@rosthq/cli 0.5.18 → 0.5.20

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path2, preserveJsx) {
-  if (typeof path2 === "string" && /^\.\.?\//.test(path2)) {
-    return path2.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path3, preserveJsx) {
+  if (typeof path3 === "string" && /^\.\.?\//.test(path3)) {
+    return path3.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path2;
+  return path3;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -14026,10 +14026,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path3) {
+  if (!path3)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path3.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14438,11 +14438,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path3, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path3);
     return iss;
   });
 }
@@ -14589,16 +14589,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path2 = []) => {
+  const processError = (error52, path3 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14625,17 +14625,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path2 = []) => {
+  const processError = (error52, path3 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14667,8 +14667,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path2) {
+  const path3 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path3) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27360,13 +27360,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path2 = ref.slice(1).split("/").filter(Boolean);
-  if (path2.length === 0) {
+  const path3 = ref.slice(1).split("/").filter(Boolean);
+  if (path3.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path2[0] === defsKey) {
-    const key = path2[1];
+  if (path3[0] === defsKey) {
+    const key = path3[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27828,7 +27828,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path2 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path3 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27836,7 +27836,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path2}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path3}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27849,7 +27849,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path2}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path3}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33056,8 +33056,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path2, query) {
-  const url2 = new URL(path2, baseUrl);
+function buildUrl(baseUrl, path3, query) {
+  const url2 = new URL(path3, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33087,12 +33087,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path2,
+      path: path3,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path2, query);
+      const url2 = buildUrl(options.baseUrl, path3, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -33954,7 +33954,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path2, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path3, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -33978,7 +33978,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path2);
+      const cleanPath = _this._removeEmptyFolders(path3);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34055,8 +34055,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path2, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path2, fileBody, fileOptions);
+  async upload(path3, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path3, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34096,9 +34096,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path2, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path3, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path2);
+    const cleanPath = _this3._removeEmptyFolders(path3);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34167,10 +34167,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path2, options) {
+  async createSignedUploadUrl(path3, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path2);
+      let _path = _this4._getFinalPath(path3);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34179,7 +34179,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path2,
+        path: path3,
         token
       };
     });
@@ -34239,8 +34239,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path2, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path2, fileBody, fileOptions);
+  async update(path3, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path3, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34391,10 +34391,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path2, expiresIn, options) {
+  async createSignedUrl(path3, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path2);
+      let _path = _this8._getFinalPath(path3);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34530,13 +34530,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path2, options, parameters) {
+  download(path3, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path2);
+    const _path = this._getFinalPath(path3);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34567,9 +34567,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path2) {
+  async info(path3) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path2);
+    const _path = _this10._getFinalPath(path3);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34590,9 +34590,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path2) {
+  async exists(path3) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path2);
+    const _path = _this11._getFinalPath(path3);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34671,8 +34671,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path2, options) {
-    const _path = this._getFinalPath(path2);
+  getPublicUrl(path3, options) {
+    const _path = this._getFinalPath(path3);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34811,10 +34811,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path2, options, parameters) {
+  async list(path3, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path2 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path3 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -34879,11 +34879,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path2) {
-    return `${this.bucketId}/${path2.replace(/^\/+/, "")}`;
+  _getFinalPath(path3) {
+    return `${this.bucketId}/${path3.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path2) {
-    return path2.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path3) {
+    return path3.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -37920,8 +37920,8 @@ function getErrorMap2() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path2, errorMaps, issueData } = params;
-  const fullPath = [...path2, ...issueData.path || []];
+  const { data, path: path3, errorMaps, issueData } = params;
+  const fullPath = [...path3, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -38037,11 +38037,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path2, key) {
+  constructor(parent, value, path3, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path2;
+    this._path = path3;
     this._key = key;
   }
   get path() {
@@ -41830,7 +41830,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-06-20.1",
+    version: "2026-06-21.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -41889,7 +41889,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
 - Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
-- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, and product-visible run errors; \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card.
+- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card.
 
 ## Review readiness before go-live
 
@@ -41910,11 +41910,11 @@ No orphan agents. No raw secrets in prompts, logs, or tool arguments. No durable
     order: 41,
     title: "Add agents to your Responsibility Graph",
     summary: "The visual journey for adding an agent seat: where to start, choosing a mode, placing the seat, naming a Steward, setup, the safety gates, and go-live.",
-    version: "2026-06-20.1",
+    version: "2026-06-21.3",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["staffing"],
-    relatedCommandIds: ["agent_template.list", "agent_setup.start", "agent.create_from_template", "agent.create_custom", "agent.run_dry_run", "agent.go_live", "staffing.assign_user", "confirmation.approve"],
+    relatedCommandIds: ["agent_template.list", "agent_setup.start", "agent.create_from_template", "agent.create_custom", "skill.list", "skill.catalog", "skill.check_dependencies", "skill.assign_to_seat", "agent.run_dry_run", "agent.go_live", "staffing.assign_user", "confirmation.approve"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native visual guidance for the agent-creation journey."] },
     sources: [
       {
@@ -41959,10 +41959,11 @@ The wizard builds a teammate, not a prompt:
 
 1. **Responsibilities and authority** \u2014 what the seat owns, what it may do alone, what needs approval, and what must escalate. Every clause is editable before sign-off.
 2. **Signals** \u2014 the measurables the seat is judged on.
-3. **Tools** \u2014 connect or decline each proposed tool. Declining a tool updates the permission manifest and the dry-run task so the agent stays safe. Credentials go in through write-only credential ingress and are stored as vault references, never shown again.
-4. **Schedule and lane** \u2014 when the agent runs and on which lane. These stay advanced unless the mode needs them.
+3. **Skills** \u2014 pin published, immutable Skill versions that the agent should carry. Skills are procedures, not authority: selecting one creates a proposed assignment and surfaces required/optional tool dependencies before sign-off.
+4. **Tools** \u2014 connect or decline each proposed tool. Declining a tool updates the permission manifest and the dry-run task so the agent stays safe. Credentials go in through write-only credential ingress and are stored as vault references, never shown again. Missing required Skill tools block sign-off, dry-run, and go-live until resolved; missing optional Skill tools warn without blocking.
+5. **Schedule and lane** \u2014 when the agent runs and on which lane. These stay advanced unless the mode needs them.
 
-You can save and resume a draft setup at any point. Returning to the flow restores the parent, Steward, mode, answers, tool decisions, and dry-run result.
+You can save and resume a draft setup at any point. Returning to the flow restores the parent, Steward, mode, answers, Skill selections, tool decisions, and dry-run result.
 
 ## The safety gates
 
@@ -41983,18 +41984,20 @@ Reopening the builder for a seat whose agent is already live shows its live stat
 - Parent or Steward seat archived during setup: go-live is blocked until you choose a live parent or reassign the Steward.
 - Failed dry run or a declined tool: the draft is preserved; fix the Charter or tool decision and rerun. See the troubleshooting guide.
 
-In read-only or demo mode the **Add agent** affordance never starts a write. The public demo instead replays the add-an-agent journey end to end \u2014 describe the role, watch the draft Charter assemble, see the four safety gates light, and watch a sandbox dry run reach the must-escalate boundary and stop \u2014 then routes go-live to sign-up, because going live is a human decision.`
+In read-only or demo mode the **Add agent** affordance never starts a write. The public demo instead replays the add-an-agent journey end to end \u2014 describe the role, watch the draft Charter assemble, see the four safety gates light, and watch a sandbox dry run reach the must-escalate boundary and stop \u2014 then routes go-live to sign-up, because going live is a human decision.
+
+For CLI and MCP setup, read agent-skill-setup-guide before adding or assigning Skills. List existing company Skills and the {{brand}} catalog first, read the full Skill file before proposing it, and run the dependency check before sign-off. A missing required Skill tool is fixed by updating the Charter permission manifest through tool configuration; it is never fixed by treating the Skill as authorization.`
   },
   {
     slug: "custom-agents-guide",
     order: 42,
     title: "Design a custom agent",
     summary: "How to build a custom agent from operational questions through the Charter Builder, tools, dry run, and go-live without writing prompts.",
-    version: "2026-06-18.4",
+    version: "2026-06-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "charter_design"],
-    relatedCommandIds: ["agent_setup.start", "agent_setup.get", "agent_setup.update", "agent.create_custom", "agent.configure_tools", "agent.run_dry_run", "agent.go_live", "charter.draft", "charter.sign_manifest", "credential.ingress", "confirmation.approve"],
+    relatedCommandIds: ["agent_setup.start", "agent_setup.get", "agent_setup.update", "agent.create_custom", "skill.list", "skill.catalog", "skill.get", "skill.file.get", "skill.check_dependencies", "skill.assign_to_seat", "agent.configure_tools", "agent.run_dry_run", "agent.go_live", "charter.draft", "charter.sign_manifest", "credential.ingress", "confirmation.approve"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native custom-agent guidance."] },
     sources: [
       {
@@ -42049,8 +42052,11 @@ The same path is command-backed:
 1. \`agent_setup.start\` / \`rost_start_agent_setup\` with mode \`custom\` returns a \`setup_id\`.
 2. Iterate with \`agent_setup.get\` and \`agent_setup.update\` (parent, Steward, lane, schedule, and the operational answers).
 3. \`agent.create_custom\` / \`rost_create_custom_agent\` seeds a \`custom\` agent and a draft Charter from the operational answers only.
-4. \`agent.configure_tools\` / \`rost_configure_agent_tools\` records connect/decline decisions and credential-ingress requests (vault refs only).
-5. \`agent.run_dry_run\` / \`rost_run_agent_dry_run\` rehearses the task after the manifest is signed.
+4. Read \`skill.list\` / \`rost_list_skills\` and, when appropriate, \`skill.catalog\` / \`rost_list_rost_skill_catalog\`; inspect \`skill.get\` plus \`skill.file.get\` for the full \`SKILL.md\` before asking a tenant-admin or human operator to assign a Skill.
+5. Run \`skill.check_dependencies\` before assignment. Missing required tools are blockers for approval; optional tools are warnings. Resolve required blockers through \`agent.configure_tools\`, not by changing the Skill.
+6. A tenant-admin command caller can propose the Skill with \`skill.assign_to_seat\` / \`rost_assign_skill_to_seat\` after dependency checks; a seat-scoped agent escalates the assignment request instead of calling that command.
+7. \`agent.configure_tools\` / \`rost_configure_agent_tools\` records connect/decline decisions and credential-ingress requests (vault refs only).
+8. \`agent.run_dry_run\` / \`rost_run_agent_dry_run\` rehearses the task after the manifest is signed.
 
 ## Dry run and go-live
 
@@ -42139,7 +42145,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-06-20.4",
+    version: "2026-06-21.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -42231,7 +42237,7 @@ Before an agent goes live, the sandbox dry run rehearses this against fake data
 
 ## What humans should review
 
-The Agents page shows fleet health first: live state, recent runs, failed runs, open held actions, last activity, cost, and the next operator action. It also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason.
+The Agents page shows fleet health first: live state, recent runs, failed runs, open held actions, last activity, cost, and the next operator action. It also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason.
 
 Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
   },
@@ -42325,7 +42331,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-06-20.4",
+    version: "2026-06-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42378,7 +42384,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-20.12",
+    version: "2026-06-21.10",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42418,6 +42424,22 @@ External connectors are being rolled out provider by provider, conservatively (r
       "agent.get_run",
       "agent.list_runs",
       "agent.list_tool_calls",
+      "skill.list",
+      "skill.catalog",
+      "skill.enable_catalog",
+      "skill.install_local",
+      "skill.sync_local",
+      "skill.get",
+      "skill.file.get",
+      "skill.assigned.list",
+      "skill.check_dependencies",
+      "skill.create",
+      "skill.update_draft",
+      "skill.import_github",
+      "skill.import_upload",
+      "skill.publish",
+      "skill.assign_to_seat",
+      "skill.revoke_from_seat",
       "integration.list",
       "integration.readiness",
       "integration.status",
@@ -42544,7 +42566,7 @@ For CI, do not run an interactive device login on every job (a device code still
 
 ## First-run path
 
-This is the install/auth quickstart \u2014 it gets you logged in, MCP registered, and onboarding started. It is a convenience view, not the full org-setup procedure: for the canonical end-to-end setup order beyond install, \`agent-reference-map\` is the source of truth (its 19-step Standard Setup Order). Read it with \`{{cli}} reference get agent-reference-map\` (step 6 below).
+This is the install/auth quickstart \u2014 it gets you logged in, MCP registered, and onboarding started. It is a convenience view, not the full org-setup procedure: for the canonical end-to-end setup order beyond install, \`agent-reference-map\` is the source of truth. Read it with \`{{cli}} reference get agent-reference-map\` (step 6 below).
 
 1. Log in: \`npx {{cliPackage}}@latest login\` (or \`{{cli}} login --device\` for a headless agent)
 2. Confirm identity: \`{{cli}} whoami\`
@@ -42701,12 +42723,12 @@ A leaked tenant-admin token can administer the whole tenant, not just one seat.
 
 ### Storing the Anthropic key and other credentials
 
-Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key, or \`rost_store_credential\` (\`credential.ingress\`) for other secrets; \`rost_configure_agent_tools\` stages credential requests but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for the confirmation gate, see the confirmations-guide.
+Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key, or \`rost_store_credential\` (\`credential.ingress\`) for other secrets; \`rost_configure_agent_tools\` stages credential requests but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
 
 ## When to use MCP or CLI
 
 - A technical operator wants to drive onboarding from a local agent session.
-- A partner wants to use their own local model subscription.
+- A partner wants to use their own local model subscription. Read the ai-model-data-handling-guide first so the operator can verify the local provider account, retention, telemetry, and transcript settings instead of assuming {{brand}} controls them.
 - A Steward wants a local agent to inspect context, draft changes, or prepare work.
 - A developer wants repeatable setup commands.
 
@@ -42784,6 +42806,8 @@ Ergonomic subcommands for everyday operation. Each wrapper is sugar over the sam
 
 These ergonomic wrappers (including the \`{{cli}} agent\` group) require **{{cli}} 0.2.0 or newer** \u2014 run \`npx {{cliPackage}}@latest \u2026\` to get them. Older versions can still reach every command through the \`{{cli}} command <id> --json\` floor, since command execution is server-side.
 
+The signed-in app exposes the same Skill command surface under **Skills** in the left sidebar. Use \`/skills\` to filter the tenant library, \`/skills/new\` to build canonical \`SKILL.md\` frontmatter with \`tool.catalog\` dependencies, \`/skills/import\` for bounded GitHub or upload imports, and each Skill detail page to review validation, publish, check Seat dependencies, and assign a published version. During \`/agents/new\`, \`agent_setup.get\` can return \`next_action: "choose_skills"\`; selected Skills are proposed immutable-version assignments and required Skill tools block sign-off/go-live until tool configuration is ready.
+
 | Command | Command ids | Purpose | Scope | Safe example |
 |---|---|---|---|---|
 | \`{{cli}} task list|accept|decline|complete|create\` | \`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`, \`task.create\` | Operate a seat's task queue. | Seat | \`{{cli}} task list --json\` |
@@ -42798,14 +42822,34 @@ These ergonomic wrappers (including the \`{{cli}} agent\` group) require **{{cli
 | \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} settings get|update\` | \`settings.get\`, \`settings.update\` | Read tenant settings; update budget caps. | Tenant | \`{{cli}} settings get --json\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
-| \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
+| \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
-| \`{{cli}} skills list|get|file|assigned|check-dependencies\` | \`skill.list\`, \`skill.get\`, \`skill.file.get\`, \`skill.assigned.list\`, \`skill.check_dependencies\` | Discover reusable Skills, read descriptors and stored package files, list approved Seat assignments, and compare required/optional tool dependencies with a Seat's signed Charter manifest. Skills are instructions, not authority. | Tenant and seat | \`{{cli}} skills list --json\`; \`{{cli}} skills file --slug invoice-review --path SKILL.md\` |
-| \`{{cli}} skills create|update-draft|import|publish|assign|revoke\` | \`skill.create\`, \`skill.update_draft\`, \`skill.import_github\`, \`skill.import_upload\`, \`skill.publish\`, \`skill.assign_to_seat\`, \`skill.revoke_from_seat\` | Create or import bounded text Skill packages, publish reviewed immutable versions, propose or approve Seat assignments, and revoke future use without deleting historical activations. Publish, revoke, and approved assignment stop at human confirmation; blocked required tools cannot be approved. | Tenant and seat | \`{{cli}} skills import github --url https://github.com/acme/skills/tree/main/ap --json\`; \`{{cli}} skills assign --seat-id <id> --slug invoice-review --json\` |
+| \`{{cli}} skills list|get|file|assigned|check-dependencies\` | \`skill.list\`, \`skill.get\`, \`skill.file.get\`, \`skill.assigned.list\`, \`skill.check_dependencies\` | Discover reusable Skills, read descriptors and stored package files, list approved Seat assignments, and compare required/optional tool dependencies with a Seat's signed Charter manifest. Skills are instructions, not authority. | Tenant-admin; seat-scoped reads for assigned Skills | \`{{cli}} skills list --json\`; \`{{cli}} skills file --slug invoice-review --path SKILL.md\` |
+| \`{{cli}} skills catalog|enable|install|sync\` | \`skill.catalog\`, \`skill.enable_catalog\`, \`skill.install_local\`, \`skill.sync_local\` | Discover entitled {{brand}} catalog Skills, enable a catalog Skill into the company library with human confirmation, and install or sync approved Skill files locally from {{brand}} APIs. Private catalog source URLs and GitHub tokens never go to local agents. | Tenant-admin for catalog enablement; seat-scoped sync for assigned Skills | \`{{cli}} skills sync --seat-id <id> --client codex\`; \`{{cli}} skills install rost/ap-review --seat-id <id> --client codex\` |
+| \`{{cli}} skills create|update-draft|import|publish|assign|revoke\` | \`skill.create\`, \`skill.update_draft\`, \`skill.import_github\`, \`skill.import_upload\`, \`skill.publish\`, \`skill.assign_to_seat\`, \`skill.revoke_from_seat\` | Create or import bounded text Skill packages, publish reviewed immutable versions, propose Seat assignments, and revoke future use without deleting historical activations. Publish, revoke, and approved assignment stop at human confirmation; blocked required tools cannot be approved. | Tenant-admin writes; seat agents read assignments and escalate requests | \`{{cli}} skills import github --url https://github.com/acme/skills/tree/main/ap --json\`; \`{{cli}} skills assign --seat-id <id> --slug invoice-review --json\` |
 | \`{{cli}} model list\` | \`model.catalog\` | List guided model tiers with recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | \`{{cli}} model list --json\` |
 | \`{{cli}} compass show\` | \`compass.show_markdown\` | Render the current Compass as a clean markdown card for review. | Tenant | \`{{cli}} compass show --markdown\` |
 | \`{{cli}} charter show\` | \`charter.show_markdown\` | Render a seat's Charter as a clean markdown card for review. | Tenant | \`{{cli}} charter show --seat-id <id> --markdown\` |
 
+Skills wrapper help:
+
+\`\`\`text
+{{cli}} skills list [--json]
+{{cli}} skills catalog [--json]
+{{cli}} skills get --slug <slug> [--json]
+{{cli}} skills file --slug <slug> --path SKILL.md
+{{cli}} skills enable rost/<slug> [--json]
+{{cli}} skills install <slug-or-rost/slug> [--seat-id <id>] [--client claude-code|codex|cursor] [--version <n>] [--local-only] [--json]
+{{cli}} skills sync --seat-id <id> [--client claude-code|codex|cursor] [--json]
+{{cli}} skills assign --seat-id <id> (--skill <slug>|--slug <slug>|--skill-version-id <id>) [--approve] [--allow-blocked-proposal] [--json]
+{{cli}} skills revoke (--assignment-id <id>|--seat-id <id> --skill <slug>) [--json]
+{{cli}} skills publish (--slug <slug>|--skill-version-id <id>) [--allow-warnings] [--json]
+\`\`\`
+
+\`{{cli}} skills install\` writes into the client Skills directory and records \`.rost-skill.json\` with \`skill_version_id\`, \`content_sha256\`, source, client, and \`installed_from: "rost_api"\`. Set \`ROST_SKILL_INSTALL_ROOT\` to override the local root in CI or a sandbox. Use \`install\` for one Skill and \`sync\` as the default local-agent command because it installs every approved Skill assigned to the Seat and skips unchanged local copies by hash. Entitlement failures mean the tenant cannot access that {{brand}} catalog tier yet; stale local copies are fixed by rerunning \`sync\`; private catalog access is always served by {{brand}} APIs, not by giving the agent a private GitHub credential.
+
+{{brand}}-maintained catalog entries are seeded from first-party Skill packages with stable content hashes, application descriptors, and declared required or optional tool dependencies. Catalog seed validation is fail-closed: a package with parser warnings is not published. Enabling a catalog Skill copies the current immutable version into the company library; later catalog refreshes update the global catalog row but do not silently rewrite already-enabled tenant Skill versions.
+
 ### MCP registration
 
 | Command | Purpose | Scope | Safe example |
@@ -42902,8 +42946,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_agent_fleet\` | \`agent.list_fleet\` | Read every staffed agent seat at once: lane, live state, last real turn, 24h/7d real turns, measurable status, escalations, and 7-day spend. | Tenant | Call with \`{}\`; counts use the same seat-run association as \`agent.list_runs\`, with sandbox dry runs excluded from real turns. |
 | \`rost_get_dogfood_fleet_health_digest\` | \`agent.fleet_digest\` | Capture the daily dogfood fleet-health digest: live/idle state, 24h/7d turns, spend, recent failed runs, unresolved errors, failed notifications, and next actions. | Tenant | Call with \`{}\`; optional \`window_hours\` bounds recent failed-run evidence, while \`error_limit\` caps linked evidence per seat. |
 | \`rost_run_agent_now\` | \`agent.run_now\` | Queue an immediate run for a live staffed agent without changing its saved schedule; cloud lane dispatches to the executor and runner lane queues for the paired runner. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
-| \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run tool-call and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
-| \`rost_get_agent_run_diagnostics\` | \`agent.get_run\` | Read one run's diagnostic record: transcript reference, token/cost usage, outcome, and linked product-visible run errors. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","run_id":"<run-id>"}\`. |
+| \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run Skill activation, tool-call, and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
+| \`rost_get_agent_run_diagnostics\` | \`agent.get_run\` | Read one run's diagnostic record: transcript reference, token/cost usage, outcome, linked product-visible run errors, and loaded Skill activation file metadata. File hashes/sizes identify the immutable source package, while model prompt text may be bounded or truncated. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","run_id":"<run-id>"}\`. |
 | \`rost_list_agent_tool_calls\` | \`agent.list_tool_calls\` | Read a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Never returns argument summaries or secret material. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`held_only: true\` for only guard-held calls. |
 | \`rost_list_agent_templates\` | \`agent_template.list\` | List stock agent templates and metadata. | Tenant | Call with \`{}\`. |
 | \`rost_create_agent_from_template\` | \`agent.create_from_template\` | Create a draft stock agent and draft Charter from a template (draft-only; occupancy needs a human steward). | Tenant | Call with \`seat_id\` and \`template_slug\`; expect human confirmation. |
@@ -42968,6 +43012,10 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
 | \`rost_list_skills\` | \`skill.list\` | List tenant Skills with application descriptors, dependency metadata, source status, latest version, and assigned Seat count. Seat-scoped reads are available through \`rost://skills\`. | Tenant-admin | Call with \`{}\` or \`{"query":"invoice"}\`. |
+| \`rost_list_rost_skill_catalog\` | \`skill.catalog\` | List entitled {{brand}} catalog Skills. Private catalog source URLs and credentials stay server-side. | Tenant-admin | Call with \`{}\`; use \`{"include_unentitled":true}\` only to inspect tier availability. |
+| \`rost_enable_rost_catalog_skill\` | \`skill.enable_catalog\` | Enable an entitled {{brand}} catalog Skill into the company library with human confirmation. | Tenant-admin | Call with \`{"slug":"rost/ap-review"}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_install_skill_locally\` | \`skill.install_local\` | Resolve company or entitled {{brand}} catalog Skill files from {{brand}} APIs for a local client install. It returns package files and metadata, not private GitHub URLs. | Tenant-admin | Call with \`{"slug":"invoice-review","client":"codex"}\`; \`rost/<slug>\` enablement may require confirmation. |
+| \`rost_sync_assigned_skills_locally\` | \`skill.sync_local\` | Resolve every approved Skill assigned to a Seat plus revoked local-copy markers for a local client sync. | Tenant-admin | Call with \`{"seat_id":"<seat-id>","client":"codex"}\`; local clients remove revoked copies. |
 | \`rost_get_skill\` | \`skill.get\` | Read one Skill descriptor and latest stored version metadata. Seat-scoped reads are available through \`rost://skills/{slug}\`. | Tenant-admin | Call with \`{"slug":"invoice-review"}\`. |
 | \`rost_get_skill_file\` | \`skill.file.get\` | Read stored Skill package file content by slug and package path; paths resolve only inside the stored package payload. Seat-scoped reads are available through \`rost://skills/{slug}/files/{path}\`. | Tenant-admin | Call with \`{"slug":"invoice-review","path":"SKILL.md"}\`. |
 | \`rost_list_assigned_skills\` | \`skill.assigned.list\` | List approved Skill assignments for a Seat, including immutable version, dependency status, rationale, and approval time. Seat-scoped reads are available through \`rost://seat/{id}/skills\`. | Tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
@@ -43037,11 +43085,285 @@ These rows are quick, at-a-glance triage. For deeper auth, tenant, scope, confir
 `
   },
   {
-    slug: "agent-reference-map",
+    slug: "skill-builder-guide",
     order: 49,
+    title: "Skill builder guide",
+    summary: "Create, import, review, publish, and assign reusable Skills without confusing procedures with authority.",
+    version: "2026-06-21.1",
+    public: true,
+    audiences: ["human", "cli", "mcp", "in_app_agent"],
+    stages: ["staffing", "operating_rhythm"],
+    relatedCommandIds: ["skill.list", "skill.catalog", "skill.get", "skill.file.get", "skill.create", "skill.update_draft", "skill.import_github", "skill.import_upload", "skill.publish", "skill.check_dependencies", "skill.assign_to_seat", "skill.revoke_from_seat", "agent.configure_tools", "confirmation.approve"],
+    legal: { publicRisk: "low", notes: ["Public guidance for tenant-authored and imported Skills."] },
+    sources: [
+      {
+        label: "Agent Skills implementation plan",
+        internalPath: "docs/specs/agent-skills-implementation-plan.md",
+        note: "Defines the Skills product boundary, governance model, and setup workflow."
+      }
+    ],
+    body: `# Skill builder guide
+
+Skills are reusable procedure packages. Use them for repeatable work patterns, domain-specific output contracts, local or client workflow setup, examples, templates, and company-standard operating routines.
+
+Skills are not authority. A Skill cannot grant a tool, approve a payment, change a Charter, store a secret, or bypass a human confirmation. The Charter, signed permission manifest, and server-side tool guard remain the control plane.
+
+## When to add a Skill
+
+Add a Skill when the procedure will be reused by more than one task or run:
+
+- A standard operating procedure such as AP exception review, weekly sync health checks, or support triage.
+- A required output contract such as named sections, evidence fields, or review checklist order.
+- A local-agent setup pattern that must be installed into Codex, Claude Code, or another client.
+- A reusable template, example, or evaluation fixture that helps agents produce consistent work.
+
+Do not add a Skill for authorization, secrets, one-off task context, temporary preferences, or rules that belong in the Charter. Put durable authority, must-escalate boundaries, and tool permissions in the Charter and permission manifest.
+
+## Package shape
+
+Every package has a \`SKILL.md\` file and may include bounded support files under \`references/\`, \`templates/\`, \`examples/\`, \`evals/\`, or \`scripts/\`. The frontmatter should define:
+
+- \`application\`: a short summary, when to use the Skill, and when not to use it.
+- \`required_tools\`: tool ids and minimum scope tiers that must exist before an approved assignment can be used safely.
+- \`optional_tools\`: useful tools that produce warnings when absent but do not block assignment.
+
+Use tool ids from \`tool.catalog\` / \`rost_list_tool_catalog\`. Required and optional tool entries are dependency declarations only; they never grant access.
+
+## Create or import
+
+Use the shared command path from the app, CLI, or tenant-admin MCP:
+
+- Create: \`skill.create\` / \`rost_create_skill\` with a bounded text package.
+- Update a draft: \`skill.update_draft\` / \`rost_update_skill_draft\`.
+- Import public GitHub: \`skill.import_github\` / \`rost_import_github_skill\`; {{brand}} records source URL, resolved ref, path, and content hash.
+- Import uploaded text: \`skill.import_upload\` / \`rost_import_uploaded_skill\`; MCP accepts structured text packages, not direct binary uploads.
+
+Imported Skills are untrusted until parsed, scanned, validated, and reviewed. Validation warnings should be fixed before publication.
+
+## Review and publish
+
+Publishing creates an immutable Skill version. Later edits create a new version; they do not rewrite what a prior agent run used. \`skill.publish\` is human-gated. Agent actors may draft or import, but they do not approve publication.
+
+Review before publishing:
+
+- The procedure is reusable and bounded.
+- It contains no secrets, keys, private tokens, or raw credential material.
+- Required tools are truly required; optional tools are not blockers.
+- The output contract does not ask the agent to exceed the Charter.
+- Support files are necessary and small enough to load safely.
+
+## Assign to a Seat
+
+Assignment pins a published immutable version to a Seat. Run \`skill.check_dependencies\` before \`skill.assign_to_seat\`.
+
+Dependency results mean:
+
+- \`ready\`: required tools meet the Skill's minimum scope tiers.
+- \`blocked\`: at least one required tool is missing, declined, or under-scoped. Approval is blocked.
+- \`warning\`: optional tools are missing or under-scoped. Assignment can proceed, but the operator should understand the degraded path.
+
+Fix blockers by updating the Seat's Charter permission manifest through \`agent.configure_tools\` and human sign-off. Do not edit the Skill to pretend authorization exists.
+
+## {{brand}} catalog and local install
+
+The {{brand}} catalog is first-party, entitlement-filtered, and private-source-safe. Use \`skill.catalog\` to list entitled catalog Skills, then \`skill.enable_catalog\` to copy an entitled catalog Skill into the company library with human confirmation. Standard tenants do not see private beta catalog entries unless explicitly entitled.
+
+Use \`skill.install_local\` for one Skill and \`skill.sync_local\` for all approved Skills assigned to a Seat. Local clients receive package files and \`.rost-skill.json\` metadata from {{brand}} APIs; private catalog GitHub URLs, signed URLs, and credentials are not returned.`
+  },
+  {
+    slug: "agent-skill-authoring-guide",
+    order: 50,
+    title: "Agent Skill authoring guide",
+    summary: "How CLI and MCP agents should propose reusable Skills safely.",
+    version: "2026-06-21.2",
+    public: true,
+    audiences: ["cli", "mcp", "in_app_agent"],
+    stages: ["staffing", "operating_rhythm"],
+    relatedCommandIds: ["skill.list", "skill.get", "skill.file.get", "skill.create", "skill.update_draft", "skill.import_github", "skill.import_upload", "skill.publish", "tool.catalog", "confirmation.approve"],
+    legal: { publicRisk: "low", notes: ["Machine-facing authoring guidance for safe Skill creation."] },
+    sources: [
+      {
+        label: "Agent Skills implementation plan",
+        internalPath: "docs/specs/agent-skills-implementation-plan.md",
+        note: "Defines agent-facing authoring constraints and safety boundaries."
+      }
+    ],
+    body: `# Agent Skill authoring guide
+
+Use this guide when you are a CLI or MCP agent asked to create, import, or revise a Skill.
+
+## First, check what already exists
+
+Do not create a duplicate procedure. Before authoring:
+
+1. Read \`agent-reference-map\`.
+2. Run \`skill.list\` / \`rost_list_skills\` and search by the job words.
+3. If the procedure may be first-party, run \`skill.catalog\` / \`rost_list_rost_skill_catalog\`.
+4. Read matching descriptors with \`skill.get\` and the full file with \`skill.file.get\`.
+
+If an existing Skill is close, propose an update draft or assignment instead of a new Skill.
+
+## Decide whether a Skill is appropriate
+
+Create a Skill for repeatable procedures, domain-specific output contracts, local/client setup patterns, reusable examples, and company operating standards.
+
+Do not create a Skill for:
+
+- Authorization or tool access.
+- Secrets, credentials, API keys, or vault refs.
+- One-off evidence that belongs on the task.
+- Temporary style preferences.
+- Charter rules, escalation boundaries, or human decision policy.
+
+If the user asks for authority, update the Charter path. If the user gives one-off evidence, keep it in the task context.
+
+## Authoring checklist
+
+The \`SKILL.md\` body should be short, procedural, and testable. Include:
+
+- A clear title.
+- An \`application.summary\` that says when to use it.
+- \`application.not_for\` for risky or out-of-scope cases.
+- Required and optional tools only when the procedure genuinely needs them.
+- An output contract when consistency matters.
+- Missing-evidence behavior: state what is missing instead of guessing.
+
+Use \`tool.catalog\` before naming a tool. Required tool scope tiers must be the minimum useful scope. Optional tools are for improved delivery, not hidden blockers.
+
+## Safe command path
+
+- Draft: \`skill.create\` or \`skill.update_draft\`.
+- Public GitHub import: \`skill.import_github\` with the URL, ref, and package path.
+- Uploaded text import: \`skill.import_upload\`.
+- Publish: \`skill.publish\` returns a human confirmation. Stop and ask the human to approve or reject.
+
+Never approve your own publication. Never paste secrets into \`SKILL.md\`, support files, command JSON, issue comments, or logs.
+
+## Quality bar
+
+Before handing off, say what the Skill is for, why it is reusable, what tools it depends on, and what human gate remains. If validation warnings exist, fix them or call them out as blockers.`
+  },
+  {
+    slug: "agent-skill-setup-guide",
+    order: 51,
+    title: "Agent Skill setup guide",
+    summary: "CLI and MCP recipes for discovering, reading, dependency-checking, assigning, and locally syncing Skills.",
+    version: "2026-06-21.1",
+    public: true,
+    audiences: ["cli", "mcp", "in_app_agent"],
+    stages: ["staffing", "operating_rhythm"],
+    relatedCommandIds: ["skill.list", "skill.catalog", "skill.enable_catalog", "skill.get", "skill.file.get", "skill.assigned.list", "skill.check_dependencies", "skill.install_local", "skill.sync_local", "skill.import_github", "skill.import_upload", "skill.assign_to_seat", "agent.configure_tools", "confirmation.approve"],
+    legal: { publicRisk: "low", notes: ["Machine-facing setup recipes for Skills over CLI and MCP."] },
+    sources: [
+      {
+        label: "Agent Skills implementation plan",
+        internalPath: "docs/specs/agent-skills-implementation-plan.md",
+        note: "Defines CLI/MCP setup sequence, dependency handling, and local sync behavior."
+      }
+    ],
+    body: `# Agent Skill setup guide
+
+Use this guide before creating, enabling, assigning, or locally installing Skills from CLI or MCP.
+
+## Setup sequence
+
+1. Read \`agent-reference-map\`.
+2. List company Skills: \`skill.list\` / \`rost_list_skills\` or read \`rost://skills\`.
+3. List {{brand}} catalog Skills when needed: \`skill.catalog\` / \`rost_list_rost_skill_catalog\`.
+4. Read descriptors: \`skill.get\` / \`rost_get_skill\` or \`rost://skills/{slug}\`.
+5. Read full files before assignment: \`skill.file.get\` / \`rost_get_skill_file\` or \`rost://skills/{slug}/files/SKILL.md\`.
+6. Check dependencies for the target Seat: \`skill.check_dependencies\` / \`rost_check_skill_dependencies\`.
+7. Tenant-admin command callers propose assignment with \`skill.assign_to_seat\` / \`rost_assign_skill_to_seat\`; seat-scoped agents read assigned Skills and escalate assignment requests to a human or tenant-admin.
+8. After approval, list assignments with \`skill.assigned.list\` or \`rost://seat/{id}/skills\`.
+9. For local clients, run \`skill.sync_local\` / \`rost_sync_assigned_skills_locally\`.
+
+Tenant-admin command callers may propose assignments; seat-scoped agents escalate assignment requests. Humans approve publication, approved assignment, revocation, and Charter or manifest changes.
+
+## Attach an existing company Skill to a new Seat
+
+Tenant-admin CLI:
+
+\`\`\`bash
+{{cli}} skills list --json
+{{cli}} skills get --slug invoice-review --json
+{{cli}} skills file --slug invoice-review --path SKILL.md
+{{cli}} skills check-dependencies --seat-id <seat-id> --slug invoice-review --json
+{{cli}} skills assign --seat-id <seat-id> --slug invoice-review --rationale "Use for AP exception work." --json
+\`\`\`
+
+Tenant-admin MCP:
+
+1. Call \`rost_list_skills\` with \`{}\`.
+2. Call \`rost_get_skill\` and \`rost_get_skill_file\`.
+3. Call \`rost_check_skill_dependencies\` with \`{"seat_id":"<seat-id>","slug":"invoice-review"}\`.
+4. If ready, call \`rost_assign_skill_to_seat\` with \`status:"proposed"\`.
+
+Seat-scoped MCP agents cannot call generated Skill assignment tools. They should read \`rost://seat/{id}/skills\`, read relevant assigned files through \`rost://skills/{slug}/files/{path}\`, and escalate when a new assignment or permission change is needed.
+
+If required tools are blocked, call \`rost_configure_agent_tools\` only when the human wants to amend the permission manifest. Then wait for the normal Charter/tool approval path.
+
+## Enable a {{brand}} catalog Skill and assign it
+
+CLI:
+
+\`\`\`bash
+{{cli}} skills catalog --json
+{{cli}} skills enable rost/ap-exception-brief --json
+{{cli}} skills check-dependencies --seat-id <seat-id> --slug ap-exception-brief --json
+{{cli}} skills assign --seat-id <seat-id> --slug ap-exception-brief --rationale "Use the first-party AP exception procedure." --json
+\`\`\`
+
+\`skill.enable_catalog\` creates a company-owned immutable copy and may return a human confirmation. Do not re-run blindly after approval; read the approval output or list Skills again.
+
+Tenant-admin MCP:
+
+1. Call \`rost_list_rost_skill_catalog\` with \`{}\`.
+2. Call \`rost_enable_rost_catalog_skill\` with \`{"slug":"rost/ap-exception-brief"}\`; if it returns a confirmation, stop for the human approval output.
+3. Call \`rost_check_skill_dependencies\` with the enabled Skill slug and target Seat.
+4. Call \`rost_assign_skill_to_seat\` with \`status:"proposed"\`; do not self-approve assignment.
+
+## Inspect, import, dependency-check, and propose a GitHub Skill
+
+Tenant-admin MCP:
+
+1. Call \`rost_import_github_skill\` with \`{"url":"https://github.com/acme/skills/tree/main/ap","status":"pending_review"}\`.
+2. Read the returned descriptor and validation findings.
+3. Call \`rost_get_skill_file\` for \`SKILL.md\`.
+4. If it should be assignable, ask a human to publish with \`rost_publish_skill\`.
+5. After publication, call \`rost_check_skill_dependencies\`.
+6. Propose assignment with \`rost_assign_skill_to_seat\`.
+
+Uploaded packages use \`rost_import_uploaded_skill\` with structured text files. MCP does not accept direct binary upload in this release.
+
+## Interpret dependency and entitlement output
+
+- \`required_tools\`: must be present at or above \`min_scope_tier\`; missing or under-scoped required tools block approved assignment.
+- \`optional_tools\`: useful but not required; missing optional tools warn only.
+- \`application\`: when to use the Skill and when not to.
+- \`entitlement_status: not_entitled\`: the tenant cannot enable that {{brand}} catalog tier. Do not ask for private source URLs.
+- Duplicate slug or existing company Skill: use the existing Skill or choose a distinct slug; catalog enablement does not overwrite tenant Skills.
+- Local install result \`installed\`, \`unchanged\`, or \`removed\`: the local client wrote, skipped by hash, or removed a revoked copy.
+
+Good assignment: the Seat's Charter already owns AP exception review, the Skill's application matches that work, and \`skill.check_dependencies\` is \`ready\`.
+
+Bad assignment: the Skill requires a payment-write tool the Charter does not grant, or the operator wants the Skill to authorize an approval boundary. Configure the Charter/tool path or choose a narrower Skill instead.
+
+## Local sync
+
+Prefer sync for local agents:
+
+\`\`\`bash
+{{cli}} skills sync --seat-id <seat-id> --client codex --json
+\`\`\`
+
+Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies are derived from {{brand}} command output and include \`.rost-skill.json\` metadata. A local copy is not authority; the server still loads assigned immutable Skill versions and still guards every tool call.`
+  },
+  {
+    slug: "agent-reference-map",
+    order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-06-20.2",
+    version: "2026-06-21.2",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43075,7 +43397,7 @@ Use this map when you are a CLI session, MCP client, or in-app agent and need to
 - Search tool: rost_reference_search
 - Get tool: rost_reference_get
 - Reference resource template: rost://reference/{slug}
-- Operation resources (read-only, scope-enforced): rost://tenant/status, rost://graph, rost://seat/{id}/context, rost://compass/current, rost://sync/latest, rost://operations/reference-map
+- Operation resources (read-only, scope-enforced): rost://tenant/status, rost://graph, rost://seat/{id}/context, rost://compass/current, rost://sync/latest, rost://skills, rost://skills/{slug}, rost://skills/{slug}/files/{path}, rost://seat/{id}/skills, rost://operations/reference-map
 
 Start with rost_reference_search when the user asks a broad question. Use rost_reference_get when a workflow or command metadata already names a guide slug. Read the operation resources to load current tenant/seat facts before mutating; tenant-wide resources need a tenant-admin token and a seat token may read only its own rost://seat/{id}/context.
 
@@ -43116,12 +43438,16 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 11. tool-access-and-vault
 12. available-tools-guide
 13. mcp-and-cli-guide
-14. cascade-guide
-15. signal-guide
-16. friction-guide
-17. confirmations-guide
-18. steward-queue-guide
-19. sync-rhythm-playbook
+14. skill-builder-guide
+15. agent-skill-authoring-guide
+16. agent-skill-setup-guide
+17. ai-model-data-handling-guide
+18. cascade-guide
+19. signal-guide
+20. friction-guide
+21. confirmations-guide
+22. steward-queue-guide
+23. sync-rhythm-playbook
 
 ## Workflow to guide map
 
@@ -43135,6 +43461,9 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Add an agent through the app (graph or sidebar, visual journey): add-agents-guide.
 - Create an agent from a template: stock-agents-guide, then how-agents-work.
 - Create a custom agent (operational answers, Charter Builder, configure tools, dry run, go live): custom-agents-guide, then agent-staffing-playbook and tool-access-and-vault.
+- Create, import, review, or publish a reusable Skill: skill-builder-guide for human workflow, then agent-skill-authoring-guide for CLI/MCP authoring rules.
+- Assign, dependency-check, enable a catalog Skill, import a GitHub Skill, or sync local Skill files: agent-skill-setup-guide, then mcp-and-cli-guide.
+- Explain AI model data handling, BYOK, local agent provider settings, or what data may enter prompts/tool calls: ai-model-data-handling-guide, then security-model-guide.
 - Build a controlled agent worker directly on the CLI/MCP path (seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live): agent-builder-guide \u2014 it shows the full setup sequence, the structured model config, the model catalog (model.catalog), the access tiers, how to discover tools (tool.catalog), which connector entries have live execution boundaries, and how to show your human a markdown readout (agent.show_markdown).
 - Connect an existing or local agent to a seat: stock-agents-guide (connect section), then mcp-and-cli-guide and runner-guide.
 - Run the operating loop as a seat (context, tasks, status, escalate): how-agents-work.
@@ -43151,10 +43480,10 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Company setup: rost-implementation-method, compass-authoring-guide, settings-guide, settings-members-and-invites-guide
 - Graph design: responsibility-graph-playbook
 - Charter design: charter-design-playbook, charter-authoring-deep-dive
-- Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, how-agents-work, tool-access-and-vault, available-tools-guide, mcp-and-cli-guide, stock-agents-guide
+- Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
 - Operating rhythm: cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
 - Local agents and runners: mcp-and-cli-guide, runner-guide, agent-reference-map
-- Security and troubleshooting: security-model-guide, troubleshooting-guide
+- Security and troubleshooting: ai-model-data-handling-guide, security-model-guide, troubleshooting-guide
 
 ## Agent behavior
 
@@ -43500,7 +43829,7 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-06-20.7",
+    version: "2026-06-21.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -43552,7 +43881,7 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 
 - Set the hard cap with \`settings.update\` (CLI: \`{{cli}} settings update --hard-cap-usd <amount>\`). The optional soft cap warns before the hard cap and must be less than or equal to it.
 - The sandbox dry run is free and is never blocked by the cap, so a fresh company can charter, dry-run, and take an agent live before setting a budget. The cap applies only to real managed-inference runs.
-- A company that brings its own provider key (BYOK) is metered on that key and is not subject to the {{brand}}-managed hard cap.
+- A company that brings its own provider key (BYOK) is metered on that key and is not subject to the {{brand}}-managed hard cap. BYOK changes the provider account used for eligible cloud calls, not the Charter, tool guard, human gate, or data-retention posture; see the ai-model-data-handling-guide before making provider-handling claims.
 
 ## Agent guidance
 
@@ -43869,15 +44198,200 @@ Most reads are safe to run while diagnosing. Any fix that changes authority, cre
 Name the failing surface, collect evidence, recommend the smallest correction, and escalate when the fix changes authority, credentials, or go-live state. Never paste secrets into chat or tool arguments while troubleshooting.`
   },
   {
-    slug: "security-model-guide",
+    slug: "ai-model-data-handling-guide",
     order: 78,
+    title: "AI model data handling guide",
+    summary: "How {{brand}} cloud agents, local MCP sessions, runners, BYOK, and connected tools handle model-bound data.",
+    version: "2026-06-21.4",
+    public: true,
+    audiences: ["human", "cli", "mcp", "in_app_agent"],
+    stages: ["company_setup", "staffing", "operating_rhythm"],
+    relatedCommandIds: [
+      "tenant.anthropic_key.save",
+      "credential.ingress",
+      "agent.configure_tools",
+      "mcp_token.create",
+      "runner.pairing.start",
+      "agent.run_now",
+      "work_order.enqueue",
+      "tool.catalog"
+    ],
+    legal: {
+      publicRisk: "medium",
+      notes: [
+        "Provider policy summary must stay conservative and source-linked.",
+        "Does not claim zero-data-retention, HIPAA readiness, or model-training exclusions beyond provider account and contract scope."
+      ]
+    },
+    sources: [
+      {
+        label: "OpenAI API data controls",
+        url: "https://developers.openai.com/api/docs/guides/your-data",
+        note: "Official API data-use and retention controls verified 2026-06-21."
+      },
+      {
+        label: "OpenAI enterprise privacy",
+        url: "https://openai.com/enterprise-privacy/",
+        note: "Official enterprise privacy and API retention summary verified 2026-06-21."
+      },
+      {
+        label: "OpenAI Codex with ChatGPT plan",
+        url: "https://help.openai.com/en/articles/11369540-using-codex-with-your-chatgpt-plan",
+        note: "Official Codex plan data-control scope verified 2026-06-21."
+      },
+      {
+        label: "Anthropic API and data retention",
+        url: "https://platform.claude.com/docs/en/manage-claude/api-and-data-retention",
+        note: "Official Claude API ZDR, HIPAA, and retention scope verified 2026-06-21."
+      },
+      {
+        label: "Claude Code data usage",
+        url: "https://code.claude.com/docs/en/data-usage",
+        note: "Official local Claude Code data-flow, training, and retention summary verified 2026-06-21."
+      },
+      {
+        label: "Reference corpus and docs spec",
+        internalPath: "docs/specs/reference-corpus-and-docs.md",
+        note: "Defines the public reference guide set and agent retrieval surfaces."
+      }
+    ],
+    body: `# AI model data handling guide
+
+Use this guide when a human, CLI session, MCP client, or in-app agent needs to understand what data can reach an AI model, what {{brand}} controls, and what remains governed by the customer's provider account, local client, or connected tools.
+
+This is product guidance, not a legal warranty. Provider terms, enterprise contracts, data-processing addenda, retention controls, regional settings, and endpoint-specific behavior can change. Verify the provider account and contract before relying on a zero-data-retention, HIPAA, regional, or no-training posture.
+
+For {{brand}}'s own product-improvement posture, read the public Privacy Policy and Terms of Service at \`/privacy\` and \`/terms\`. They state that {{brand}} may analyze aggregated or de-identified data about usage, setup patterns, agent outcomes, and operating metrics to improve product features, defaults, templates, recommendations, safety checks, and reliability; they also state that {{brand}} does not sell customer data, share one customer's workspace data with another customer, or use identifiable customer content to train generalized AI models. Google user data and information derived from Google APIs stay under the Privacy Policy's Google user data limits and are not included in cross-customer product-improvement analytics. Do not turn this into a provider-side claim about a customer's local client, BYOK provider account, or third-party tool.
+
+## The three agent lanes
+
+{{brand}} names the execution lane on runs and work orders. Use these exact terms:
+
+| Lane | Where model-bound data is assembled | Who controls provider handling |
+|---|---|---|
+| \`cloud\` | The {{brand}} cloud runtime builds bounded prompt context from the Seat Charter, signed permission manifest, task or work order, relevant operating facts, selected Skill files, and tool results. | The current managed cloud path uses Anthropic-backed model configuration, either through {{brand}}'s platform-managed provider account or the tenant's approved BYOK Anthropic credential when that tenant has saved one. |
+| \`mcp_session\` | A local agent client such as Claude Code, Codex, OpenCode, Cursor, or another MCP-capable client asks {{brand}} for scoped context, resources, and command results. | The customer's local client, model provider account, proxy, and provider settings. {{brand}} does not control that local provider's retention, training, telemetry, or local transcript storage. |
+| \`runner\` | A paired runner claims work from {{brand}}, receives bounded work-order context, and may invoke a local or customer-controlled model client to complete the work. | The runner host, local client, and provider account used by that runner. {{brand}} controls the work-order boundary and audit path, not every downstream local model setting. |
+
+When answering "where did my data go?", name the lane first. Do not collapse \`cloud\`, \`mcp_session\`, and \`runner\` into one generic "agent" path.
+
+## Cloud agents
+
+For \`cloud\` runs, {{brand}} prepares the minimum context needed for the Seat to act:
+
+- Charter purpose, responsibilities, autonomous scope, approval scope, escalation rules, Signals, and signed permission manifest.
+- The task, work order, Sync/Friction/Signal context, or human instruction for that run.
+- Assigned Skill summaries and the bounded contents of selected approved Skill files.
+- Tool results that the server-side guard allowed and that are relevant to the next model turn.
+- Model catalog choices and run metadata needed to attribute cost and diagnostics.
+
+Cloud prompts should not include raw credentials, long exports, unrelated customer records, or secret values. A tool result can become model context, so keep tool scopes narrow and connect only the tools the Seat's Charter actually needs. The server-side guard decides whether a tool call is allowed, escalated, or denied; model output and Skill text never grant authority.
+
+## BYOK Anthropic
+
+Tenant BYOK changes which provider account is used for eligible \`cloud\` model calls. It does not loosen tool permissions, human gates, tenant isolation, or audit requirements.
+
+Store a tenant Anthropic key only through \`tenant.anthropic_key.save\` / \`rost_save_tenant_anthropic_key\` or the generic credential ingress path. The key is handled as a vault-backed credential: {{brand}} stores a vault reference and safe metadata, not the raw key in prompts, config, logs, or command output. A human approves the credential flow.
+
+After BYOK is saved, provider-side retention, training, regional, HIPAA, or zero-data-retention posture depends on that Anthropic organization, workspace, model, feature, and contract. Do not tell a customer "BYOK means zero retention" or "BYOK means no training" unless their provider arrangement actually says that.
+
+## Local MCP sessions
+
+In a \`mcp_session\`, {{brand}} is the governed operating-system surface. The local agent client is still its own model client.
+
+{{brand}} can enforce token scope, tenant isolation, command schemas, human confirmations, tool guards, and redacted command output. It cannot decide whether the local client stores transcripts, sends telemetry, opts into model improvement, uses a consumer account, uses a commercial account, routes through a proxy, or applies zero-data-retention settings. Those are local client and provider settings.
+
+{{brand}} command and resource outputs are returned to the local client. Seat context, Charter text, task and Signal facts, reference guide bodies, command JSON, and filtered tool results may become part of that client's provider request unless the operator narrows scope, redacts the input, or uses a provider setting that prevents it. Treat every MCP read as data that can enter the local model transcript.
+
+Before connecting a local agent to sensitive work, verify:
+
+- Which model provider and account the local client is using.
+- Whether the account is consumer, team, enterprise, API, or routed through another platform.
+- Whether model-improvement sharing, telemetry, transcript retention, and local logs are enabled.
+- Whether the client stores session files locally, and where those files live.
+- Whether screenshots, files, terminal output, browser data, or tool results can be included in the client transcript.
+
+For example, official Claude Code docs distinguish consumer and commercial handling, describe local plaintext session transcripts, and state that local clients send prompts and outputs to the configured provider. Official OpenAI API docs distinguish API data controls from consumer products, while official Codex help says ChatGPT training data controls apply to content processed through Codex when Codex is used with a ChatGPT plan. Treat each local agent's provider settings as part of the customer's environment review.
+
+## Runners
+
+A \`runner\` is paired to {{brand}} and claims work orders. {{brand}} records the work-order state, lane, Seat, run diagnostics, and audited tool-call outcomes. The runner host controls the local execution environment.
+
+Keep runner prompts bounded to the work order and Seat context. Do not paste runner bearer secrets, API keys, \`.env\` contents, SSH keys, OAuth tokens, database URLs, or private package credentials into prompts, tool args, screenshots, logs, or status updates. If a runner needs a credential, use the governed credential ingress and vault reference path or the customer's own secure local secret mechanism; do not turn the credential into model context.
+
+If a runner invokes Claude Code, Codex, OpenCode, Cursor, or another local model client, provider data handling follows that local client and account, not the {{brand}} cloud provider path.
+
+## Connected tools and tool results
+
+Connected tools are often the highest-risk data path because a valid tool result may be summarized into the next model turn.
+
+Use these rules:
+
+- Connect the narrowest tool scopes needed for the Seat's Charter.
+- Prefer filtered reads over full exports.
+- Keep credentials in vault refs and tool handlers; do not send raw secret values to the model.
+- Treat third-party tool data handling separately from model-provider data handling.
+- Escalate when a tool would expose regulated data, unusually broad customer records, confidential legal or HR material, or data outside the Seat's approved scope.
+
+Tool selection is never authorization. Every live tool call still passes the server-side guard and writes an audit record.
+
+## What not to put in prompts or tool args
+
+Do not intentionally put these into prompts, MCP tool arguments, runner work orders, Skill files, status updates, or screenshots unless the customer has a documented need and a matching provider/tool contract:
+
+- API keys, OAuth tokens, passwords, session cookies, SSH keys, signing keys, or recovery codes.
+- Raw \`.env\` files, private database URLs, credential vault payloads, or unredacted logs containing secrets.
+- Full customer exports when a filtered subset would answer the question.
+- Payment card data, PHI, government identifiers, or other regulated records without the required contract and workflow.
+- Private source URLs with embedded tokens or signed URLs.
+- Data from another tenant, workspace, account, or seat.
+
+If sensitive data appears by accident, stop, do not repeat it, and route cleanup through the customer's incident process.
+
+## Provider policy checkpoints
+
+For platform-managed \`cloud\` runs and BYOK Anthropic \`cloud\` runs, check the Anthropic account, workspace, model, and contract. As of 2026-06-21, official Anthropic Claude API documentation says retained API data is not used for model training without express permission, that some API features are ZDR-eligible while others are not, and that ZDR, HIPAA readiness, model-specific retention requirements, consumer products, Claude Code, and third-party integrations each have their own scope.
+
+For local OpenAI API-key clients running through \`mcp_session\` or \`runner\`, check the customer's OpenAI organization, project, endpoint, and API data controls. As of 2026-06-21, official OpenAI API documentation says API data is not used to train or improve OpenAI models unless the customer explicitly opts in, and default abuse-monitoring logs may retain customer content for up to 30 days unless approved controls apply. OpenAI says zero data retention is available only for eligible customers, endpoints, and use cases.
+
+For Codex specifically, first identify whether the operator is using Codex through a ChatGPT Free/Plus/Pro, Business, Enterprise, Edu, API, or other workspace path. Official OpenAI Codex help says ChatGPT training data controls apply to whether content processed through Codex may be used to improve OpenAI models when Codex is used with a ChatGPT plan, and that Pro and Plus conversations may be used unless training is disabled. Do not give a Codex user the OpenAI API answer unless they are actually using an API-governed Codex path.
+
+For local Claude Code clients running through \`mcp_session\` or \`runner\`, check whether the customer is using a consumer, team, enterprise, API, or third-party-platform path. Official Claude Code documentation separately describes consumer versus commercial handling, local transcript storage, telemetry, feedback, and provider-specific defaults.
+
+Use those statements only as current provider-doc summaries. Do not convert them into a blanket {{brand}} claim. The correct customer-facing answer is: "Here is the lane, here is what {{brand}} sends, here is which provider account or local client handles it, and here is what to verify in that account before treating the workflow as no-training, zero-retention, HIPAA-ready, or region-bound."
+
+## Agent response checklist
+
+When asked about AI data handling:
+
+1. Identify the lane: \`cloud\`, \`mcp_session\`, or \`runner\`.
+2. Name the specific data classes that can enter the prompt or tool result.
+3. Name whether the provider path is platform-managed, tenant BYOK Anthropic, local client/account, or runner-controlled.
+4. Warn if the answer depends on provider settings, contract terms, ZDR approval, HIPAA readiness, model choice, endpoint, or third-party tool policy.
+5. Recommend the smallest safe next step: narrow the tool scope, use a vault ref, redact the input, switch to the approved provider account, or escalate for human/legal review.`
+  },
+  {
+    slug: "security-model-guide",
+    order: 79,
     title: "Security model guide",
     summary: "How {{brand}} protects tenant data, credentials, tool calls, and human decisions across web, MCP, CLI, and agents.",
-    version: "2026-06-20.1",
+    version: "2026-06-21.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
-    relatedCommandIds: ["mcp_token.create", "mcp_token.revoke", "charter.sign_manifest"],
+    relatedCommandIds: [
+      "mcp_token.create",
+      "mcp_token.revoke",
+      "charter.sign_manifest",
+      "credential.ingress",
+      "tenant.anthropic_key.save",
+      "runner.pairing.start",
+      "agent.configure_tools",
+      "agent.list_tool_calls",
+      "agent.get_run",
+      "integration.status",
+      "integration.readiness"
+    ],
     legal: { publicRisk: "low", notes: ["Public security model summary without internal implementation details."] },
     sources: [
       {
@@ -43903,12 +44417,97 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
 - Tool calls are checked server-side and audited.
 - Agents recommend and draft; humans approve durable decisions.
 - Accepted knowledge changes by supersession, not silent mutation.
+- Skills are reusable procedures, not authority. They are versioned immutably, can declare tool dependencies, and are loaded only after assignment; they never grant tools or override the Charter.
+
+## What {{brand}} stores
+
+{{brand}} stores operating-system state for each tenant so humans and agents can run the company with an audit trail. The main stored categories are:
+
+- Company setup, onboarding state, members, roles, invites, and tenant settings.
+- Compass answers and versions, Responsibility Graph seats, occupancies, Steward links, Charters, signed permission manifests, goals, Signals, Frictions, tasks, decisions, Sync briefs, and events.
+- Agent setup state, model/run metadata, work orders, run diagnostics, transcript references, token and cost usage, Skill assignments, and immutable Skill activation records.
+- Tool-call audit rows: tool id, canonical guard result, safe argument summaries, outcome, evidence labels, escalation state, and error linkage.
+- Integration records, OAuth connection metadata, channel/binding metadata, notification preferences, notification delivery errors, and connector readiness/test results.
+- MCP token metadata, Runner metadata, runner-pairing state, and revocation state. Raw token material and runner bearer secrets are shown only at issuance when the flow requires it and are not retrievable from normal reads.
+- Credential records that contain vault references and safe metadata only. Raw API keys, OAuth refresh tokens, tenant Anthropic keys, Slack tokens, Google tokens, and REST connector secrets stay outside Postgres in the configured vault path.
+- Uploaded or generated documents and bounded extracted context when a user intentionally adds them to onboarding, Compass, Charter, or reference workflows.
+
+Do not store raw passwords, OAuth tokens, API keys, full \`.env\` files, session cookies, private signed URLs, or credential payloads in prompts, Skill files, command JSON, issue comments, logs, or reference docs. If a workflow needs a secret, route it through credential ingress and store a vault reference.
+
+## Access and isolation
+
+Every tenant-scoped product record is scoped by \`tenant_id\`, and database policies are written so one tenant cannot read another tenant's data through normal application access. Server-side tenant context comes from trusted server-side authority, not from client-supplied tenant ids: browser and CLI user sessions use authenticated Supabase claims plus membership, MCP sessions use the authenticated MCP token record, and runner sessions use the authenticated runner credential record.
+
+Human access is role-based through tenant membership:
+
+- Owners can administer tenant settings, integrations, members, MCP tokens, agent setup, and credential flows.
+- Stewards and members usually act through their seat occupancies and assigned responsibilities; some tenant-scoped setup, read, and credential workflows are also available to active tenant members when the command authorization layer allows them.
+
+Seat Steward accountability is separate from the tenant membership role named \`steward\`. A Seat Steward is the human accountability chain for an agent seat and receives escalations for that seat, but being named as a Seat Steward does not silently grant a model permission to act.
+
+Agent authority is seat-scoped even when the machine credential is broader. A seat-scoped MCP token can act only as the seat it was minted for. A paired runner authenticates as a tenant machine credential, claims tenant work orders, and receives seat-scoped work context plus a temporary seat-scoped MCP token for the claimed order; the runner bearer credential itself is not a single-seat credential. Tenant-admin MCP tokens are broader: they can reach workflows in the tenant-admin command surface, bounded by command authorization and guards. Reserve them for setup and administration, and prefer the narrowest scope that can do the job.
+
+Local clients such as Claude Code, Codex, OpenCode, and Cursor may receive command/resource output through MCP. {{brand}} enforces token scope, schemas, tenant isolation, and redaction on the output it returns; the local client and provider account control local transcript storage, telemetry, and model-provider handling. For that model-bound path, use the ai-model-data-handling-guide.
+
+## Credentials and integrations
+
+Credentials are never authority by themselves. A connected Slack, Google, REST, Anthropic, or future integration credential can be used only when all required checks pass:
+
+1. The actor is authorized for the tenant and command.
+2. The Seat Charter and signed permission manifest allow or escalate the tool.
+3. The tool handler exists and validates its input schema.
+4. The integration is connected for the tenant and has an active credential reference.
+5. Any extra binding exists, such as a Slack channel binding, REST host/method/path policy, or provider-specific setup requirement.
+6. Human confirmation is complete when the command or credential flow requires it.
+
+Tool selection is never authorization. A selected tool in setup records the requested permission; live execution still goes through the server-side guard, and the system is designed to write a tool-call audit row for every execution attempt. Standard agent audit reads do not return argument summaries or secret material.
+
+## Audit trail
+
+{{brand}} is designed to explain who or what changed operating state:
+
+- The event log is append-only. Corrections are new events, not edits to old events.
+- Decisions are human-decided records. Agents can draft or recommend, but durable decisions require a human.
+- Charters, Compass versions, and accepted knowledge change by supersession instead of silent overwrite.
+- Agent runs, work orders, tool calls, Skill activations, notification failures, and integration tests leave diagnostic records that can be inspected without exposing raw secrets.
+- Product-visible server/integration/runtime failures are recorded in \`error_logs\` when tenant context is available; pre-auth or tenant-less failures fall back to structured server logging.
+
+When reporting evidence to a human, summarize the relevant fields and include stable ids only when they help trace the record. Do not paste raw secrets, full provider responses, full prompt text, or broad exports into status updates.
+
+## Retention and support access boundaries
+
+{{brand}} keeps the records needed to operate, secure, troubleshoot, audit, and improve the product. This guide does not promise a fixed deletion schedule, zero retention, regional residency, HIPAA readiness, or staff-access workflow beyond what is explicitly stated in the customer contract, product settings, or public legal pages.
+
+Staff and support access should be treated as operationally sensitive. The current public posture is conservative: authorized personnel may access customer information when reasonably needed to operate, secure, or support the service; investigate abuse, reliability, or security issues; comply with law; or respond to a customer request. Google user data and information derived from Google APIs remain subject to the Privacy Policy's Google user data limits: humans may access that data only where the customer gives explicit permission for support, for security, to comply with law, or as required to operate the Google-connected features the customer uses. Do not claim that staff technically cannot access customer data in all circumstances unless that control is included in a separate written agreement and has been implemented for that account.
+
+When support access is needed, use the least data needed to diagnose the issue, prefer tenant-visible product evidence when available, redact secrets, and do not export broad customer datasets for routine support. Avoid asking customers to paste secrets, OAuth tokens, full provider responses, or raw mailbox/spreadsheet content into chat, tickets, issues, or docs. If a customer asks for deletion, retention, legal hold, DPA, BAA, regional processing, customer-visible staff access logs, break-glass approval, or staff-access commitments, escalate instead of improvising an answer.
+
+Retention language by category:
+
+- Workspace operating records such as graph, Charter, goal, Signal, Friction, task, Sync, run, event, and tool-call records are retained while the workspace is active so the product can show history, audit trails, and diagnostics.
+- Connected-service credentials are revoked when an integration is disconnected or the account is closed. Normal reads return credential metadata and vault references, not raw secret material.
+- Security, audit, event, diagnostic, and abuse-prevention records may be retained after an account or workspace deletion request is completed when needed for integrity, legal compliance, dispute resolution, or service protection.
+- Product-improvement analytics use only aggregated or de-identified data under the public Privacy Policy and Terms. Aggregated or de-identified derived metrics may be retained after account closure because they no longer identify a workspace.
+- Google user data and information derived from Google APIs stay under the Privacy Policy's Google user data limits and are not included in cross-customer product-improvement analytics.
+
+Deferred enterprise controls are not current promises: customer-visible staff access logs, formal break-glass approval, support-access approval workflows, customer-managed retention windows, full self-serve data export/deletion, regional data residency, DPA/BAA commitments, and HIPAA readiness require separate implementation or contract review before being promised.
 
 The public Privacy Policy and Terms of Service are available at \`/privacy\` and \`/terms\` before sign-in and from the authenticated app chrome.
 
+Those legal pages state that {{brand}} may analyze aggregated or de-identified data about usage, setup patterns, agent outcomes, and operating metrics to improve product features, defaults, templates, recommendations, safety checks, and reliability. They also state that {{brand}} does not sell customer data, does not share one customer's workspace data with another customer, and does not use identifiable customer content to train generalized AI models. Google user data and information derived from Google APIs stay under the Privacy Policy's Google user data limits and are not included in cross-customer product-improvement analytics. Keep those limits intact when explaining product improvement analytics, and escalate legal/security questions about contracts, deletion, regulated data, or customer-specific commitments.
+
+For model-bound data questions \u2014 including what \`cloud\`, \`mcp_session\`, or \`runner\` sends to an AI provider, what BYOK changes, and what local clients can store or transmit \u2014 read the ai-model-data-handling-guide before making a provider, retention, HIPAA, ZDR, or no-training claim.
+
+## Where to read next
+
+- Read the ai-model-data-handling-guide for model-provider, BYOK, local-client, MCP-session, and runner data paths.
+- Read the tool-access-and-vault guide for credential ingress, vault references, permission manifests, and tool execution boundaries.
+- Read the mcp-and-cli-guide for token scope, installation, rotation, and local-agent setup.
+- Read the runner-guide for runner pairing, local credential storage, bearer-token handling, and queue boundaries.
+
 ## Agent guidance
 
-Never infer permission from the user's wording or a locally available tool. Check the Charter, manifest, and server response. When in doubt, escalate with the evidence and the narrow question a human must decide.`
+Never infer permission from the user's wording, a local client configuration, a connected credential, a Skill, or a locally available tool. Check the tenant, role, seat occupancy, Charter, signed permission manifest, command schema, confirmation state, and server response. When in doubt, escalate with the evidence and the narrow question a human must decide.`
   },
   {
     slug: "migration-and-legal-notes",
@@ -45214,6 +45813,18 @@ function field(record2, key) {
   }
   return String(value);
 }
+function dryRunToolActionLabel(status) {
+  switch (status) {
+    case "intended":
+      return "Would run";
+    case "blocked":
+      return "Blocked";
+    case "escalated":
+      return "Escalated";
+    default:
+      return status;
+  }
+}
 function formatDryRunTranscript(value) {
   const transcript = asRecord(value);
   const steps = asArray(transcript.steps);
@@ -45226,7 +45837,11 @@ function formatDryRunTranscript(value) {
     const guard = record2.guard === null || record2.guard === void 0 ? "" : ` [${field(record2, "guard")}]`;
     return `  ${kind}: ${field(record2, "text")}${guard}`;
   });
-  return ["rehearsal:", ...lines].join("\n");
+  const toolPreview = asArray(transcript.tool_preview).map((action) => {
+    const record2 = asRecord(action);
+    return `  ${dryRunToolActionLabel(field(record2, "status"))}: ${field(record2, "intended_action")} [${field(record2, "tool_name")}]`;
+  });
+  return ["rehearsal:", ...lines, ...toolPreview.length > 0 ? ["tool preview:", ...toolPreview] : []].join("\n");
 }
 function markdownLine(output) {
   const markdown = asRecord(output).markdown;
@@ -46626,6 +47241,431 @@ function ensureTrailingSlash2(value) {
   return value.endsWith("/") ? value : `${value}/`;
 }
 
+// src/skills.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync3, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+var UsageError2 = class extends Error {
+};
+var CLIENTS = /* @__PURE__ */ new Set(["claude-code", "codex", "cursor"]);
+function skillsUsage2(binName = cliBrand.binName) {
+  return [
+    `${binName} skills list [--json]`,
+    `${binName} skills catalog [--json]`,
+    `${binName} skills get --slug <slug> [--json]`,
+    `${binName} skills file --slug <slug> --path SKILL.md`,
+    `${binName} skills enable rost/<slug> [--json]`,
+    `${binName} skills install <slug-or-rost/slug> [--seat-id <id>] [--client claude-code|codex|cursor] [--version <n>] [--local-only] [--json]`,
+    `${binName} skills sync --seat-id <id> [--client claude-code|codex|cursor] [--json]`,
+    `${binName} skills assign --seat-id <id> (--skill <slug>|--slug <slug>|--skill-version-id <id>) [--approve] [--allow-blocked-proposal] [--json]`,
+    `${binName} skills revoke (--assignment-id <id>|--seat-id <id> --skill <slug>) [--json]`,
+    `${binName} skills publish (--slug <slug>|--skill-version-id <id>) [--allow-warnings] [--json]`
+  ].join("\n");
+}
+async function runSkills(context, args, env = process.env) {
+  try {
+    const [action, ...rest] = args;
+    if (action === "help" || action === "--help" || action === "-h" || action === void 0) {
+      context.io.stdout.write(`${skillsUsage2(context.binName)}
+`);
+      return action === void 0 ? 1 : 0;
+    }
+    if (action === "list") {
+      return context.run(context.client, "skill.list", {}, void 0);
+    }
+    if (action === "catalog") {
+      const parsed = parseFlags2(rest, /* @__PURE__ */ new Set(["include-unentitled"]));
+      return context.run(context.client, "skill.catalog", {
+        ...parsed.flags.has("include-unentitled") ? { include_unentitled: true } : {}
+      }, parsed.json ? void 0 : formatCatalog);
+    }
+    if (action === "get") {
+      const parsed = parseFlags2(rest);
+      return context.run(context.client, "skill.get", { slug: requireValue3(parsed, "slug") }, parsed.json ? void 0 : formatSkillDetail2);
+    }
+    if (action === "file") {
+      const parsed = parseFlags2(rest);
+      return context.run(context.client, "skill.file.get", {
+        slug: requireValue3(parsed, "slug"),
+        path: requireValue3(parsed, "path")
+      }, (output) => {
+        const content = asRecord2(output).content;
+        return typeof content === "string" ? content : JSON.stringify(output, null, 2);
+      });
+    }
+    if (action === "enable") {
+      const slug2 = rest[0];
+      if (!slug2 || slug2.startsWith("--")) {
+        throw new UsageError2(`Usage: ${context.binName} skills enable rost/<slug> [--json]`);
+      }
+      const parsed = parseFlags2(rest.slice(1));
+      return context.run(context.client, "skill.enable_catalog", { slug: slug2 }, parsed.json ? void 0 : formatEnable);
+    }
+    if (action === "install") {
+      return installOne(context, rest, env);
+    }
+    if (action === "sync") {
+      return syncAssigned(context, rest, env);
+    }
+    if (action === "assign") {
+      const parsed = parseFlags2(rest, /* @__PURE__ */ new Set(["approve", "allow-blocked-proposal"]));
+      const body = withDefined({
+        seat_id: requireValue3(parsed, "seat-id"),
+        status: parsed.flags.has("approve") ? "approved" : "proposed",
+        rationale: optionalValue2(parsed, "rationale") ?? "Skill selected for this Seat.",
+        allow_blocked_proposal: parsed.flags.has("allow-blocked-proposal")
+      }, {
+        slug: optionalValue2(parsed, "skill") ?? optionalValue2(parsed, "slug"),
+        skill_version_id: optionalValue2(parsed, "skill-version-id")
+      });
+      return context.run(context.client, "skill.assign_to_seat", body, parsed.json ? void 0 : formatAssignment2, { targetSeatId: body.seat_id });
+    }
+    if (action === "revoke") {
+      const parsed = parseFlags2(rest);
+      const seatId = optionalValue2(parsed, "seat-id");
+      const body = withDefined({}, {
+        assignment_id: optionalValue2(parsed, "assignment-id"),
+        seat_id: seatId,
+        slug: optionalValue2(parsed, "skill") ?? optionalValue2(parsed, "slug"),
+        skill_version_id: optionalValue2(parsed, "skill-version-id"),
+        rationale: optionalValue2(parsed, "rationale")
+      });
+      return context.run(context.client, "skill.revoke_from_seat", body, parsed.json ? void 0 : formatRevoke, seatId ? { targetSeatId: seatId } : {});
+    }
+    if (action === "publish") {
+      const parsed = parseFlags2(rest, /* @__PURE__ */ new Set(["allow-warnings"]));
+      const body = withDefined({
+        allow_warnings: parsed.flags.has("allow-warnings")
+      }, {
+        slug: optionalValue2(parsed, "slug"),
+        skill_version_id: optionalValue2(parsed, "skill-version-id")
+      });
+      return context.run(context.client, "skill.publish", body, parsed.json ? void 0 : formatPublish);
+    }
+    throw new UsageError2(`Unknown skills action: ${action}`);
+  } catch (error51) {
+    if (error51 instanceof UsageError2) {
+      context.io.stderr.write(`${error51.message}
+`);
+      return 1;
+    }
+    if (error51 instanceof CommandClientError) {
+      return printCommandError(context.io, error51);
+    }
+    throw error51;
+  }
+}
+async function installOne(context, args, env) {
+  const slug2 = args[0];
+  if (!slug2 || slug2.startsWith("--")) {
+    throw new UsageError2(`Usage: ${context.binName} skills install <slug-or-rost/slug> [--seat-id <id>] [--client claude-code|codex|cursor] [--version <n>] [--local-only] [--json]`);
+  }
+  const parsed = parseFlags2(args.slice(1), /* @__PURE__ */ new Set(["local-only"]));
+  const client = parseClient2(optionalValue2(parsed, "client") ?? "codex");
+  const seatId = optionalValue2(parsed, "seat-id");
+  const body = withDefined({
+    slug: slug2,
+    client,
+    local_only: parsed.flags.has("local-only")
+  }, {
+    seat_id: seatId,
+    version: optionalNumber2(parsed, "version")
+  });
+  const options = seatId ? { targetSeatId: seatId } : {};
+  const output = await executeInstallCommand(context, body, options);
+  const summary = applyLocalSkillChanges(output, client, env, { removeRevoked: false });
+  const outputRecord = asRecord2(output);
+  context.io.stdout.write(parsed.json ? `${JSON.stringify({ ...outputRecord, local: summary }, null, 2)}
+` : `${formatLocalSummary(summary)}
+`);
+  return 0;
+}
+async function syncAssigned(context, args, env) {
+  const parsed = parseFlags2(args);
+  const seatId = requireValue3(parsed, "seat-id");
+  const client = parseClient2(optionalValue2(parsed, "client") ?? "codex");
+  const output = await executeSkillCommand(context, "skill.sync_local", {
+    seat_id: seatId,
+    client
+  }, { targetSeatId: seatId });
+  const summary = applyLocalSkillChanges(output, client, env, { removeRevoked: true });
+  const outputRecord = asRecord2(output);
+  context.io.stdout.write(parsed.json ? `${JSON.stringify({ ...outputRecord, local: summary }, null, 2)}
+` : `${formatLocalSummary(summary)}
+`);
+  return 0;
+}
+async function executeInstallCommand(context, body, options) {
+  const slug2 = typeof body.slug === "string" ? body.slug : "";
+  if (slug2.startsWith("rost/") && body.local_only !== true) {
+    try {
+      return await executeSkillCommand(context, "skill.install_local", { ...body, local_only: true }, options);
+    } catch (error51) {
+      if (!isCommandConflict(error51)) {
+        throw error51;
+      }
+    }
+  }
+  return executeSkillCommand(context, "skill.install_local", body, options);
+}
+async function executeSkillCommand(context, commandId, body, options = {}) {
+  try {
+    const output = await context.client.execute(commandId, body, options);
+    return output.output;
+  } catch (error51) {
+    const pending = context.io.interactive === true ? pendingConfirmationFromError(error51) : null;
+    if (pending && pending.commandId === commandId) {
+      context.io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the interactive CLI user.
+`);
+      const approved = await context.client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
+      return asRecord2(approved.output).output ?? approved.output;
+    }
+    throw error51;
+  }
+}
+function applyLocalSkillChanges(output, client, env, options) {
+  const root = installRoot(client, env);
+  const changes = writeInstalls(output, root);
+  if (options.removeRevoked) {
+    changes.push(...removeRevokedInstalls(output, root));
+  }
+  return changes;
+}
+function writeInstalls(output, root) {
+  const installs = asArray2(asRecord2(output).installs);
+  return installs.map((entry) => {
+    const install = asRecord2(entry);
+    const slug2 = safeLocalSlug(String(install.slug ?? ""));
+    const metadata = asRecord2(install.metadata);
+    const files = asArray2(install.files).map(asRecord2);
+    const dir = path2.join(root, slug2);
+    const metadataPath = path2.join(dir, ".rost-skill.json");
+    const expectedHash = String(metadata.content_sha256 ?? "");
+    if (existingHash(metadataPath) === expectedHash) {
+      return { slug: slug2, dir, status: "unchanged", files: files.length };
+    }
+    rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dir, { recursive: true });
+    for (const file2 of files) {
+      const relativePath = safeRelativePath(String(file2.path ?? ""));
+      const content = String(file2.content ?? "");
+      const target = path2.join(dir, relativePath);
+      mkdirSync(path2.dirname(target), { recursive: true });
+      writeFileSync(target, content, "utf8");
+    }
+    writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}
+`, "utf8");
+    return { slug: slug2, dir, status: "installed", files: files.length };
+  });
+}
+function removeRevokedInstalls(output, root) {
+  const installs = new Set(asArray2(asRecord2(output).installs).map((entry) => {
+    const slug2 = asRecord2(entry).slug;
+    return typeof slug2 === "string" ? slug2 : "";
+  }));
+  const revoked = asArray2(asRecord2(output).revoked);
+  const changes = [];
+  for (const entry of revoked) {
+    const slug2 = safeLocalSlug(String(asRecord2(entry).slug ?? ""));
+    if (installs.has(slug2)) {
+      continue;
+    }
+    const dir = path2.join(root, slug2);
+    if (!existsSync(dir)) {
+      continue;
+    }
+    rmSync(dir, { recursive: true, force: true });
+    changes.push({ slug: slug2, dir, status: "removed", files: 0 });
+  }
+  return changes;
+}
+function installRoot(client, env) {
+  const override = env.ROST_SKILL_INSTALL_ROOT;
+  if (override && override.length > 0) {
+    return path2.resolve(override, client);
+  }
+  if (client === "codex") {
+    return path2.join(env.CODEX_HOME ?? path2.join(os.homedir(), ".codex"), "skills", "rost");
+  }
+  if (client === "claude-code") {
+    return path2.join(env.CLAUDE_HOME ?? path2.join(os.homedir(), ".claude"), "skills", "rost");
+  }
+  return path2.join(os.homedir(), ".cursor", "skills", "rost");
+}
+function safeRelativePath(value) {
+  const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
+  if (!normalized || normalized.startsWith("/") || normalized.includes("//") || normalized.split("/").includes("..")) {
+    throw new UsageError2("Server returned an invalid skill file path.");
+  }
+  return normalized;
+}
+function safeLocalSlug(value) {
+  if (!/^[a-z0-9][a-z0-9-]{1,80}$/.test(value)) {
+    throw new UsageError2("Server returned an invalid skill slug.");
+  }
+  return value;
+}
+function existingHash(metadataPath) {
+  if (!existsSync(metadataPath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync3(metadataPath, "utf8"));
+    const hash2 = asRecord2(parsed).content_sha256;
+    return typeof hash2 === "string" ? hash2 : null;
+  } catch {
+    return null;
+  }
+}
+function parseFlags2(args, booleanFlags = /* @__PURE__ */ new Set()) {
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  let json2 = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === void 0) {
+      continue;
+    }
+    if (!token.startsWith("--")) {
+      throw new UsageError2(`Unexpected argument: ${token}`);
+    }
+    const key = token.slice(2);
+    if (key === "json") {
+      json2 = true;
+      continue;
+    }
+    if (booleanFlags.has(key)) {
+      flags.add(key);
+      continue;
+    }
+    const value = args[index + 1];
+    if (value === void 0 || value.startsWith("--")) {
+      flags.add(key);
+      continue;
+    }
+    values.set(key, value);
+    index += 1;
+  }
+  return { json: json2, values, flags };
+}
+function requireValue3(parsed, key) {
+  const value = optionalValue2(parsed, key);
+  if (value === void 0) {
+    throw new UsageError2(`Missing required --${key} value.`);
+  }
+  return value;
+}
+function optionalValue2(parsed, key) {
+  const value = parsed.values.get(key);
+  return value && value.length > 0 ? value : void 0;
+}
+function optionalNumber2(parsed, key) {
+  const value = optionalValue2(parsed, key);
+  if (value === void 0) {
+    return void 0;
+  }
+  const parsedNumber = Number(value);
+  if (!Number.isSafeInteger(parsedNumber) || parsedNumber <= 0) {
+    throw new UsageError2(`--${key} must be a positive integer.`);
+  }
+  return parsedNumber;
+}
+function parseClient2(value) {
+  if (!CLIENTS.has(value)) {
+    throw new UsageError2("--client must be claude-code, codex, or cursor.");
+  }
+  return value;
+}
+function isCommandConflict(error51) {
+  return error51 instanceof CommandClientError && error51.status === 409;
+}
+function withDefined(base, extra) {
+  const next = { ...base };
+  for (const [key, value] of Object.entries(extra)) {
+    if (value !== void 0) {
+      next[key] = value;
+    }
+  }
+  return next;
+}
+function asRecord2(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function asArray2(value) {
+  return Array.isArray(value) ? value : [];
+}
+function formatCatalog(output) {
+  const entries = asArray2(asRecord2(output).catalog);
+  if (entries.length === 0) {
+    return "No ROST catalog skills are available for this tenant.";
+  }
+  return entries.map((entry) => {
+    const record2 = asRecord2(entry);
+    return `${record2.catalog_slug} [${record2.tier}/${record2.entitlement_status}] ${record2.name}`;
+  }).join("\n");
+}
+function formatSkillDetail2(output) {
+  const skill = asRecord2(asRecord2(output).skill);
+  return `${skill.slug} v${skill.latest_version ?? "\u2014"} [${skill.status}] ${skill.name}
+${skill.description}`;
+}
+function formatEnable(output) {
+  const skill = asRecord2(asRecord2(output).skill);
+  const catalog = asRecord2(asRecord2(output).catalog);
+  return `Enabled ${catalog.catalog_slug} as ${skill.slug} v${skill.version} (${skill.skill_version_id})`;
+}
+function formatAssignment2(output) {
+  const assignment = asRecord2(asRecord2(output).assignment);
+  return `${assignment.status} ${assignment.slug} for seat ${assignment.seat_id}; sync: ${String(asRecord2(output).local_sync_next_step)}`;
+}
+function formatRevoke(output) {
+  const record2 = asRecord2(output);
+  return `Revoked ${record2.slug} for seat ${record2.seat_id}; sync: ${record2.local_sync_next_step}`;
+}
+function formatPublish(output) {
+  const skill = asRecord2(asRecord2(output).skill);
+  return `Published ${skill.slug} v${skill.version} (${skill.skill_version_id})`;
+}
+function formatLocalSummary(summary) {
+  if (summary.length === 0) {
+    return "No skills to install.";
+  }
+  return summary.map((entry) => `${entry.status} ${entry.slug} -> ${entry.dir} (${entry.files} files)`).join("\n");
+}
+function printCommandError(io, error51) {
+  if (error51.response && !error51.response.ok) {
+    const payload = {
+      code: error51.response.error.code,
+      message: error51.response.error.message,
+      ...error51.response.error.details === void 0 ? {} : { details: error51.response.error.details },
+      ...error51.response.error.help === void 0 ? {} : { help: error51.response.error.help },
+      ...error51.response.requestId === void 0 ? {} : { requestId: error51.response.requestId }
+    };
+    io.stderr.write(`${redactForLog(payload)}
+`);
+    if (error51.response.error.help !== void 0) {
+      io.stderr.write(`\u2192 try: ${redactForLog(error51.response.error.help)}
+`);
+    }
+    return error51.status === 409 ? 3 : error51.status >= 400 && error51.status < 500 ? 1 : 2;
+  }
+  io.stderr.write(`${redactForLog(error51.message)}
+`);
+  return error51.status >= 400 && error51.status < 500 ? 1 : 2;
+}
+function pendingConfirmationFromError(error51) {
+  if (!(error51 instanceof CommandClientError) || !error51.response || error51.response.ok || error51.response.error.code !== "COMMAND_CONFIRMATION_REQUIRED") {
+    return null;
+  }
+  const details = asRecord2(error51.response.error.details);
+  const confirmationId = details.confirmationId;
+  const commandId = details.commandId;
+  if (typeof confirmationId !== "string" || confirmationId.length === 0 || typeof commandId !== "string" || commandId.length === 0) {
+    return null;
+  }
+  return { confirmationId, commandId };
+}
+
 // src/index.ts
 async function main(argv = process.argv.slice(2), options = {}) {
   const io = options.io ?? {
@@ -46788,6 +47828,23 @@ Run ${cliBrand.binName} login --device again if the next command asks you to aut
   if (command === "mcp") {
     return executeMcp(io, client, config2.appUrl, args);
   }
+  if (command === "skills") {
+    const skillsAction = args[0];
+    if (skillsAction !== "catalog" && skillsAction !== "enable" && skillsAction !== "install" && skillsAction !== "sync") {
+      return runOperation(command, args, {
+        io,
+        client,
+        binName: cliBrand.binName,
+        run: (wrapperClient, commandId, body, format, options2) => printCommandOutput(io, wrapperClient, commandId, body, format, options2)
+      });
+    }
+    return runSkills({
+      io,
+      client,
+      binName: cliBrand.binName,
+      run: (wrapperClient, commandId, body, format, options2) => printCommandOutput(io, wrapperClient, commandId, body, format, options2)
+    }, args);
+  }
   if (command === "init") {
     return executeInit(io, client, config2.appUrl, args);
   }
@@ -46887,7 +47944,7 @@ function extractSeatFlag(args) {
 var SeatFlagError = class extends Error {
 };
 function formatCommandSchema(output) {
-  const record2 = asRecord2(output);
+  const record2 = asRecord3(output);
   const lines = [
     `${field2(record2, "id")} \u2014 ${field2(record2, "title")}`,
     field2(record2, "description"),
@@ -46912,16 +47969,16 @@ function formatCommandSchema(output) {
   return lines.join("\n");
 }
 function formatCommandList(output) {
-  const commands = Array.isArray(asRecord2(output).commands) ? asRecord2(output).commands : [];
+  const commands = Array.isArray(asRecord3(output).commands) ? asRecord3(output).commands : [];
   if (commands.length === 0) {
     return "No commands registered.";
   }
   return commands.map((entry) => {
-    const record2 = asRecord2(entry);
+    const record2 = asRecord3(entry);
     return `${field2(record2, "id")}  [${field2(record2, "required_scope")}/${field2(record2, "confirmation")}]  ${field2(record2, "title")}`;
   }).join("\n");
 }
-function asRecord2(value) {
+function asRecord3(value) {
   return typeof value === "object" && value !== null ? value : {};
 }
 function asStringArray(value) {
@@ -46982,7 +48039,7 @@ async function executeMcp(io, client, appUrl2, args, env = process.env) {
       return 1;
     }
     if (error51 instanceof CommandClientError) {
-      return printCommandError(io, error51);
+      return printCommandError2(io, error51);
     }
     io.stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
@@ -47038,30 +48095,30 @@ async function printCommandOutput(io, client, commandId, body = {}, format, opti
     return 0;
   } catch (error51) {
     if (io.interactive === true) {
-      const pending = pendingConfirmationFromError(error51);
+      const pending = pendingConfirmationFromError2(error51);
       if (pending && pending.commandId === commandId) {
         io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the interactive CLI user.
 `);
         try {
           const approved = await client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
-          const approvedOutput = asRecord2(approved.output).output ?? approved.output;
+          const approvedOutput = asRecord3(approved.output).output ?? approved.output;
           const rendered = format ? format(approvedOutput) : JSON.stringify(approvedOutput, null, 2);
           io.stdout.write(`${rendered}
 `);
           return 0;
         } catch (approvalError) {
-          return printCommandError(io, approvalError);
+          return printCommandError2(io, approvalError);
         }
       }
     }
-    return printCommandError(io, error51);
+    return printCommandError2(io, error51);
   }
 }
-function pendingConfirmationFromError(error51) {
+function pendingConfirmationFromError2(error51) {
   if (!(error51 instanceof CommandClientError) || !error51.response || error51.response.ok || error51.response.error.code !== "COMMAND_CONFIRMATION_REQUIRED") {
     return null;
   }
-  const details = asRecord2(error51.response.error.details);
+  const details = asRecord3(error51.response.error.details);
   const confirmationId = details.confirmationId;
   const commandId = details.commandId;
   if (typeof confirmationId !== "string" || confirmationId.length === 0 || typeof commandId !== "string" || commandId.length === 0) {
@@ -47069,7 +48126,7 @@ function pendingConfirmationFromError(error51) {
   }
   return { confirmationId, commandId };
 }
-function printCommandError(io, error51) {
+function printCommandError2(io, error51) {
   if (error51 instanceof CommandClientError && error51.response && !error51.response.ok) {
     const help = error51.response.error.help;
     const requestId = error51.response.requestId;
@@ -47106,7 +48163,7 @@ function parseJsonBody(args) {
   return JSON.parse(body);
 }
 function isCommand(value) {
-  return value === "login" || value === "logout" || value === "signup" || value === "whoami" || value === "tenants" || value === "use" || value === "command" || value === "onboard" || value === "mcp" || value === "init" || value === "docs" || value === "reference" || value === "help";
+  return value === "login" || value === "logout" || value === "signup" || value === "whoami" || value === "tenants" || value === "use" || value === "command" || value === "onboard" || value === "mcp" || value === "skills" || value === "init" || value === "docs" || value === "reference" || value === "help";
 }
 function printUsage(io) {
   io.stdout.write([
@@ -47126,6 +48183,7 @@ function printUsage(io) {
     `${cliBrand.binName} mcp install --client claude-code|codex|cursor --scope tenant-admin|seat [--seat-id <id>] [--expires-in <days>|--no-expiry] [--skip-permissions]`,
     `${cliBrand.binName} mcp install --client claude-code|codex|cursor --rotate <old-token-id>  (inherits the old token's scope; no --scope)`,
     `${cliBrand.binName} mcp install ... --skip-permissions  (or ${cliBrand.envPrefix}_CLI_SKIP_PERMISSIONS=1 \u2014 auto-approves the token-mint confirmation in a non-interactive session)`,
+    skillsUsage2(cliBrand.binName),
     `${cliBrand.binName} init [--client claude-code|codex|cursor]  (defaults --scope tenant-admin)`,
     `${cliBrand.binName} docs`,
     `${cliBrand.binName} reference <list|search|get> [options]`,