration.readiness",
+      "integration.status",
+      "integration.test"
     ],
     legal: {
       publicRisk: "low",
@@ -42769,11 +42795,12 @@ These ergonomic wrappers (including the \`{{cli}} agent\` group) require **{{cli
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
 | \`{{cli}} runner list|status|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders; revoke a runner. | Tenant | \`{{cli}} runner list --json\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
-| \`{{cli}} integration list|status|test\` | \`integration.list\`, \`integration.status\`, \`integration.test\` | List connector metadata, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration test --provider google --json\` |
+| \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} settings get|update\` | \`settings.get\`, \`settings.update\` | Read tenant settings; update budget caps. | Tenant | \`{{cli}} settings get --json\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
+| \`{{cli}} skills list|get|file|assigned|check-dependencies\` | \`skill.list\`, \`skill.get\`, \`skill.file.get\`, \`skill.assigned.list\`, \`skill.check_dependencies\` | Discover reusable Skills, read descriptors and stored package files, list approved Seat assignments, and compare required/optional tool dependencies with a Seat's signed Charter manifest. Skills are instructions, not authority. | Tenant and seat | \`{{cli}} skills list --json\`; \`{{cli}} skills file --slug invoice-review --path SKILL.md\` |
 | \`{{cli}} model list\` | \`model.catalog\` | List guided model tiers with recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | \`{{cli}} model list --json\` |
 | \`{{cli}} compass show\` | \`compass.show_markdown\` | Render the current Compass as a clean markdown card for review. | Tenant | \`{{cli}} compass show --markdown\` |
 | \`{{cli}} charter show\` | \`charter.show_markdown\` | Render a seat's Charter as a clean markdown card for review. | Tenant | \`{{cli}} charter show --seat-id <id> --markdown\` |
@@ -42800,7 +42827,7 @@ This catalog is the canonical machine surface \u2014 the \`rost_*\` tools your M
 3. **\`{{cli}} model list\` / \`model.catalog\`** (MCP \`rost_list_model_catalog\`) \u2014 the guided model-tier catalog the builder reads for recommendations, effort, token prices, cost bands, and model id selection.
 4. **The "Available tools guide"** (in the sidebar) \u2014 covers tool *categories* and governance, not a callable surface. See the available-tools-guide.
 
-Sections below: Command discovery (2) \xB7 Public reference (3) \xB7 Tenant-admin tools (grouped by domain) \xB7 Seat-scoped operating tools (9) \xB7 MCP operation resources (9).
+Sections below: Command discovery (2) \xB7 Public reference (3) \xB7 Tenant-admin tools (grouped by domain) \xB7 Seat-scoped operating tools (9) \xB7 MCP operation resources (13).
 
 ### Command discovery tools
 
@@ -42852,7 +42879,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_approve_pending_confirmation\` | \`confirmation.approve\` | Approve a pending confirmation. | Tenant | Call with \`{"confirmation_id":"<confirmation-id>"}\`. |
 | \`rost_reject_pending_confirmation\` | \`confirmation.reject\` | Reject a pending confirmation. | Tenant | Call with \`{"confirmation_id":"<confirmation-id>"}\`. |
 | \`rost_draft_compass\` | \`compass.draft\` | Create a Compass draft. | Tenant | Call with a concise Compass document. |
-| \`rost_update_compass_draft\` | \`compass.update_draft\` | Replace a Compass draft document. | Tenant | Call with \`draft_id\` and updated document. |
+| \`rost_update_compass_draft\` | \`compass.update_draft\` | Replace a Compass draft document. | Tenant | Call with the \`compass_version_id\` from \`compass.draft\` as \`draft_id\` and the updated document. |
 | \`rost_approve_compass_version\` | \`compass.approve_version\` | Activate a Compass version by supersession. | Tenant | Call after human review. |
 | \`rost_reject_compass_draft\` | \`compass.reject_draft\` | Reject and remove a Compass draft. | Tenant | Call when the draft should not proceed. |
 | \`rost_answer_compass_gap\` | \`compass.answer_gap\` | Record a human answer for a Compass gap. | Tenant | Call with \`gap_id\` and answer text. |
@@ -42902,6 +42929,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_send_test_notification\` | \`notification.test\` | Emit an in-app test notification to the acting human. | Tenant | Call with \`{}\`. |
 | \`rost_list_notification_errors\` | \`notification.list_errors\` | List recent failed notification deliveries with linked \`error_log_id\`, source, seat id, and run id when available. | Tenant | Call with optional \`limit\`; \`source=run\` rows can be followed with \`agent.get_run\`. |
 | \`rost_list_integrations\` | \`integration.list\` | List connected integration metadata and latest health state. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`; no secrets or vault refs are returned. |
+| \`rost_check_integration_readiness\` | \`integration.readiness\` | Return the connector setup checklist: OAuth env/callback, tenant connection, scopes, latest test state, external verification/CASA, handler availability, and DER-coded next actions. | Tenant | Call with \`{"provider":"google"}\`; metadata only, no secrets or vault refs. |
 | \`rost_get_integration_status\` | \`integration.status\` | Read one integration's metadata by provider or integration id. | Tenant | Call with \`{"provider":"google"}\` or \`{"integration_id":"<id>"}\`. |
 | \`rost_test_integration_connection\` | \`integration.test\` | Run the provider-specific connection test and update integration health. | Tenant | Call with \`{"provider":"google"}\`; result is bounded metadata only. |
 | \`rost_invite_member\` | \`member.invite\` | Create a pending tenant invite for a human teammate. | Tenant | Call with \`email\` and \`role\`. |
@@ -42938,6 +42966,11 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_show_charter_as_markdown\` | \`charter.show_markdown\` | Render a seat's active or latest Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
+| \`rost_list_skills\` | \`skill.list\` | List tenant Skills with application descriptors, dependency metadata, source status, latest version, and assigned Seat count. Seat-scoped reads are available through \`rost://skills\`. | Tenant-admin | Call with \`{}\` or \`{"query":"invoice"}\`. |
+| \`rost_get_skill\` | \`skill.get\` | Read one Skill descriptor and latest stored version metadata. Seat-scoped reads are available through \`rost://skills/{slug}\`. | Tenant-admin | Call with \`{"slug":"invoice-review"}\`. |
+| \`rost_get_skill_file\` | \`skill.file.get\` | Read stored Skill package file content by slug and package path; paths resolve only inside the stored package payload. Seat-scoped reads are available through \`rost://skills/{slug}/files/{path}\`. | Tenant-admin | Call with \`{"slug":"invoice-review","path":"SKILL.md"}\`. |
+| \`rost_list_assigned_skills\` | \`skill.assigned.list\` | List approved Skill assignments for a Seat, including immutable version, dependency status, rationale, and approval time. Seat-scoped reads are available through \`rost://seat/{id}/skills\`. | Tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
+| \`rost_check_skill_dependencies\` | \`skill.check_dependencies\` | Compare a Skill version's required and optional tools with a Seat's active or draft Charter permission manifest. Returns ready/blocked/warning and suggested \`agent.configure_tools\` input; it never grants permissions. | Tenant-admin | Call with \`{"seat_id":"<seat-id>","slug":"invoice-review"}\`. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
 
 ### Seat-scoped operating tools
@@ -42967,9 +43000,13 @@ These read-only resources bundle the facts the UI shows so an agent can avoid gu
 | \`rost://seat/{id}/context\` | A seat's Compass, Charter, goals, measurables, open tasks, open issues, and protocol. | Seat (own seat) or tenant-admin (any seat) | Read \`rost://seat/<seat-id>/context\` for the acting seat. |
 | \`rost://compass/current\` | Active and draft Compass versions plus source documents. | Tenant-admin | Read before drafting Compass changes. |
 | \`rost://sync/latest\` | The most recent compiled Sync Brief and its agenda. | Tenant-admin | Read before running the weekly Sync. |
+| \`rost://skills\` | Tenant Skills library for tenant-admin tokens; assigned published Skills for seat tokens. | Tenant-admin or seat | Read before creating, assigning, or loading Skill instructions. |
+| \`rost://skills/{slug}\` | One Skill descriptor and latest stored version metadata. | Tenant-admin or assigned seat | Read \`rost://skills/<slug>\` before loading the full file. |
+| \`rost://skills/{slug}/files/{path}\` | Stored Skill package file content by package path; never server filesystem paths. | Tenant-admin or assigned seat | Read \`rost://skills/<slug>/files/SKILL.md\`. |
 | \`rost://agents/templates\` | Stock agent templates: responsibilities, default tools, safety boundaries, and dry-run rehearsal. | Tenant-admin | Read before creating an agent from a template. |
 | \`rost://agent-setup/{id}\` | A draft agent setup's mode, parent, steward, lane, schedule, tool decisions, dry-run, blockers, and next action. | Tenant-admin | Read \`rost://agent-setup/<setup-id>\` to resume a draft. |
 | \`rost://seat/{id}/agent-status\` | A seat's agent occupancy, lane, schedule, live state, steward chain, and dry-run result. | Seat (own seat) or tenant-admin (any seat) | Read \`rost://seat/<seat-id>/agent-status\` for the acting seat. |
+| \`rost://seat/{id}/skills\` | Approved Skill assignments for a Seat, including immutable version and dependency status. | Seat (own seat) or tenant-admin (any seat) | Read \`rost://seat/<seat-id>/skills\` before a run loads Skills. |
 | \`rost://operations/reference-map\` | Machine-facing map of which guide to read before each workflow. | Any valid MCP token | Read first when planning a CLI/MCP workflow. |
 
 ## Troubleshooting
@@ -43120,7 +43157,7 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
     order: 60,
     title: "Cascade guide",
     summary: "How to connect company goals to seat-level work without turning {{brand}} into a project-management tool.",
-    version: "2026-06-18.1",
+    version: "2026-06-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -43156,11 +43193,27 @@ Cascade connects company direction to seat-level commitments. It is a goal tree,
 ## Good Cascade structure
 
 - Company goals connect back to the Compass.
-- Team or function goals connect to company goals.
+- Team or function goals connect to company goals. This is the accountable human layer for most agent work.
+- Agent execution goals connect below the human or function goal they advance, unless the agent seat is intentionally accountable for that outcome.
 - Seat commitments connect to the goal they advance.
 - Each commitment has one owning seat.
 - Status is evidence-based where possible.
 
+## Setup-health recommendations
+
+Cascade warnings are advisory, not blockers. They point to setup that should be reviewed before the next Sync:
+
+- Uncovered Compass objective: the objective has no active child seat goal.
+- Objective skips accountable function: current child goals are agent-owned without a human or function goal between Compass and execution.
+- Seat missing cycle goals: an active seat has no current-cycle goal.
+- Seat missing active Charter: an active seat has no approved Charter.
+- Agent goal missing human accountability parent: an agent-owned goal has no human or hybrid goal in its ancestry.
+- Orphaned goal branch: the owner seat or parent chain no longer reaches an active Compass objective.
+
+On \`/cascade\`, the screen renders the full goal depth, not just one or two levels. Off-track descendant branches stay open so the operator can see why a parent rolled up to risk.
+
+On human and function seat pages, goal visibility includes both direct goals and descendant seat goals from the Responsibility Graph subtree, so a manager can review team progress without double-owning the agent's work.
+
 ## What does not belong
 
 Do not put every task into Cascade. Small errands, private notes, and work with no strategic connection should stay out. Cascade should answer whether the company is moving toward its stated outcomes.
@@ -43252,7 +43305,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
     order: 62,
     title: "Friction guide",
     summary: "How to capture issues with evidence, rank them, and resolve them without losing ownership.",
-    version: "2026-06-18.1",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -43301,6 +43354,8 @@ Friction is where operational issues become visible. A good Friction item is spe
 
 Agents should file Friction when a measurable breaks, a tool fails, a repeated exception appears, or the Charter says a condition must be escalated. The agent should attach evidence and avoid deciding beyond its scope.
 
+In the app, operational evidence is summarized for humans instead of shown as the primary interface. Incident fields, proposed tool calls, schedules, payload labels, and source links render as readable fields with raw details tucked behind supporting context when useful. Secret-shaped values stay redacted.
+
 ## Operate Friction, tasks, and escalations from CLI or MCP
 
 Friction, tasks, and escalations are the issue-to-action loop. A seat files, a task carries the work, and an escalation routes a decision a seat cannot make alone.
@@ -43322,7 +43377,7 @@ Resolving Friction should produce one of four outcomes: a decision, a task, a Ch
     order: 70,
     title: "Steward queue guide",
     summary: "How Stewards review escalations, approve agent boundaries, and keep agents accountable.",
-    version: "2026-06-18.2",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -43359,6 +43414,8 @@ Read the seat, Charter, evidence, and recommended action. Decide the narrow ques
 
 In the app, the evidence is shown as a legible card, not raw data: a proposed tool call lists the tool and its summarized arguments, and any attached context shows as labeled fields. Values that read like credentials are redacted, so you can decide without seeing secret material.
 
+When nothing is waiting, the Steward page still proves the governance loop. It shows which agent or hybrid seats the human stewards, how many escalations were raised or decided recently, and whether any are open. That empty state is an operating summary, not a dead end.
+
 ## Work the queue from CLI or MCP
 
 The Steward reads the queue from any surface but decides as a human.
@@ -43435,11 +43492,11 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-06-20.5",
+    version: "2026-06-20.7",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.status", "integration.test", "settings.get", "settings.update", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -43469,11 +43526,11 @@ Start with members and invites, then provider and channel connections, then MCP
 
 Settings lifecycle timestamps are display metadata for tokens, connected machines, integrations, and stored credentials. They may be emitted by the database as either timestamp values or strings, but Settings renders them as safe labels rather than treating timestamp formatting failures as page-level failures.
 
-When a settings source is temporarily unavailable, the app keeps the route open and marks affected sections as unavailable instead of showing raw errors or stale-looking editable values. Budget and Sync Brief controls stay read-only until their server-backed data can be loaded.
+When a settings source is temporarily unavailable, the app keeps the route open and marks affected sections as unavailable instead of showing raw errors or stale-looking editable values. Budget and Sync Brief controls stay read-only until their server-backed data can be loaded. Notification timestamps and integration test timestamps follow the same safe-label rule, so a malformed or missing timestamp becomes \`Unknown\` or unavailable copy rather than a page crash.
 
 ## Integration health
 
-\`integration.list\` lists connector metadata for CLI and MCP operators, \`integration.status\` reads one provider or integration id, and \`integration.test\` runs the installed provider-specific health check. These commands return account labels, scopes, capabilities, timestamps, and health only; they never return vault references, access tokens, refresh tokens, or raw provider responses. Google's test refreshes the vaulted OAuth credential and reads the Gmail profile as the minimal live check. Settings exposes the same Google test as an owner/operator button beside Connect/Reconnect, shows the last tested time, and turns failures into reconnect-oriented remediation copy rather than raw provider errors.
+\`integration.list\` lists connector metadata for CLI and MCP operators, \`integration.readiness\` returns the setup checklist, \`integration.status\` reads one provider or integration id, and \`integration.test\` runs the installed provider-specific health check. These commands return account labels, scopes, capabilities, timestamps, checklist status, DER-coded next actions, and health only; they never return vault references, access tokens, refresh tokens, client secrets, or raw provider responses. Google's test refreshes the vaulted OAuth credential and reads the Gmail profile as the minimal live check. Settings exposes the same Google readiness facts and test action beside Connect/Reconnect, showing whether OAuth env, callback registration, tenant connection, scopes, tests, Google verification/CASA, and Gmail/Sheets handler slices are ready or still waiting on DER-880, DER-881, DER-866, DER-867, or DER-869.
 
 Reconnects keep historical rows for audit, but provider status in Settings, CLI, and MCP prefers the current connected row first, then the latest error or disconnected row.
 
@@ -43736,7 +43793,7 @@ Templates may draft. Humans approve. A stock agent should not go live until a hu
     order: 77,
     title: "Troubleshooting guide",
     summary: "How users and agents should diagnose common setup, tool, Signal, Friction, and MCP problems.",
-    version: "2026-06-18.4",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
@@ -43769,10 +43826,12 @@ Before calling a command that changes state, discover its exact shape so you do
 - Onboarding seems stuck: call \`onboarding.status\` / \`rost_onboard_status\` and inspect missing graph, Charter, Compass, or staffing steps.
 - Graph looks wrong: read \`graph.get\` / \`rost://graph\` to confirm seat ids, parents, and occupancy before mutating.
 - Agent cannot act: check the Charter, permission manifest, Steward chain, and token scope with \`agent.status\` / \`rost_get_agent_status\` and \`seat.get\`.
+- Agent looks incomplete: open the fleet row on \`/agents\` and follow the configuration readiness links for the missing Steward chain, lane/substrate, credentials, tools, model config, sandbox dry run, or go-live state.
 - Signal looks wrong: read \`signal.list\` / \`rost_list_signals\` and check owner seat, cadence, target, and evidence.
 - Friction is noisy: read \`friction.list\` and check whether the underlying Charter or measurable is unclear.
 - Escalations are aging: read \`escalation.list\` / \`rost_list_escalations\`; a human resolves through the Steward queue.
 - MCP access fails: revoke and recreate the narrowest token after checking scope (\`mcp_token.revoke\` then \`{{cli}} mcp install --client <client> --scope seat --seat-id <seat-id>\`; standalone \`mcp install\` requires an explicit \`--scope\`).
+- Settings section unavailable: keep the route open, read which section is marked unavailable, and retry or fix that source directly. Do not treat a missing Settings panel as permission to write blind values; budget and Sync Brief settings stay read-only until their data loads.
 
 ## Surface-specific failures
 
@@ -43920,7 +43979,7 @@ Agents should not teach EOS as EOS. They should use {{brand}}'s method. When a u
     order: 11,
     title: "Compass authoring guide",
     summary: "Field-by-field guidance for authoring a strong Compass document directly, with the full JSON contract and worked examples.",
-    version: "2026-06-16.1",
+    version: "2026-06-20.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup"],
@@ -44028,7 +44087,7 @@ A consultancy's purpose might be "Make expert tax guidance affordable for first-
 
 1. \`compass.draft\` \u2014 submit the document above. Drafting is safe for an agent; it returns a \`compass_version_id\`.
 2. \`compass.list_gaps\` \u2014 see what is unanswered. \`compass.answer_gap\` records a human's answer and produces a fresh draft.
-3. \`compass.update_draft\` \u2014 revise the draft as answers arrive.
+3. \`compass.update_draft\` \u2014 revise the draft as answers arrive. Pass the same \`compass_version_id\` from \`compass.draft\` as \`draft_id\`; the command replaces that unpublished draft in place and returns the draft row's current version number. If the id is missing, belongs to another tenant, or is already approved or rejected, start from \`compass.get_current\` instead of retrying blindly.
 4. \`compass.approve_version\` \u2014 activation by supersession. This is \`human_required\`: a human approves it. Prepare the draft and surface the approve link; do not approve on a human's behalf. See the confirmations guide.`
   },
   {
@@ -45739,6 +45798,17 @@ var integrationWrapper = (context, args) => dispatch(context, "integration", arg
       return integrations.map((entry) => formatIntegrationLine(asRecord(entry))).join("\n");
     });
   },
+  readiness: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({}, { provider: optionalValue(parsed, "provider") });
+    return execute(ctx, parsed, "integration.readiness", body, (output) => {
+      const connectors = asArray(asRecord(output).connectors);
+      if (connectors.length === 0) {
+        return "No connector readiness facts found.";
+      }
+      return connectors.map((entry) => formatIntegrationReadiness(asRecord(entry))).join("\n\n");
+    });
+  },
   status: (ctx, rest) => {
     const parsed = parseFlags(rest);
     const body = integrationLookupBody(parsed);
@@ -45772,9 +45842,24 @@ function integrationLookupBody(parsed) {
 function formatIntegrationLine(record2) {
   return `${field(record2, "provider")}  status=${field(record2, "status")}  account=${field(record2, "account_email")}  last_test=${field(record2, "last_test_result")}  id=${field(record2, "id")}`;
 }
+function formatIntegrationReadiness(record2) {
+  const checks = asArray(record2.checks).map((entry) => {
+    const check2 = asRecord(entry);
+    const issue2 = field(check2, "linear_issue") === "\u2014" ? "" : ` ${field(check2, "linear_issue")}`;
+    return `  - ${field(check2, "label")}: ${field(check2, "status")}${issue2} \u2014 ${field(check2, "detail")}`;
+  });
+  const actions = asArray(record2.next_actions).map((entry) => `  - ${String(entry)}`);
+  return [
+    `${field(record2, "provider")} readiness=${field(record2, "overall_status")}  id=${field(record2, "integration_id")}`,
+    field(record2, "summary"),
+    checks.length > 0 ? ["checks:", ...checks].join("\n") : "",
+    actions.length > 0 ? ["next:", ...actions].join("\n") : ""
+  ].filter((line) => line.length > 0).join("\n");
+}
 function integrationUsage(bin) {
-  return `Usage: ${bin} integration list|status|test [--json]
+  return `Usage: ${bin} integration list|readiness|status|test [--json]
   ${bin} integration list [--provider <name>]
+  ${bin} integration readiness [--provider google]
   ${bin} integration status --provider <name>
   ${bin} integration test --provider <name>`;
 }
@@ -46091,6 +46176,113 @@ function toolsUsage(bin) {
   return `Usage: ${bin} tools list [--provider <name>] [--json]
   ${bin} tools list \u2014 the discoverable tool catalog the builder reads; live handlers execute only behind signed manifests, guards, credentials, and bindings.`;
 }
+function formatSkillList(output) {
+  const skills = asArray(asRecord(output).skills);
+  if (skills.length === 0) {
+    return "No skills found.";
+  }
+  return [
+    "# Skills",
+    ...skills.map((entry) => {
+      const r = asRecord(entry);
+      return `- \`${field(r, "slug")}\` v${field(r, "latest_version")} [${field(r, "status")} \xB7 ${field(r, "visibility")} \xB7 assigned ${field(r, "assigned_seat_count")}]
+  ${field(r, "description")}`;
+    })
+  ].join("\n");
+}
+function formatSkillDetail(output) {
+  const skill = asRecord(asRecord(output).skill);
+  const required2 = asArray(skill.required_tools).map((entry) => field(asRecord(entry), "tool")).join(", ") || "none";
+  const optional2 = asArray(skill.optional_tools).map((entry) => field(asRecord(entry), "tool")).join(", ") || "none";
+  const files = asArray(skill.files).map((entry) => field(asRecord(entry), "path")).join(", ") || "SKILL.md";
+  return [
+    `# ${field(skill, "name")} (\`${field(skill, "slug")}\`)`,
+    `${field(skill, "description")}`,
+    `version: ${field(skill, "latest_version")} (${field(skill, "latest_version_id")})`,
+    `required tools: ${required2}`,
+    `optional tools: ${optional2}`,
+    `files: SKILL.md${files === "SKILL.md" ? "" : `, ${files}`}`
+  ].join("\n");
+}
+function formatAssignedSkills(output) {
+  const record2 = asRecord(output);
+  const assignments = asArray(record2.assignments);
+  if (assignments.length === 0) {
+    return `No assigned skills${record2.seat_id ? ` for seat ${field(record2, "seat_id")}` : ""}.`;
+  }
+  return [
+    `# Assigned skills${record2.seat_id ? ` for ${field(record2, "seat_id")}` : ""}`,
+    ...assignments.map((entry) => {
+      const r = asRecord(entry);
+      return `- \`${field(r, "slug")}\` v${field(r, "version")} \u2192 seat ${field(r, "seat_id")} (${field(r, "assignment_id")})
+  ${field(r, "rationale")}`;
+    })
+  ].join("\n");
+}
+function formatDependencyCheck(output) {
+  const record2 = asRecord(output);
+  const render = (label, items) => {
+    if (items.length === 0) {
+      return `${label}: none`;
+    }
+    return [
+      `${label}:`,
+      ...items.map((entry) => {
+        const r = asRecord(entry);
+        return `- \`${field(r, "tool")}\` ${field(r, "status")} (needs ${field(r, "min_scope_tier")}, has ${field(r, "current_scope_tier")})`;
+      })
+    ].join("\n");
+  };
+  return [
+    `Skill dependencies: ${field(record2, "status")}`,
+    `skill_version_id: ${field(record2, "skill_version_id")}`,
+    `seat_id: ${field(record2, "seat_id")}`,
+    render("required", asArray(record2.required)),
+    render("optional", asArray(record2.optional))
+  ].join("\n");
+}
+var skillsWrapper = (context, args) => dispatch(context, "skills", args, {
+  list: (ctx, rest) => {
+    const parsed = parseFlags(rest, /* @__PURE__ */ new Set(["include-archived"]));
+    const body = withOptional({}, {
+      status: optionalValue(parsed, "status"),
+      visibility: optionalValue(parsed, "visibility"),
+      query: optionalValue(parsed, "query"),
+      include_archived: parsed.flags.has("include-archived") ? true : void 0
+    });
+    return execute(ctx, parsed, "skill.list", body, formatSkillList);
+  },
+  get: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "skill.get", { slug: requireValue2(parsed, "slug") }, formatSkillDetail);
+  },
+  file: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = { slug: requireValue2(parsed, "slug"), path: requireValue2(parsed, "path") };
+    return execute(ctx, parsed, "skill.file.get", body, (output) => field(asRecord(output), "content"));
+  },
+  assigned: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({}, { seat_id: optionalValue(parsed, "seat-id") });
+    return execute(ctx, parsed, "skill.assigned.list", body, formatAssignedSkills);
+  },
+  "check-dependencies": (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({ seat_id: requireValue2(parsed, "seat-id") }, {
+      slug: optionalValue(parsed, "slug"),
+      skill_version_id: optionalValue(parsed, "skill-version-id")
+    });
+    return execute(ctx, parsed, "skill.check_dependencies", body, formatDependencyCheck);
+  }
+}, skillsUsage(context.binName));
+function skillsUsage(bin) {
+  return `Usage: ${bin} skills list|get|file|assigned|check-dependencies [--json]
+  ${bin} skills list [--status draft|pending_review|published|archived] [--visibility private|seat|tenant] [--query <text>]
+  ${bin} skills get --slug <slug>
+  ${bin} skills file --slug <slug> --path SKILL.md
+  ${bin} skills assigned [--seat-id <id>] [--seat <id>]
+  ${bin} skills check-dependencies --seat-id <id> (--slug <slug>|--skill-version-id <id>)`;
+}
 var modelWrapper = (context, args) => dispatch(context, "model", args, {
   list: (ctx, rest) => {
     const parsed = parseFlags(rest);
@@ -46165,6 +46357,7 @@ var OPERATION_GROUPS = [
   "member",
   "agent",
   "tools",
+  "skills",
   "model",
   "compass",
   "charter"
@@ -46184,6 +46377,7 @@ var wrappers = {
   member: memberWrapper,
   agent: agentWrapper,
   tools: toolsWrapper,
+  skills: skillsWrapper,
   model: modelWrapper,
   compass: compassWrapper,
   charter: charterWrapper
@@ -46206,6 +46400,7 @@ var groupUsageBuilders = {
   member: memberUsage,
   agent: agentUsage,
   tools: toolsUsage,
+  skills: skillsUsage,
   model: modelUsage,
   compass: compassUsage,
   charter: charterUsage
@@ -46236,6 +46431,7 @@ function operationUsageLines(bin) {
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,
+    `${bin} skills list|get|file|assigned|check-dependencies`,
     `${bin} model list`,
     `${bin} compass show`,
     `${bin} charter show`