@rosthq/cli 0.5.26 → 0.5.28

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path3, preserveJsx) {
-  if (typeof path3 === "string" && /^\.\.?\//.test(path3)) {
-    return path3.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path4, preserveJsx) {
+  if (typeof path4 === "string" && /^\.\.?\//.test(path4)) {
+    return path4.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path3;
+  return path4;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -5471,7 +5471,7 @@ var require_helpers = __commonJS({
     exports.generateCallbackId = generateCallbackId;
     exports.parseParametersFromURL = parseParametersFromURL;
     exports.decodeJWT = decodeJWT;
-    exports.sleep = sleep2;
+    exports.sleep = sleep3;
     exports.retryable = retryable;
     exports.generatePKCEVerifier = generatePKCEVerifier;
     exports.generatePKCEChallenge = generatePKCEChallenge;
@@ -5609,7 +5609,7 @@ var require_helpers = __commonJS({
       };
       return data;
     }
-    async function sleep2(time3) {
+    async function sleep3(time3) {
       return await new Promise((accept) => {
         setTimeout(() => accept(null), time3);
       });
@@ -7718,10 +7718,10 @@ var require_webauthn = __commonJS({
         authenticatorAttachment: (_a3 = credentialWithAttachment.authenticatorAttachment) !== null && _a3 !== void 0 ? _a3 : void 0
       };
     }
-    function isValidDomain(hostname3) {
+    function isValidDomain(hostname4) {
       return (
         // Consider localhost valid as well since it's okay wrt Secure Contexts
-        hostname3 === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(hostname3)
+        hostname4 === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(hostname4)
       );
     }
     function browserSupportsWebAuthn() {
@@ -14026,10 +14026,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path3) {
-  if (!path3)
+function getElementAtPath(obj, path4) {
+  if (!path4)
     return obj;
-  return path3.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14438,11 +14438,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path3, issues) {
+function prefixIssues(path4, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path3);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -14589,16 +14589,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path3 = []) => {
+  const processError = (error52, path4 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else {
-        const fullpath = [...path3, ...issue2.path];
+        const fullpath = [...path4, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14625,17 +14625,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path3 = []) => {
+  const processError = (error52, path4 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else {
-        const fullpath = [...path3, ...issue2.path];
+        const fullpath = [...path4, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14667,8 +14667,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path3 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path3) {
+  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path4) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14874,8 +14874,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+var mac = (delimiter2) => {
+  const escapedDelim = escapeRegex(delimiter2 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -27360,13 +27360,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path3 = ref.slice(1).split("/").filter(Boolean);
-  if (path3.length === 0) {
+  const path4 = ref.slice(1).split("/").filter(Boolean);
+  if (path4.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path3[0] === defsKey) {
-    const key = path3[1];
+  if (path4[0] === defsKey) {
+    const key = path4[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27828,7 +27828,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path3 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path4 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27836,7 +27836,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path3}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path4}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27849,7 +27849,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path3}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path4}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33056,8 +33056,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path3, query) {
-  const url2 = new URL(path3, baseUrl);
+function buildUrl(baseUrl, path4, query) {
+  const url2 = new URL(path4, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33087,12 +33087,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path3,
+      path: path4,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path3, query);
+      const url2 = buildUrl(options.baseUrl, path4, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -33954,7 +33954,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path3, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path4, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -33978,7 +33978,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path3);
+      const cleanPath = _this._removeEmptyFolders(path4);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34055,8 +34055,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path3, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path3, fileBody, fileOptions);
+  async upload(path4, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path4, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34096,9 +34096,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path3, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path4, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path3);
+    const cleanPath = _this3._removeEmptyFolders(path4);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34167,10 +34167,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path3, options) {
+  async createSignedUploadUrl(path4, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path3);
+      let _path = _this4._getFinalPath(path4);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34179,7 +34179,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path3,
+        path: path4,
         token
       };
     });
@@ -34239,8 +34239,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path3, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path3, fileBody, fileOptions);
+  async update(path4, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path4, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34391,10 +34391,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path3, expiresIn, options) {
+  async createSignedUrl(path4, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path3);
+      let _path = _this8._getFinalPath(path4);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34530,13 +34530,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path3, options, parameters) {
+  download(path4, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path3);
+    const _path = this._getFinalPath(path4);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34567,9 +34567,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path3) {
+  async info(path4) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path3);
+    const _path = _this10._getFinalPath(path4);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34590,9 +34590,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path3) {
+  async exists(path4) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path3);
+    const _path = _this11._getFinalPath(path4);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34671,8 +34671,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path3, options) {
-    const _path = this._getFinalPath(path3);
+  getPublicUrl(path4, options) {
+    const _path = this._getFinalPath(path4);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34811,10 +34811,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path3, options, parameters) {
+  async list(path4, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path3 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path4 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -34879,11 +34879,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path3) {
-    return `${this.bucketId}/${path3.replace(/^\/+/, "")}`;
+  _getFinalPath(path4) {
+    return `${this.bucketId}/${path4.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path3) {
-    return path3.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path4) {
+    return path4.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -36381,12 +36381,12 @@ function shouldPropagateToTarget(targetUrl, targets) {
   }
   return false;
 }
-function matchStringTarget(hostname3, target) {
-  if (target === hostname3) return true;
+function matchStringTarget(hostname4, target) {
+  if (target === hostname4) return true;
   if (target.startsWith("*.")) {
     const domain2 = target.slice(2);
-    if (hostname3.endsWith(domain2)) {
-      if (hostname3 === domain2 || hostname3.endsWith("." + domain2)) return true;
+    if (hostname4.endsWith(domain2)) {
+      if (hostname4 === domain2 || hostname4.endsWith("." + domain2)) return true;
     }
   }
   return false;
@@ -37172,7 +37172,7 @@ async function defaultVerifyOtp(config2, input) {
 }
 async function loginWithDeviceCode(config2, io, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const sleep2 = deps.sleep ?? defaultSleep;
+  const sleep3 = deps.sleep ?? defaultSleep;
   const openBrowser2 = deps.openBrowser ?? tryOpenBrowser;
   const verifyOtp = deps.verifyOtp ?? defaultVerifyOtp;
   const now = deps.now ?? Date.now;
@@ -37206,7 +37206,7 @@ async function loginWithDeviceCode(config2, io, deps = {}) {
         `The code expired before it was approved. Run '${cliBrand.binName} login --device' again.`
       );
     }
-    await sleep2(intervalMs);
+    await sleep3(intervalMs);
     const poll = await postJson(fetchImpl, `${baseUrl}/api/auth/device/token`, {
       device_code: session.device_code
     });
@@ -37359,8 +37359,8 @@ var FileTokenStore = class {
     return `plain file fallback at ${this.filePath}`;
   }
   async chmodOwnerOnly() {
-    const { chmod } = await import("node:fs/promises");
-    await chmod(this.filePath, 384);
+    const { chmod: chmod2 } = await import("node:fs/promises");
+    await chmod2(this.filePath, 384);
   }
 };
 function createTokenStore(options = {}) {
@@ -37920,8 +37920,8 @@ function getErrorMap2() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path3, errorMaps, issueData } = params;
-  const fullPath = [...path3, ...issueData.path || []];
+  const { data, path: path4, errorMaps, issueData } = params;
+  const fullPath = [...path4, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -38037,11 +38037,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path3, key) {
+  constructor(parent, value, path4, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path3;
+    this._path = path4;
     this._key = key;
   }
   get path() {
@@ -42085,6 +42085,7 @@ The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provide
       "sync.run.start",
       "sync.run.complete",
       "sync.item.assign",
+      "coach.draft_guide",
       "confirmation.approve"
     ],
     legal: {
@@ -42145,7 +42146,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-06-21.6",
+    version: "2026-06-27.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -42155,6 +42156,8 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
       "agent.status",
       "agent.list_fleet",
       "agent.fleet_digest",
+      "system.health",
+      "team.health_score",
       "agent_setup.get",
       "agent_setup.update",
       "agent.decommission",
@@ -42235,18 +42238,26 @@ Provider requests carry only the model payload the runtime needs; run attributio
 
 Before an agent goes live, the sandbox dry run rehearses this against fake data and returns a per-tool preview: for each tool the agent would touch, whether it would run it, would be blocked, or would escalate \u2014 no external side effect. Review that preview before you approve go-live.
 
+## Company guardrails
+
+Beyond each seat's own manifest, the company can set one ceiling on how much an agent may do *autonomously*. Every tool's scope carries an autonomous-risk level \u2014 reading and drafting are low, writing-with-approval is high, and unrestricted access is critical; an unrecognized tool is treated as critical, never as safe. The guardrail caps that risk for the whole organization through a named profile (locked down, balanced, high autonomy, or a custom ceiling), with balanced as the default. An autonomous call that stays within the ceiling runs as usual; an autonomous call above it is treated as needing a human instead of acting on its own. Calls that are already human-gated or being escalated are never affected \u2014 the ceiling only ever narrows autonomous action, it never blocks the human-approval path. New organizations start balanced and in a watch-only mode, so the guardrail first reports where it would intervene before it begins enforcing.
+
 ## What humans should review
 
 The Agents page shows fleet health first: live state, recent runs, failed runs, open held actions, last activity, cost, and the next operator action. It also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason.
 
-Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat. The \`/health\` dashboard and \`{{cli}} system health --json\` / \`system.health\` / \`rost_system_health\` share the same command-backed system-health model, with server-derived tenant, member, requested-seat, or seat-token scope. Owners see tenant health; members see occupied-seat subtrees; seat pages link to \`/health?seat_id=<seat>\` for scoped follow-up. Every health finding includes a remediation action with a human label/link plus command id, schema reference, CLI command, help text, and human-gated marker for agents. Open Friction without an action task links to the Friction detail and gives agents the \`task.create\` then \`friction.link_task\` next step; the final issue resolution still requires the human \`friction.resolve\` decision. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
+Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat.
+
+For an operational audit, start with the \`/health\` dashboard or \`{{cli}} system health --json\` / \`system.health\` / \`rost_system_health\` before manually chaining fleet, run, Signal, Friction, task, integration, runner, and Sync commands. The dashboard, CLI, and MCP tool share the same command-backed system-health model, with server-derived tenant, member, requested-seat, or seat-token scope. Owners see tenant health; members see occupied-seat subtrees; seat-scoped tokens see their own seat plus authorized downstream seats, and optional \`seat_id\` narrowing can only reduce that server-derived scope. Seat pages link to \`/health?seat_id=<seat>\` for scoped follow-up. Every health finding includes a remediation action with a human label/link plus command id, schema reference, CLI command, help text, and human-gated marker for agents. Open Friction without an action task links to the Friction detail and gives agents the \`task.create\` then \`friction.link_task\` next step; the final issue resolution still requires the human \`friction.resolve\` decision.
+
+Use the lower-level commands after health names a finding: \`agent.get_run\` for a specific failed run, \`signal.list\` for off-track readings, \`task.list\` for the owning seat's queue, \`integration.status\` or \`integration.test\` for connector evidence, \`runner.list\` / \`runner.diagnose\` for local-runner repair, and \`sync.brief.compile\` for missing Sync Briefs. Fleet real-turn counts use the same seat-run association as \`agent.list_runs\`, filtered to real runs. Scheduled agents are checked in rounded five-minute buckets, so a minute-level cron inside the bucket queues one work order for that bucket rather than one order per minute. Sandbox dry runs do not count as real turns. If the agent is repeatedly blocked, revise the Charter or split the seat. If the agent is taking too much judgment, narrow its autonomous scope.`
   },
   {
     slug: "tool-access-and-vault",
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-06-20.5",
+    version: "2026-06-27.6",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42294,9 +42305,13 @@ For an API with no dedicated connector, the generic REST tool lets a seat call a
 
 \`slack.post_message\` reuses the connected Slack workspace credential and the seat's Slack channel binding. A live call posts only to that bound channel, through the server-side guard and vault-bound bot token. If the bound channel is marked sensitive, the handler escalates for human approval instead of posting. A sandbox dry run makes no Slack request and does not open the vault.
 
+## Gmail connector
+
+The native Gmail handlers run inside the same broker boundary as the REST and Slack connectors: every call passes the server guard and writes an audit row, and the vaulted Google OAuth token is bound only inside a credential closure \u2014 the agent never sees it, and both the access and refresh tokens are redacted from anything a handler returns. \`gmail.read\` (read scoped inbox) and \`gmail.draft\` (compose a draft, never send) are autonomous-eligible. \`gmail.send\` is approval-gated: it never sends autonomously \u2014 it holds the action for steward approval. A sandbox dry run previews the intended read/draft/held-send with no Gmail request and without opening the vault. Live external Gmail send stays gated on Google verification and domain cutover (DER-880 / DER-881); the draft and send-with-approval paths are live now.
+
 ## Google connector status
 
-Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose and Sheets, stores the returned credential in the vault, and records only account and scope metadata in the integration row. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail and Sheets agent tools remain configuration-only until their guarded handlers ship; connecting Google does not by itself let an agent read mail or edit a sheet.
+Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose and Sheets, stores the returned credential in the vault, and records only account and scope metadata in the integration row. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Sheets agent tools remain configuration-only until their guarded handlers ship; connecting Google does not by itself let an agent edit a sheet.
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
 
@@ -42331,7 +42346,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-06-21.1",
+    version: "2026-06-27.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42377,14 +42392,14 @@ Agents should explain the job, the required tool category, the minimum permissio
 
 Every tool call passes the server-side guard first: the guard checks the call against the seat's signed permission manifest and records a tool-call audit row for **every** call \u2014 allowed, denied, or escalated. Tool selection is never authorization. Only an allowed call reaches its handler. A connected credential is bound into the handler for the duration of the call only; the secret never appears in the result, the audit summary, logs, or the model's context.
 
-External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST connector when a signed host/method/path allowlist and credential exist, and \`slack.post_message\` for a bound Slack channel. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
+External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST connector when a signed host/method/path allowlist and credential exist, \`slack.post_message\` for a bound Slack channel, and the Gmail handlers (\`gmail.read\`/\`gmail.draft\` autonomous-eligible, \`gmail.send\` held for approval) when Google is connected. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
   },
   {
     slug: "mcp-and-cli-guide",
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-21.15",
+    version: "2026-06-28.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42450,6 +42465,9 @@ External connectors are being rolled out provider by provider, conservatively (r
       "deliverable.get",
       "deliverable.create",
       "deliverable.attach",
+      "deliverable.accept",
+      "usage.report",
+      "usage.snapshot",
       "error_log.list",
       "error_log.resolve",
       "error_log.supersede",
@@ -42780,6 +42798,7 @@ These are the security posture rules for operating after install \u2014 a checkl
 | Command | Purpose | Scope | Safe example |
 |---|---|---|---|
 | \`{{cli}} docs\` | Print the agent-facing how-to summary. | Public reference | \`{{cli}} docs\` |
+| \`{{cli}} doctor\` | Diagnose local CLI configuration: app URL, Supabase URL, installed version, PATH, session store, local Claude/Codex availability, and update status without printing tokens. | Local environment | \`{{cli}} doctor\` |
 | \`{{cli}} help [group]\` | Print top-level usage, or one operation group's usage; \`{{cli}} <group> --help\` works too. | Public reference | \`{{cli}} help agent\` |
 | \`{{cli}} reference <list|search|get> [options]\` | Help syntax for public reference commands. \`--audience <human|cli|mcp|in_app_agent>\` filters to one audience (omit for all). | Public reference | \`{{cli}} reference search "onboarding" --audience cli\` |
 | \`{{cli}} reference list\` | List public reference guides. | Public reference | \`{{cli}} reference list --audience cli\` |
@@ -42829,11 +42848,12 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} escalation list|get|resolve|reject\` | \`escalation.list\`, \`escalation.get\`, \`escalation.resolve\`, \`escalation.reject\` | Work the steward escalation queue. | Steward | \`{{cli}} escalation list --json\` |
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
-| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders, diagnose offline runners, get repair guidance, and revoke a runner. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\` |
+| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect runners and work orders, diagnose offline runners, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
-| \`{{cli}} settings get|update|product-learning|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, and rename the company. Budget and product-learning updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings product-learning update --mode disabled --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
+| \`{{cli}} command usage.report|usage.snapshot\` | \`usage.report\`, \`usage.snapshot\` | Read the AI-workforce ROI report (per-period agent turns, token/run cost, human-accepted value, exceptions, approvals) from immutable usage snapshots, and freeze a period's totals into a new snapshot (insert-only, idempotent). | Tenant | \`{{cli}} command usage.report --json\`; \`{{cli}} command usage.snapshot --json\` |
+| \`{{cli}} settings get|update|product-learning|agent-policy|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`settings.agent_policy.get\`, \`settings.agent_policy.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, read or set the company autonomy ceiling, and rename the company. Budget, product-learning, and policy updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings agent-policy get --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
@@ -42844,6 +42864,8 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} compass show\` | \`compass.show_markdown\` | Render the current Compass as a clean markdown card for review. | Tenant | \`{{cli}} compass show --markdown\` |
 | \`{{cli}} charter show\` | \`charter.show_markdown\` | Render a seat's Charter as a clean markdown card for review. | Tenant | \`{{cli}} charter show --seat-id <id> --markdown\` |
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
+| \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
+| \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
 
 Skills wrapper help:
 
@@ -42926,6 +42948,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_rename_seat\` | \`seat.rename\` | Rename a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`name\`. |
 | \`rost_reparent_seat\` | \`seat.reparent\` | Move a seat under a new parent. | Seat or tenant-admin | Call with \`seat_id\` and \`parent_seat_id\`. |
 | \`rost_set_seat_type\` | \`seat.set_type\` | Set a seat type. | Seat or tenant-admin | Call with \`seat_id\` and \`seat_type\`. |
+| \`rost_preview_seat_decommission\` | \`seat.decommission_preview\` | Preview retiring a seat: affected occupancies, agents, Charters, MCP tokens, credentials, work orders, and schedules. No mutation. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; no confirmation. |
 | \`rost_decommission_seat\` | \`seat.decommission\` | Retire a seat: end occupancies, archive the Charter, revoke tokens/credentials, cancel schedules, tombstone event. No-orphan guarded. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; expect confirmation. |
 | \`rost_draft_charter\` | \`charter.draft\` | Create or fetch a draft Charter. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_draft_all_charters\` | \`charter.draft_all\` | Draft Charters for every eligible seat. | Tenant | Call after initial graph creation. |
@@ -42968,6 +42991,9 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_get_agent_deliverable\` | \`deliverable.get\` | Read one durable agent deliverable by id for a seat. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","deliverable_id":"<id>"}\`. |
 | \`rost_create_agent_deliverable\` | \`deliverable.create\` | Create a scrubbed durable work output for the acting seat. | Seat | Call with title, kind, summary/content, and optional safe links. |
 | \`rost_attach_agent_deliverable\` | \`deliverable.attach\` | Attach a scrubbed deliverable to a source run, task, or work order after server-side seat validation. | Seat | Call with title, kind, and the source ids that belong to the acting seat. |
+| \`rost_accept_deliverable_value\` | \`deliverable.accept\` | Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event. | Tenant-admin | Call with \`{"deliverable_id":"<id>","impact_value_usd":<number>}\`; expect human confirmation. |
+| \`rost_ai_workforce_roi_report\` | \`usage.report\` | Read the AI-workforce ROI report \u2014 per-period agent turns, token/run cost, human-accepted value, exceptions, and approvals \u2014 from immutable usage snapshots. | Tenant | Call with \`{}\` or \`{"limit":<n>}\`. |
+| \`rost_capture_usage_period_snapshot\` | \`usage.snapshot\` | Freeze the current (or a given) period's usage and accepted-value totals into an immutable snapshot; insert-only and idempotent. | Tenant | Call with \`{}\` or \`{"period":"YYYY-MM-DD"}\`. |
 | \`rost_list_agent_templates\` | \`agent_template.list\` | List stock agent templates and metadata. | Tenant | Call with \`{}\`. |
 | \`rost_create_agent_from_template\` | \`agent.create_from_template\` | Create a draft stock agent and draft Charter from a template (draft-only; occupancy needs a human steward). | Tenant | Call with \`seat_id\` and \`template_slug\`; expect human confirmation. |
 | \`rost_start_agent_setup\` | \`agent_setup.start\` | Start an agent setup draft for template, custom, or existing mode. | Tenant | Call with \`mode\` and seat placement. |
@@ -43011,6 +43037,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_update_sync_brief_scope\` | \`settings.sync_brief_scope.update\` | Set the tenant's Sync Brief scope (company_wide or per_cluster). | Tenant-admin | Owner-only; call with \`{"sync_brief_scope":"company_wide"}\` or \`{"sync_brief_scope":"per_cluster"}\`. |
 | \`rost_get_product_learning_policy\` | \`settings.product_learning.get\` | Read whether product/page/recommendation analytics are allowed. | Tenant | Call with \`{}\`; audit/security logs are always enabled. |
 | \`rost_update_product_learning_policy\` | \`settings.product_learning.update\` | Set product-learning mode. | Tenant-admin | Human-gated; call with \`{"mode":"enabled"}\`, \`{"mode":"disabled"}\`, or \`{"mode":"enterprise_contract"}\`. |
+| \`rost_get_company_autonomy_ceiling\` | \`settings.agent_policy.get\` | Read the company autonomy ceiling (Company Guardrails): profile, enforcement, and max_autonomous_risk. | Tenant | Call with \`{}\`; metadata only. |
+| \`rost_set_company_autonomy_ceiling\` | \`settings.agent_policy.update\` | Set the company autonomy ceiling. | Tenant-admin | Owner-only, human-gated; call with \`{"profile":"locked_down"}\` (or \`balanced\`/\`high_autonomy\`, or \`{"profile":"custom","max_autonomous_risk":"high"}\`). Enforced by default. |
 | \`rost_list_signals\` | \`signal.list\` | List measurables with their latest reading and on/off-track state. | Seat or tenant-admin | Call with \`{}\` to find measurable ids. |
 | \`rost_get_signal\` | \`signal.get\` | Read a measurable with its full reading history. | Seat or tenant-admin | Call with \`{"measurable_id":"<id>"}\`. |
 | \`rost_confirm_signal_reading\` | \`signal.confirm_reading\` | Confirm an unconfirmed reading as human-verified. | Seat or tenant-admin | Humans confirm; call with \`{"reading_id":"<id>"}\`. |
@@ -43020,9 +43048,12 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_cascade_goal\` | \`goal.create\` | Create a cycle goal under an objective. | Tenant | Call with cycle, seat, parent, title, definition of done. |
 | \`rost_update_cascade_goal\` | \`goal.update\` | Update a goal's title or definition of done. | Tenant | Call with \`goal_id\` and the changed fields. |
 | \`rost_set_cascade_goal_status\` | \`goal.set_status\` | Set a goal's status (on/off/done). | Seat or tenant-admin | Seats may set only their own goals. |
+| \`rost_set_cascade_goal_progress\` | \`goal.set_progress\` | Report a goal's quantified progress (0-100). An agent's progress is a proposal a human approves before the goal moves. | Seat or tenant-admin | Seats set only their own goals; expect confirmation. |
+| \`rost_list_at_risk_cascade_goals\` | \`goal.list_at_risk\` | List goals projected off pace (at-risk or projected-miss) with days behind pace. Read-only; status-only goals excluded. | Tenant | Call with \`{}\`. |
 | \`rost_reparent_cascade_goal\` | \`goal.reparent\` | Move a goal under a new parent. | Tenant | Authority change; expect confirmation. |
 | \`rost_drop_cascade_goal\` | \`goal.drop\` | Drop (retire) a goal, retained for audit. | Tenant | Expect confirmation. |
 | \`rost_list_friction_issues\` | \`friction.list\` | List Friction issues ranked by impact and severity. | Seat or tenant-admin | Call with \`{}\` or \`{"status":"active"}\`. |
+| \`rost_assist_friction_issue\` | \`friction.assist\` | Advisory IDS assist: the most-similar prior resolved issues with their root causes and decisions, a recurring-pattern flag, and recommended options. Read-only \u2014 it never resolves the issue. | Tenant | Call with \`{"issue_id":"<id>"}\`. |
 | \`rost_update_friction_issue_status\` | \`friction.update_status\` | Move a non-terminal issue between open and diagnosing. | Seat or tenant-admin | Call with \`issue_id\` and \`status\`. |
 | \`rost_resolve_friction_issue\` | \`friction.resolve\` | Resolve an issue with a root cause and remediation task. | Tenant | Human decision; expect confirmation. |
 | \`rost_link_task_to_friction_issue\` | \`friction.link_task\` | Attach an existing task as an issue's action task. | Seat or tenant-admin | Call with \`issue_id\` and \`task_id\`. |
@@ -43034,6 +43065,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_sync_follow_up\` | \`sync.item.assign\` | Create a follow-up task from a Sync agenda item. | Tenant | Call with brief, owner seat, title, description. |
 | \`rost_list_escalations\` | \`escalation.list\` | List Steward queue escalations (own steward chain for humans, own seat for agents). | Seat or tenant-admin | Call with \`{}\` or \`{"include_decided":true}\`. |
 | \`rost_get_escalation\` | \`escalation.get\` | Read one escalation's evidence, recommendation, and decision state. | Seat or tenant-admin | Call with \`{"id":"<escalation-id>"}\`. Resolve/reject are human-only and not exposed over MCP. |
+| \`rost_check_compass_alignment\` | \`compass.alignment\` | Advisory drift check: scores whether cycle goals still ladder to the active vision and flags orphan/contradictory goals. Read-only \u2014 it never edits the Compass or any goal. | Tenant | Call with \`{}\`. |
+| \`rost_team_health_score\` | \`team.health_score\` | Read the single rolled-up 0-100 team-health score (latest month) with its band and label. | Tenant | Call with \`{}\`. |
 | \`rost_show_compass_as_markdown\` | \`compass.show_markdown\` | Render the current Compass and its open gaps as a clean markdown card for review. | Tenant | Call with \`{}\`. |
 | \`rost_show_charter_as_markdown\` | \`charter.show_markdown\` | Render a seat's active or latest Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
@@ -43521,7 +43554,7 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
     order: 60,
     title: "Cascade guide",
     summary: "How to connect company goals to seat-level work without turning {{brand}} into a project-management tool.",
-    version: "2026-06-20.2",
+    version: "2026-06-28.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -43533,8 +43566,11 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
       "goal.create",
       "goal.update",
       "goal.set_status",
+      "goal.set_progress",
+      "goal.list_at_risk",
       "goal.reparent",
       "goal.drop",
+      "compass.alignment",
       "confirmation.approve"
     ],
     legal: {
@@ -43576,6 +43612,10 @@ Cascade warnings are advisory, not blockers. They point to setup that should be
 
 On \`/cascade\`, the screen renders the full goal depth, not just one or two levels. Off-track descendant branches stay open so the operator can see why a parent rolled up to risk.
 
+## Goal progress and at-risk goals
+
+A goal can carry a quantified progress (0-100) distinct from its on/off/done status. Report it with \`goal.set_progress\`; when an agent reports progress it lands as a proposal a human approves before the goal moves. \`goal.list_at_risk\` projects which goals are off pace by comparing progress against the elapsed fraction of the cycle window (deterministic date math, no forecast model). Off-pace goals surface on \`/cascade\`, on the owner home, in the weekly Sync Brief, and as a weekly owner alert. Status-only goals (no progress recorded) are simply excluded from the projection.
+
 On human and function seat pages, goal visibility includes both direct goals and descendant seat goals from the Responsibility Graph subtree, so a manager can review team progress without double-owning the agent's work.
 
 ## What does not belong
@@ -43678,6 +43718,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
       "compass.answer_gap",
       "friction.file_issue",
       "friction.list",
+      "friction.assist",
       "friction.update_status",
       "friction.resolve",
       "friction.link_task",
@@ -43741,7 +43782,7 @@ Resolving Friction should produce one of four outcomes: a decision, a task, a Ch
     order: 70,
     title: "Steward queue guide",
     summary: "How Stewards review escalations, approve agent boundaries, and keep agents accountable.",
-    version: "2026-06-20.1",
+    version: "2026-06-27.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -43780,6 +43821,14 @@ In the app, the evidence is shown as a legible card, not raw data: a proposed to
 
 When nothing is waiting, the Steward page still proves the governance loop. It shows which agent or hybrid seats the human stewards, how many escalations were raised or decided recently, and whether any are open. That empty state is an operating summary, not a dead end.
 
+## How escalations reach you
+
+An escalation reaches you the same way no matter how the agent raised it \u2014 in a chat or CLI session, or on its own scheduled cloud run. When the agent stops at a boundary it opens the queue item and sends a notification to the accountable human along the steward chain, preferring a connected Slack channel and falling back to email. If no human occupies the agent's seat, the chain walks up to the next Steward. Delivery is idempotent: a retried run never notifies you twice for the same escalation, and the notification carries only summarized, redacted evidence \u2014 never secret material.
+
+## Where notifications land
+
+Every notification sent to you \u2014 escalations, approval requests, sync briefs, and your daily digest \u2014 also appears in your in-app Inbox, with unread state you can clear. A Slack or email delivery that fails is retried automatically on a bounded schedule; once it can no longer be delivered it stays visible in the Inbox rather than being lost. A once-a-day digest rolls up the day's deliverables, open approvals, and exceptions into a single message, so a quiet day stays quiet and a busy one is summarized in one place.
+
 ## Work the queue from CLI or MCP
 
 The Steward reads the queue from any surface but decides as a human.
@@ -43801,7 +43850,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-06-20.2",
+    version: "2026-06-27.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43836,6 +43885,8 @@ The \`dangerous\` confirmation **level** is rare and is not the same as the **ri
 
 A gated command does not mutate when an agent calls it. It returns a pending confirmation with the command id, a risk level, and an \`approveVia\` block containing a web URL and the exact \`{{cli}} command confirmation.approve --json ...\` line. The human approves through the web link or the CLI; the agent surfaces the link and stops. A logged-in human at an interactive CLI can run their own gated \`{{cli}} command <id>\` without copy-pasting the approval command because the CLI completes the returned confirmation inline.
 
+When an **agent** triggers a gate, {{brand}} also notifies the seat's steward (Slack with an email fallback) so the held action does not sit silent \u2014 a human is told a decision is waiting and given the approve link. A human pausing their own gated command does not self-notify. See the notifications guide.
+
 \`\`\`bash
 # Human approves a pending confirmation
 {{cli}} command confirmation.approve --json '{"confirmation_id":"<confirmation-id>"}'
@@ -43843,6 +43894,10 @@ A gated command does not mutate when an agent calls it. It returns a pending con
 {{cli}} command confirmation.reject --json '{"confirmation_id":"<confirmation-id>"}'
 \`\`\`
 
+## The approvals queue
+
+The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act.
+
 ## The rule for agents
 
 An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) are not even exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human.
@@ -43856,11 +43911,11 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-06-21.4",
+    version: "2026-06-27.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -43913,7 +43968,13 @@ Product-learning participation controls whether {{brand}} may record product/pag
 
 Read the policy with \`settings.product_learning.get\` (CLI: \`{{cli}} settings product-learning get\`). Change it with \`settings.product_learning.update\` (CLI: \`{{cli}} settings product-learning update --mode disabled\`). Analytics ingestion code should call the shared product-learning policy helper instead of reading \`tenants.settings\` directly.
 
-The product analytics foundation stores only bounded product telemetry: product events, page views by route template, command invocation metadata, onboarding milestones, and recommendation outcomes. Authenticated users can read analytics rows for their tenant, but writes are server-owned through the trusted DB helpers. The helpers and database constraints reject or redact obvious raw URLs, filesystem paths, secrets, prompt/content fields, command argument/output fields, direct contact/payment identifiers, and long prose-shaped values. These analytics rows are not audit records; operational logs and security evidence stay in their dedicated append-only or product-visible tables.
+The product analytics foundation stores only bounded product telemetry: product events, page views by route template, command invocation metadata, onboarding milestones, and recommendation outcomes. Recommendation outcomes use bounded statuses such as \`shown\`, \`accepted\`, \`edited\`, \`rejected\`, \`dismissed\`, and \`reversed\`; current instrumented paths include model-tier recommendations from \`agent.create_custom\` and Charter seat-type recommendations from the Charter lifecycle. These rows store safe enums/categories and fingerprints, not raw responsibility answers, Charter prose, prompt text, tool arguments, or customer content. Authenticated users can read analytics rows for their tenant, but writes are server-owned through the trusted DB helpers. The helpers and database constraints reject or redact obvious raw URLs, filesystem paths, secrets, prompt/content fields, command argument/output fields, direct contact/payment identifiers, and long prose-shaped values. These analytics rows are not audit records; operational logs and security evidence stay in their dedicated append-only or product-visible tables.
+
+The authenticated web app records first-party page views and product events through route templates, not raw full URLs or query strings. The ingestion route resolves tenant and user server-side, caps client batches, validates enriched payloads with the shared protocol schemas, and treats product-learning opt-out as a skipped analytics write rather than a product error.
+
+Onboarding milestones are recorded from durable server-side transitions such as company setup, graph review, first Charter draft, first agent setup/dry run/pass/live, first Signal, first goal, Sync rhythm start, and onboarding finish. They are idempotent per tenant and milestone: repeated UI, CLI, MCP, or system calls keep the earliest product-learning timestamp instead of creating duplicate funnel steps. The append-only event log remains the audit timeline; onboarding milestone rows are a bounded analytics projection and are skipped when product learning is disabled.
+
+Command invocation analytics are emitted from the central command executor for UI, CLI, and MCP calls. They store command id, source, actor/scope kind, outcome class, duration, confirmation flag, guard result, request id when UUID-shaped, safe error code, and bounded changed ids. They do not store raw command arguments or outputs. The command outcome classes are \`ok\`, \`denied\`, \`pending_confirmation\`, \`validation_error\`, \`precondition_error\`, \`authorization_error\`, and \`internal_error\`. Product analytics write failures are ignored so they cannot mask the command result or replace audit/security records.
 
 ## Inference budget
 
@@ -43923,6 +43984,16 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 - The sandbox dry run is free and is never blocked by the cap, so a fresh company can charter, dry-run, and take an agent live before setting a budget. The cap applies only to real managed-inference runs.
 - A company that brings its own provider key (BYOK) is metered on that key and is not subject to the {{brand}}-managed hard cap. BYOK changes the provider account used for eligible cloud calls, not the Charter, tool guard, human gate, or data-retention posture; see the ai-model-data-handling-guide before making provider-handling claims.
 
+## Company autonomy ceiling (Company Guardrails)
+
+The company autonomy ceiling is a single tenant-wide dial that caps how much ANY agent may do **without a human in the loop**. It is the fourth governance gate, after the signed manifest, the budget, and before escalation \u2014 it never replaces them. It only ever constrains AUTONOMOUS (always_allow) actions; a tool already routed to a human (always_ask), an explicit escalation, a connector that already escalated, or secret-shaped input is never blocked by the ceiling.
+
+- Read it with \`settings.agent_policy.get\` (CLI: \`{{cli}} settings agent-policy get\`).
+- Set it with \`settings.agent_policy.update\` (CLI: \`{{cli}} settings agent-policy set --profile locked_down\`). Owner-only and human-gated.
+- Profiles are named ceilings: \`locked_down\` (agents autonomously read/draft only; every write/send escalates), \`balanced\` (the default; read/draft autonomous, writes escalate), \`high_autonomy\` (approval-marked write tools may run autonomously; only full-access escalates), and \`custom\` + \`max_autonomous_risk\` (\`low\`, \`medium\`, \`high\`, \`critical\`).
+- An explicitly set ceiling is ENFORCED by default. Enforcement has two modes: \`enforce\` blocks an over-ceiling autonomous call and routes it to the steward (it is never a dead-end deny \u2014 a human can still approve), and \`observe\` allows the call but logs it. The platform default for a company that never set a policy is balanced + observe, so existing live agents are never retro-bricked.
+- When enforcement is on, signing a manifest or taking an agent live is REFUSED if the manifest grants always_allow to a tool whose risk exceeds the ceiling; the error names the exact ceiling, tool, and risk in its \`details\`. Lower that tool to always_ask, or raise the ceiling, then retry.
+
 ## Agent guidance
 
 Agents may explain which setting is needed and why. They should not ask users to paste secrets into chat or tool arguments. When credentials are required, route the user to the vault-backed setup flow.`
@@ -43966,7 +44037,7 @@ When a user asks to add a person, clarify whether they mean app access, seat occ
     order: 74,
     title: "Notifications guide",
     summary: "How {{brand}} should notify humans about decisions, escalations, stale work, and agent boundaries.",
-    version: "2026-06-19.1",
+    version: "2026-06-27.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -43987,6 +44058,7 @@ Notifications should move decisions to the right human without turning {{brand}}
 
 - An agent hits a must-escalate condition.
 - A tool or credential approval is needed.
+- An agent holds a durable command behind a pending confirmation \u2014 the seat's steward is notified so the held action does not sit silent. A human pausing their own gated command does not self-notify.
 - A Signal is broken or stale.
 - A Friction item needs a decision.
 - A Sync decision creates a handoff.
@@ -44244,7 +44316,7 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
     order: 78,
     title: "AI model data handling guide",
     summary: "How {{brand}} cloud agents, local MCP sessions, runners, BYOK, and connected tools handle model-bound data.",
-    version: "2026-06-21.4",
+    version: "2026-06-22.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
@@ -44269,27 +44341,27 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
       {
         label: "OpenAI API data controls",
         url: "https://developers.openai.com/api/docs/guides/your-data",
-        note: "Official API data-use and retention controls verified 2026-06-21."
+        note: "Official API data-use and retention controls verified 2026-06-22."
       },
       {
         label: "OpenAI enterprise privacy",
         url: "https://openai.com/enterprise-privacy/",
-        note: "Official enterprise privacy and API retention summary verified 2026-06-21."
+        note: "Official enterprise privacy and API retention summary verified 2026-06-22."
       },
       {
         label: "OpenAI Codex with ChatGPT plan",
         url: "https://help.openai.com/en/articles/11369540-using-codex-with-your-chatgpt-plan",
-        note: "Official Codex plan data-control scope verified 2026-06-21."
+        note: "Official Codex plan data-control scope verified 2026-06-22."
       },
       {
         label: "Anthropic API and data retention",
         url: "https://platform.claude.com/docs/en/manage-claude/api-and-data-retention",
-        note: "Official Claude API ZDR, HIPAA, and retention scope verified 2026-06-21."
+        note: "Official Claude API ZDR, HIPAA, and retention scope verified 2026-06-22."
       },
       {
         label: "Claude Code data usage",
         url: "https://code.claude.com/docs/en/data-usage",
-        note: "Official local Claude Code data-flow, training, and retention summary verified 2026-06-21."
+        note: "Official local Claude Code data-flow, training, and retention summary verified 2026-06-22."
       },
       {
         label: "Reference corpus and docs spec",
@@ -44392,15 +44464,15 @@ If sensitive data appears by accident, stop, do not repeat it, and route cleanup
 
 ## Provider policy checkpoints
 
-For platform-managed \`cloud\` runs and BYOK Anthropic \`cloud\` runs, check the Anthropic account, workspace, model, and contract. As of 2026-06-21, official Anthropic Claude API documentation says retained API data is not used for model training without express permission, that some API features are ZDR-eligible while others are not, and that ZDR, HIPAA readiness, model-specific retention requirements, consumer products, Claude Code, and third-party integrations each have their own scope.
+For platform-managed \`cloud\` runs and BYOK Anthropic \`cloud\` runs, check the Anthropic account, workspace, model, and contract. As of 2026-06-22, official Anthropic Claude API documentation says retained API data is not used for model training without express permission, that some API features are ZDR-eligible while others are not, and that ZDR, HIPAA readiness, model-specific retention requirements, consumer products, Claude Code, and third-party integrations each have their own scope.
 
-For local OpenAI API-key clients running through \`mcp_session\` or \`runner\`, check the customer's OpenAI organization, project, endpoint, and API data controls. As of 2026-06-21, official OpenAI API documentation says API data is not used to train or improve OpenAI models unless the customer explicitly opts in, and default abuse-monitoring logs may retain customer content for up to 30 days unless approved controls apply. OpenAI says zero data retention is available only for eligible customers, endpoints, and use cases.
+For local OpenAI API-key clients running through \`mcp_session\` or \`runner\`, check the customer's OpenAI organization, project, endpoint, and API data controls. As of 2026-06-22, official OpenAI API documentation says API data is not used to train or improve OpenAI models unless the customer explicitly opts in, and default abuse-monitoring logs may retain customer content for up to 30 days unless approved controls apply. OpenAI says zero data retention is available only for eligible customers, endpoints, and use cases.
 
 For Codex specifically, first identify whether the operator is using Codex through a ChatGPT Free/Plus/Pro, Business, Enterprise, Edu, API, or other workspace path. Official OpenAI Codex help says ChatGPT training data controls apply to whether content processed through Codex may be used to improve OpenAI models when Codex is used with a ChatGPT plan, and that Pro and Plus conversations may be used unless training is disabled. Do not give a Codex user the OpenAI API answer unless they are actually using an API-governed Codex path.
 
 For local Claude Code clients running through \`mcp_session\` or \`runner\`, check whether the customer is using a consumer, team, enterprise, API, or third-party-platform path. Official Claude Code documentation separately describes consumer versus commercial handling, local transcript storage, telemetry, feedback, and provider-specific defaults.
 
-Use those statements only as current provider-doc summaries. Do not convert them into a blanket {{brand}} claim. The correct customer-facing answer is: "Here is the lane, here is what {{brand}} sends, here is which provider account or local client handles it, and here is what to verify in that account before treating the workflow as no-training, zero-retention, HIPAA-ready, or region-bound."
+Use those statements only as current provider-doc summaries. Do not convert them into a blanket {{brand}} claim. The correct customer-facing answer is: "Here is the lane, here is what {{brand}} sends, here is which provider account or local client handles it, and here is what to verify in that account before treating the workflow as no-training, zero-retention, HIPAA-ready, or region-bound." If a customer or prospect asks for a DPA, BAA, SOC 2 report, regional processing commitment, customer-managed retention window, staff-access approval workflow, or customer-visible staff-access log, escalate instead of answering from this guide.
 
 ## Agent response checklist
 
@@ -44410,7 +44482,8 @@ When asked about AI data handling:
 2. Name the specific data classes that can enter the prompt or tool result.
 3. Name whether the provider path is platform-managed, tenant BYOK Anthropic, local client/account, or runner-controlled.
 4. Warn if the answer depends on provider settings, contract terms, ZDR approval, HIPAA readiness, model choice, endpoint, or third-party tool policy.
-5. Recommend the smallest safe next step: narrow the tool scope, use a vault ref, redact the input, switch to the approved provider account, or escalate for human/legal review.`
+5. Escalate contractual, compliance, regional-processing, customer-managed retention, or staff-access-commitment questions instead of answering from this guide.
+6. Recommend the smallest safe next step: narrow the tool scope, use a vault ref, redact the input, switch to the approved provider account, or escalate for human/legal review.`
   },
   {
     slug: "security-model-guide",
@@ -45908,12 +45981,12 @@ function resolveModelConfig(model, effort) {
     ...resolvedEffort ? { effort: resolvedEffort } : {}
   };
 }
-function usageWithSchemaFooter(usage, bin) {
-  return `${usage}
+function usageWithSchemaFooter(usage2, bin) {
+  return `${usage2}
 discover a command's exact input with: ${bin} command schema <id>`;
 }
-async function dispatch(context, group, args, actions, usage) {
-  const usageText = usageWithSchemaFooter(usage, context.binName);
+async function dispatch(context, group, args, actions, usage2) {
+  const usageText = usageWithSchemaFooter(usage2, context.binName);
   const action = args[0];
   if (action === "--help" || action === "-h" || action === "help") {
     context.io.stdout.write(`${usageText}
@@ -45939,12 +46012,137 @@ ${usageText}
   }
 }
 function execute(context, parsed, commandId, body, format) {
-  const options = parsed.seat === void 0 ? void 0 : { targetSeatId: parsed.seat };
+  const autoConfirm = parsed.flags.has("yes") || parsed.flags.has("y");
+  const options = {
+    ...parsed.seat === void 0 ? {} : { targetSeatId: parsed.seat },
+    ...autoConfirm ? { autoConfirm: true } : {}
+  };
   if (parsed.json) {
     return context.run(context.client, commandId, body, void 0, options);
   }
   return context.run(context.client, commandId, body, format, options);
 }
+var graphWrapper = (context, args) => dispatch(context, "graph", args, {
+  show: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "graph.get", {}, formatGraph);
+  },
+  get: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "graph.get", {}, formatGraph);
+  }
+}, graphUsage(context.binName));
+function formatGraph(output) {
+  const record2 = asRecord(output);
+  const nodes = asArray(record2.nodes);
+  if (nodes.length === 0) {
+    return "No seats in the Responsibility Graph.";
+  }
+  const lines = [
+    `root_seat_id=${field(record2, "root_seat_id")}`,
+    "seat_id  parent_seat_id  type  status  name"
+  ];
+  for (const node of nodes) {
+    const row = asRecord(node);
+    lines.push(`${field(row, "seat_id")}  ${field(row, "parent_seat_id")}  ${field(row, "seat_type")}  ${field(row, "status")}  ${field(row, "name")}`);
+  }
+  return lines.join("\n");
+}
+function graphUsage(bin) {
+  return `Usage: ${bin} graph show|get [--json]
+  ${bin} graph show`;
+}
+var seatWrapper = (context, args) => dispatch(context, "seat", args, {
+  list: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "graph.get", {}, formatSeatList);
+  },
+  get: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const seatId = requireValue2(parsed, "seat-id");
+    return execute(ctx, parsed, "seat.get", { seat_id: seatId }, formatSeatDetail);
+  },
+  create: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({
+      name: requireValue2(parsed, "name"),
+      seat_type: requireValue2(parsed, "type")
+    }, {
+      parent_seat_id: optionalValue(parsed, "parent-seat-id")
+    });
+    return execute(ctx, parsed, "seat.create", body, formatSeatMutation);
+  },
+  rename: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "seat.rename", {
+      seat_id: requireValue2(parsed, "seat-id"),
+      name: requireValue2(parsed, "name")
+    }, formatSeatMutation);
+  },
+  reparent: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "seat.reparent", {
+      seat_id: requireValue2(parsed, "seat-id"),
+      new_parent_seat_id: requireValue2(parsed, "parent-seat-id")
+    }, formatSeatMutation);
+  },
+  decommission: (ctx, rest) => {
+    const parsed = parseFlags(rest, /* @__PURE__ */ new Set(["dry-run", "preview"]));
+    if (parsed.flags.has("dry-run") || parsed.flags.has("preview")) {
+      return execute(ctx, parsed, "seat.decommission_preview", {
+        seat_id: requireValue2(parsed, "seat-id")
+      }, formatSeatDecommissionPreview);
+    }
+    return execute(ctx, parsed, "seat.decommission", {
+      seat_id: requireValue2(parsed, "seat-id")
+    }, formatSeatMutation);
+  }
+}, seatUsage(context.binName));
+function formatSeatList(output) {
+  const nodes = asArray(asRecord(output).nodes);
+  if (nodes.length === 0) {
+    return "No seats.";
+  }
+  return nodes.map((node) => {
+    const row = asRecord(node);
+    return `seat_id=${field(row, "seat_id")} parent_seat_id=${field(row, "parent_seat_id")} type=${field(row, "seat_type")} status=${field(row, "status")} name=${field(row, "name")}`;
+  }).join("\n");
+}
+function formatSeatDetail(output) {
+  const record2 = asRecord(output);
+  const counts = asRecord(record2.counts);
+  return [
+    `seat_id=${field(record2, "seat_id")} name=${field(record2, "name")} type=${field(record2, "seat_type")} status=${field(record2, "status")}`,
+    `parent_seat_id=${field(record2, "parent_seat_id")} active_charter_version_id=${field(record2, "active_charter_version_id")} draft_charter_version_id=${field(record2, "draft_charter_version_id")}`,
+    `agent_status=${field(record2, "agent_status")} agent_lane=${field(record2, "agent_lane")}`,
+    `counts: open_tasks=${field(counts, "open_tasks")} owned_goals=${field(counts, "owned_goals")} active_measurables=${field(counts, "active_measurables")} open_issues=${field(counts, "open_issues")}`
+  ].join("\n");
+}
+function formatSeatMutation(output) {
+  const record2 = asRecord(output);
+  return `seat_id=${field(record2, "seat_id")}`;
+}
+function formatSeatDecommissionPreview(output) {
+  const record2 = asRecord(output);
+  const effects = asArray(record2.effects).map((effect) => `- ${String(effect)}`);
+  return [
+    `seat_id=${field(record2, "seat_id")} name=${field(record2, "seat_name")} status=${field(record2, "previous_status")}`,
+    `active_occupancies=${field(record2, "active_occupancy_count")} active_agents=${field(record2, "active_agent_ids")}`,
+    `active_charters=${field(record2, "active_charter_count")} mcp_tokens=${field(record2, "active_mcp_token_count")} credentials=${field(record2, "active_credential_count")}`,
+    `open_work_orders=${field(record2, "open_work_order_count")} schedules=${field(record2, "schedule_count")} no_orphan_steward_guard=${field(record2, "no_orphan_steward_guard")}`,
+    "effects:",
+    ...effects
+  ].join("\n");
+}
+function seatUsage(bin) {
+  return `Usage: ${bin} seat list|get|create|rename|reparent|decommission [--json] [--yes]
+  ${bin} seat list
+  ${bin} seat get --seat-id <id>
+  ${bin} seat create --name <text> --type human|agent|hybrid [--parent-seat-id <id>]
+  ${bin} seat rename --seat-id <id> --name <text>
+  ${bin} seat reparent --seat-id <id> --parent-seat-id <id> [--yes]
+  ${bin} seat decommission --seat-id <id> [--dry-run] [--yes]`;
+}
 var taskWrapper = (context, args) => dispatch(context, "task", args, {
   list: (ctx, rest) => {
     const parsed = parseFlags(rest);
@@ -46457,13 +46655,14 @@ var runnerWrapper = (context, args) => dispatch(context, "runner", args, {
   }
 }, runnerUsage(context.binName));
 function runnerUsage(bin) {
-  return `Usage: ${bin} runner list|status|diagnose|repair|work-orders|revoke [--json]
+  return `Usage: ${bin} runner list|status|diagnose|repair|work-orders|revoke|serve [--json]
   ${bin} runner list [--include-revoked]
   ${bin} runner status --runner-id <id>
   ${bin} runner diagnose --runner-id <id>
   ${bin} runner repair --runner-id <id> [--issue restart|re_pair|revoke_stale|missing_cli_runtime]
   ${bin} runner work-orders [--status <s>] [--agent-id <id>] [--runner-id <id>] [--limit <n>]
-  ${bin} runner revoke --runner-id <id>`;
+  ${bin} runner revoke --runner-id <id>
+  ${bin} runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--once] [--execute]`;
 }
 var notificationWrapper = (context, args) => dispatch(context, "notification", args, {
   settings: (ctx, rest) => {
@@ -46599,6 +46798,30 @@ var settingsWrapper = (context, args) => dispatch(context, "settings", args, {
       });
     }
   }, settingsUsage(ctx.binName)),
+  "agent-policy": (ctx, rest) => dispatch(ctx, "settings agent-policy", rest, {
+    get: (innerCtx, innerRest) => {
+      const parsed = parseFlags(innerRest);
+      return execute(innerCtx, parsed, "settings.agent_policy.get", {}, (output) => {
+        const policy = asRecord(asRecord(output).agent_policy);
+        return `agent_policy profile=${field(policy, "profile")}  enforcement=${field(policy, "enforcement")}  max_autonomous_risk=${field(policy, "max_autonomous_risk")}  explicit=${field(policy, "explicit")}`;
+      });
+    },
+    set: (innerCtx, innerRest) => {
+      const parsed = parseFlags(innerRest);
+      const profile = optionalValue(parsed, "profile");
+      if (profile !== "locked_down" && profile !== "balanced" && profile !== "high_autonomy" && profile !== "custom") {
+        throw new UsageError("Provide --profile locked_down|balanced|high_autonomy|custom.");
+      }
+      const body = withOptional({ profile }, {
+        max_autonomous_risk: optionalValue(parsed, "max-autonomous-risk"),
+        enforcement: optionalValue(parsed, "enforcement")
+      });
+      return execute(innerCtx, parsed, "settings.agent_policy.update", body, (output) => {
+        const policy = asRecord(asRecord(output).agent_policy);
+        return `Set company autonomy ceiling to ${field(policy, "profile")} (max_autonomous_risk=${field(policy, "max_autonomous_risk")}, enforcement=${field(policy, "enforcement")}).`;
+      });
+    }
+  }, settingsUsage(ctx.binName)),
   get: (ctx, rest) => {
     const parsed = parseFlags(rest);
     return execute(ctx, parsed, "settings.get", {}, (output) => {
@@ -46635,11 +46858,13 @@ var settingsWrapper = (context, args) => dispatch(context, "settings", args, {
   }
 }, settingsUsage(context.binName));
 function settingsUsage(bin) {
-  return `Usage: ${bin} settings get|update|product-learning|rename [--json]
+  return `Usage: ${bin} settings get|update|product-learning|agent-policy|rename [--json]
   ${bin} settings get
   ${bin} settings update [--soft-cap-usd <n>] [--hard-cap-usd <n>]
   ${bin} settings product-learning get
   ${bin} settings product-learning update --mode enabled|disabled|enterprise_contract
+  ${bin} settings agent-policy get
+  ${bin} settings agent-policy set --profile locked_down|balanced|high_autonomy|custom [--max-autonomous-risk low|medium|high|critical] [--enforcement enforce|observe]
   ${bin} settings rename --company <name>`;
 }
 var memberWrapper = (context, args) => dispatch(context, "member", args, {
@@ -47422,7 +47647,9 @@ var OPERATION_GROUPS = [
   "compass",
   "charter",
   "deliverable",
-  "system"
+  "system",
+  "graph",
+  "seat"
 ];
 var wrappers = {
   task: taskWrapper,
@@ -47445,7 +47672,9 @@ var wrappers = {
   compass: compassWrapper,
   charter: charterWrapper,
   deliverable: deliverableWrapper,
-  system: systemWrapper
+  system: systemWrapper,
+  graph: graphWrapper,
+  seat: seatWrapper
 };
 function isOperationGroup(value) {
   return value !== void 0 && OPERATION_GROUPS.includes(value);
@@ -47471,7 +47700,9 @@ var groupUsageBuilders = {
   compass: compassUsage,
   charter: charterUsage,
   deliverable: deliverableUsage,
-  system: systemUsage
+  system: systemUsage,
+  graph: graphUsage,
+  seat: seatUsage
 };
 function operationGroupUsage(group, bin) {
   return usageWithSchemaFooter(groupUsageBuilders[group](bin), bin);
@@ -47494,9 +47725,9 @@ function operationUsageLines(bin) {
     `${bin} escalation list|get|resolve|reject`,
     `${bin} error list|resolve|supersede`,
     `${bin} sync brief|compile|complete`,
-    `${bin} runner list|status|diagnose|repair|work-orders|revoke`,
+    `${bin} runner list|status|diagnose|repair|work-orders|revoke|serve`,
     `${bin} notification settings|test|errors`,
-    `${bin} settings get|update|product-learning|rename`,
+    `${bin} settings get|update|product-learning|agent-policy|rename`,
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,
@@ -47504,7 +47735,9 @@ function operationUsageLines(bin) {
     `${bin} model list`,
     `${bin} compass show`,
     `${bin} charter show`,
-    `${bin} deliverable list|get|create|attach`
+    `${bin} deliverable list|get|create|attach`,
+    `${bin} graph show`,
+    `${bin} seat list|get|create|rename|reparent|decommission`
   ];
 }
 
@@ -47999,6 +48232,424 @@ function pendingConfirmationFromError(error51) {
   return { confirmationId, commandId };
 }
 
+// src/doctor.ts
+import { execFile as execFileCallback2 } from "node:child_process";
+import { access, readFile as readFile3 } from "node:fs/promises";
+import { delimiter } from "node:path";
+import { promisify as promisify3 } from "node:util";
+var execFile3 = promisify3(execFileCallback2);
+async function runDoctor(options) {
+  const env = options.env ?? process.env;
+  const store = options.store ?? createTokenStore();
+  const lines = [`${cliBrand.name} CLI doctor`];
+  const config2 = loadConfig(env);
+  lines.push(`app_url: ${config2.appUrl}`);
+  lines.push(`supabase_url: ${config2.supabaseUrl}`);
+  const currentVersion = await readCurrentVersion2();
+  lines.push(`version: ${currentVersion ?? "unknown"}`);
+  const pathStatus = await checkPath(env);
+  lines.push(pathStatus);
+  try {
+    const session = await store.read();
+    lines.push(`session: ${session ? `present (${store.describe()})` : `missing - run ${cliBrand.binName} login --device`}`);
+  } catch (error51) {
+    lines.push(`session: unreadable - ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}`);
+  }
+  const [claude, codex] = await Promise.all([probeCli("claude"), probeCli("codex")]);
+  lines.push(`claude: ${claude}`);
+  lines.push(`codex: ${codex}`);
+  const latest = await fetchLatestVersion2(cliBrand.packageName, env);
+  if (currentVersion && latest && isSemverBehind2(currentVersion, latest)) {
+    lines.push(`update: ${currentVersion} -> ${latest}; run npm i -g ${cliBrand.packageName}@latest`);
+  } else if (latest) {
+    lines.push(`update: current (${latest})`);
+  } else {
+    lines.push("update: skipped or unavailable");
+  }
+  options.io.stdout.write(`${lines.join("\n")}
+`);
+  return 0;
+}
+async function checkPath(env) {
+  const pathValue = env.PATH ?? "";
+  const candidates = pathValue.split(delimiter).filter(Boolean).map((entry) => `${entry}/${cliBrand.binName}`);
+  for (const candidate of candidates) {
+    try {
+      await access(candidate);
+      return `path: found ${candidate}`;
+    } catch {
+      continue;
+    }
+  }
+  return `path: ${cliBrand.binName} not found on PATH - use npx ${cliBrand.packageName}@latest or add your npm global bin directory`;
+}
+async function probeCli(command) {
+  try {
+    const { stdout, stderr } = await execFile3(command, ["--version"], { timeout: 1500 });
+    const version4 = (stdout || stderr).trim().split("\n")[0]?.trim();
+    return version4 ? `installed (${version4})` : "installed";
+  } catch {
+    return "not found";
+  }
+}
+async function readCurrentVersion2() {
+  try {
+    const url2 = new URL("../package.json", import.meta.url);
+    const parsed = JSON.parse(await readFile3(url2, "utf8"));
+    return typeof parsed.version === "string" ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchLatestVersion2(packageName, env) {
+  if (env.CI || env.VITEST || env.CLI_SKIP_UPDATE_CHECK === "1" || env[`${cliBrand.envPrefix}_CLI_NO_UPDATE_CHECK`] === "1") {
+    return null;
+  }
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 750);
+  try {
+    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, {
+      headers: { accept: "application/json" },
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const body = await response.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function isSemverBehind2(currentVersion, latestVersion) {
+  const current = parseSemver2(currentVersion);
+  const latest = parseSemver2(latestVersion);
+  if (!current || !latest) {
+    return currentVersion !== latestVersion;
+  }
+  if (current.major !== latest.major) {
+    return current.major < latest.major;
+  }
+  if (current.minor !== latest.minor) {
+    return current.minor < latest.minor;
+  }
+  return current.patch < latest.patch;
+}
+function parseSemver2(value) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(value);
+  if (!match) {
+    return null;
+  }
+  const [, major, minor, patch] = match;
+  if (major === void 0 || minor === void 0 || patch === void 0) {
+    return null;
+  }
+  return {
+    major: Number.parseInt(major, 10),
+    minor: Number.parseInt(minor, 10),
+    patch: Number.parseInt(patch, 10)
+  };
+}
+
+// src/runner-serve.ts
+import { execFile as execFileCallback3, spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmod, mkdir as mkdir2, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { hostname as hostname3, tmpdir } from "node:os";
+import path3 from "node:path";
+import { setTimeout as sleep2 } from "node:timers/promises";
+import { promisify as promisify4 } from "node:util";
+var execFile4 = promisify4(execFileCallback3);
+async function runRunnerServe(options) {
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let config2;
+  try {
+    config2 = parseServeArgs(options.args, options.appUrl, env);
+  } catch (error51) {
+    options.io.stderr.write(`${error51 instanceof Error ? error51.message : String(error51)}
+${usage()}
+`);
+    return 1;
+  }
+  options.io.stdout.write(`runner serve: ${options.appUrl} name=${config2.name} execute=${config2.execute}
+`);
+  let state;
+  try {
+    state = await pairIfNeeded(options.client ?? null, fetchImpl, options.appUrl, config2, options.io);
+  } catch (error51) {
+    options.io.stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+    return 1;
+  }
+  let beat = 0;
+  let heartbeatSucceeded = false;
+  let failed = false;
+  do {
+    const capabilities = await detectCapabilities();
+    try {
+      const heartbeat = await post2(fetchImpl, options.appUrl, "/api/runner/heartbeat", { capabilities }, state.runner_secret);
+      if (heartbeat.status !== 200) {
+        options.io.stderr.write(`heartbeat ${heartbeat.status}: ${redactForLog(JSON.stringify(heartbeat.json))}
+`);
+        failed = true;
+      } else {
+        heartbeatSucceeded = true;
+        options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
+`);
+      }
+      if (config2.execute && capabilities.claude.installed) {
+        await claimAndExecute(fetchImpl, options.appUrl, state, options.io);
+      }
+    } catch (error51) {
+      failed = true;
+      options.io.stderr.write(`transient runner error (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+    }
+    beat += 1;
+    if (!config2.once) {
+      await sleep2(config2.heartbeatMs);
+    }
+  } while (!config2.once);
+  return heartbeatSucceeded && !failed ? 0 : 1;
+}
+function parseServeArgs(args, appUrl2, env) {
+  let name = env.RUNNER_NAME ?? `headless-${hostname3()}`;
+  let stateFile = env.RUNNER_STATE_FILE ?? path3.join(tmpdir(), `rost-runner-${createHash("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
+  let execute2 = env.RUNNER_EXECUTE === "1";
+  let once = false;
+  let userCode = env.RUNNER_USER_CODE;
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--name") {
+      name = requiredValue(args, index);
+      index += 1;
+    } else if (token === "--state-file") {
+      stateFile = requiredValue(args, index);
+      index += 1;
+    } else if (token === "--heartbeat-ms") {
+      heartbeatMs = Number(requiredValue(args, index));
+      index += 1;
+    } else if (token === "--user-code") {
+      userCode = requiredValue(args, index);
+      index += 1;
+    } else if (token === "--execute") {
+      execute2 = true;
+    } else if (token === "--once") {
+      once = true;
+    } else {
+      throw new Error(`Unexpected runner serve argument: ${token ?? ""}`);
+    }
+  }
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3) {
+    throw new Error("--heartbeat-ms must be an integer >= 1000.");
+  }
+  return { name, stateFile, heartbeatMs, execute: execute2, once, ...userCode ? { userCode } : {} };
+}
+function requiredValue(args, index) {
+  const value = args[index + 1];
+  if (value === void 0 || value.startsWith("--")) {
+    throw new Error(`${args[index] ?? "flag"} requires a value.`);
+  }
+  return value;
+}
+async function resolveRunnerServeTenant(client) {
+  try {
+    const response = await client.execute("user.whoami", {});
+    const output = response.output && typeof response.output === "object" && !Array.isArray(response.output) ? response.output : {};
+    const activeTenantId = output.active_tenant_id ?? output.current_tenant_id ?? output.tenant_id;
+    return typeof activeTenantId === "string" && activeTenantId.length > 0 ? activeTenantId : null;
+  } catch {
+    return null;
+  }
+}
+async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
+  if (client) {
+    const expectedTenantId = await resolveRunnerServeTenant(client);
+    if (expectedTenantId) {
+      config2.expectedTenantId = expectedTenantId;
+    }
+  }
+  const existing = await loadState(config2.stateFile, config2.expectedTenantId);
+  if (existing) {
+    io.stdout.write(`reusing paired runner ${existing.runner_id}
+`);
+    return existing;
+  }
+  if (!client) {
+    throw new Error(`No paired runner state at ${config2.stateFile}. Run with a CLI login once to pair this runner before starting without a CLI session.`);
+  }
+  const userCode = config2.userCode ?? await startPairing(client, config2);
+  const claim = await post2(fetchImpl, appUrl2, "/api/runner/pairing/claim", { user_code: userCode });
+  const runnerSecret = claim.json.runner_secret;
+  const runnerId = claim.json.runner_id;
+  const tenantId = claim.json.tenant_id;
+  if (claim.status !== 200 || typeof runnerSecret !== "string" || typeof runnerId !== "string") {
+    throw new Error(`pairing claim failed ${claim.status}: ${redactForLog(JSON.stringify(claim.json))}`);
+  }
+  const state = {
+    runner_id: runnerId,
+    runner_secret: runnerSecret,
+    ...typeof tenantId === "string" ? { tenant_id: tenantId } : config2.expectedTenantId ? { tenant_id: config2.expectedTenantId } : {},
+    name: typeof claim.json.name === "string" ? claim.json.name : config2.name
+  };
+  await mkdir2(path3.dirname(config2.stateFile), { recursive: true, mode: 448 });
+  await writeFile2(config2.stateFile, `${JSON.stringify(state)}
+`, { mode: 384 });
+  await chmod(config2.stateFile, 384);
+  io.stdout.write(`paired runner_id=${runnerId} state_file=${config2.stateFile}
+`);
+  return state;
+}
+async function loadState(filePath, expectedTenantId) {
+  try {
+    const parsed = JSON.parse(await readFile4(filePath, "utf8"));
+    if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
+      if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
+        return null;
+      }
+      return {
+        runner_id: parsed.runner_id,
+        runner_secret: parsed.runner_secret,
+        ...typeof parsed.tenant_id === "string" ? { tenant_id: parsed.tenant_id } : {},
+        ...typeof parsed.name === "string" ? { name: parsed.name } : {}
+      };
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function startPairing(client, config2) {
+  const response = await client.execute("runner.pairing.start", { name: config2.name, platform: process.platform });
+  const userCode = response.output && typeof response.output === "object" ? response.output.user_code : void 0;
+  if (typeof userCode !== "string" || userCode.length === 0) {
+    throw new Error("runner.pairing.start did not return a user_code.");
+  }
+  return userCode;
+}
+async function detectCapabilities() {
+  const [claude, codex] = await Promise.all([probe("claude"), probe("codex")]);
+  return { claude, codex };
+}
+async function probe(command) {
+  try {
+    const { stdout, stderr } = await execFile4(command, ["--version"], { timeout: 1500 });
+    return { installed: true, version: (stdout || stderr).trim() || null, auth_state: "ready" };
+  } catch {
+    return { installed: false, version: null, auth_state: "unknown" };
+  }
+}
+async function post2(fetchImpl, appUrl2, pathName, body, token) {
+  const headers = { "content-type": "application/json" };
+  if (token) {
+    headers.authorization = `Bearer ${token}`;
+  }
+  const response = await fetchImpl(`${appUrl2.replace(/\/+$/, "")}${pathName}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  });
+  const text = await response.text();
+  let json2;
+  try {
+    json2 = JSON.parse(text);
+  } catch {
+    json2 = { raw: text.slice(0, 300) };
+  }
+  return { status: response.status, json: json2 };
+}
+async function claimAndExecute(fetchImpl, appUrl2, state, io) {
+  const claimed = await post2(fetchImpl, appUrl2, "/api/runner/work-orders/claim", {}, state.runner_secret);
+  const workOrder = claimed.json.work_order;
+  if (claimed.status !== 200 || !workOrder || typeof workOrder !== "object") {
+    return;
+  }
+  const workOrderId = workOrder.id;
+  if (typeof workOrderId !== "string") {
+    return;
+  }
+  const started = await post2(fetchImpl, appUrl2, `/api/runner/work-orders/${encodeURIComponent(workOrderId)}/start`, {}, state.runner_secret);
+  if (started.status !== 200) {
+    throw new Error(`work order start failed ${started.status}: ${redactForLog(JSON.stringify(started.json))}`);
+  }
+  const result = await runClaudeTurn(appUrl2, workOrder);
+  const reported = await post2(fetchImpl, appUrl2, `/api/runner/work-orders/${encodeURIComponent(workOrderId)}/result`, {
+    status: result.ok ? "succeeded" : "failed",
+    summary: result.summary,
+    log_ref: `runner-local:${workOrderId}`,
+    model: "claude-cli"
+  }, state.runner_secret);
+  if (reported.status !== 200) {
+    throw new Error(`work order result failed ${reported.status}: ${redactForLog(JSON.stringify(reported.json))}`);
+  }
+  io.stdout.write(`work_order_id=${workOrderId} status=${result.ok ? "succeeded" : "failed"}
+`);
+}
+async function runClaudeTurn(appUrl2, workOrder) {
+  const mcp = typeof workOrder.mcp === "object" && workOrder.mcp !== null ? workOrder.mcp : {};
+  const token = typeof mcp.token === "string" ? mcp.token : "";
+  const url2 = typeof mcp.url === "string" ? `${appUrl2.replace(/\/+$/, "")}${mcp.url}` : `${appUrl2.replace(/\/+$/, "")}/mcp`;
+  const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
+  const configPath = path3.join(tmpdir(), `rost-runner-mcp-${createHash("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  const context = {
+    work_order_id: workOrder.id,
+    task_id: workOrder.task_id ?? null,
+    seat: workOrder.seat ?? null,
+    charter: workOrder.charter ?? null,
+    permission_manifest: workOrder.permission_manifest ?? null
+  };
+  const prompt = [
+    `Load your ${cliBrand.name} context, report one read-only status, and stop.`,
+    "Do not call external systems or mutating tools.",
+    `Claimed work order context: ${JSON.stringify(context).slice(0, 8e3)}`
+  ].join("\n");
+  await writeFile2(configPath, `${mcpConfig}
+`, { mode: 384 });
+  await chmod(configPath, 384);
+  return new Promise((resolve2) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      void rm2(configPath, { force: true });
+      resolve2(result);
+    };
+    const child = spawn("claude", ["-p", prompt, "--mcp-config", configPath, "--strict-mcp-config", "--output-format", "text"], {
+      cwd: tmpdir(),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let out = "";
+    let err = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ ok: false, summary: "turn timed out after 180s" });
+    }, 18e4);
+    child.stdout.on("data", (data) => {
+      out += data.toString("utf8");
+    });
+    child.stderr.on("data", (data) => {
+      err += data.toString("utf8");
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({ ok: code === 0, summary: redactForLog((out || err || "completed").trim()).slice(0, 600) });
+    });
+    child.on("error", (error51) => {
+      clearTimeout(timer);
+      finish({ ok: false, summary: `spawn error: ${redactForLog(error51.message)}` });
+    });
+  });
+}
+function usage() {
+  return "Usage: rost runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--user-code <code>] [--once] [--execute]";
+}
+
 // src/index.ts
 async function main(argv = process.argv.slice(2), options = {}) {
   const io = options.io ?? {
@@ -48052,6 +48703,13 @@ async function main(argv = process.argv.slice(2), options = {}) {
     }
     return result.exitCode;
   }
+  if (command === "doctor") {
+    return runDoctor({
+      io,
+      env: process.env,
+      ...options.store ? { store: options.store } : {}
+    });
+  }
   if (command === "onboard" && args[0] === "run") {
     io.stdout.write(`${renderOnboardRunPrompt()}
 `);
@@ -48107,12 +48765,35 @@ async function main(argv = process.argv.slice(2), options = {}) {
 `);
     justLoggedIn = true;
   }
+  const config2 = loadConfig();
+  if (command === "runner" && args[0] === "serve") {
+    let runnerClient = null;
+    if (session) {
+      try {
+        const refreshed2 = await refreshSession(config2, session);
+        if (refreshed2 !== session) {
+          session = refreshed2;
+          await store.write(session);
+        }
+        runnerClient = new CommandClient({ appUrl: config2.appUrl, token: session.accessToken });
+      } catch (error51) {
+        io.stderr.write(`CLI session unavailable; trying paired runner state only: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+      }
+    }
+    return runRunnerServe({
+      io,
+      client: runnerClient,
+      appUrl: config2.appUrl,
+      args: args.slice(1),
+      env: process.env
+    });
+  }
   if (!session) {
     io.stderr.write(`Not logged in. Run ${cliBrand.binName} login first.
 `);
     return 1;
   }
-  const config2 = loadConfig();
   let refreshed;
   try {
     refreshed = await refreshSession(config2, session);
@@ -48229,9 +48910,10 @@ async function executeDirectCommand(io, client, args) {
   }
   const commandId = first;
   let seat;
+  let autoConfirm = false;
   let rest;
   try {
-    ({ seat, rest } = extractSeatFlag(args.slice(1)));
+    ({ seat, autoConfirm, rest } = extractCommandMetaFlags(args.slice(1)));
   } catch (error51) {
     io.stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
@@ -48252,11 +48934,15 @@ async function executeDirectCommand(io, client, args) {
 `);
     return 1;
   }
-  return printCommandOutput(io, client, commandId, body, void 0, seat === void 0 ? {} : { targetSeatId: seat });
+  return printCommandOutput(io, client, commandId, body, void 0, {
+    ...seat === void 0 ? {} : { targetSeatId: seat },
+    autoConfirm
+  });
 }
-function extractSeatFlag(args) {
+function extractCommandMetaFlags(args) {
   const rest = [];
   let seat;
+  let autoConfirm = false;
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
     if (token === "--seat") {
@@ -48268,11 +48954,15 @@ function extractSeatFlag(args) {
       index += 1;
       continue;
     }
+    if (token === "--yes" || token === "-y") {
+      autoConfirm = true;
+      continue;
+    }
     if (token !== void 0) {
       rest.push(token);
     }
   }
-  return { ...seat === void 0 ? {} : { seat }, rest };
+  return { ...seat === void 0 ? {} : { seat }, autoConfirm, rest };
 }
 var SeatFlagError = class extends Error {
 };
@@ -48287,7 +48977,9 @@ function formatCommandSchema(output) {
   if (typeof help === "string" && help.length > 0) {
     lines.push(`help: ${help}`);
   }
-  lines.push("", "input_schema:", JSON.stringify(record2.input_schema, null, 2));
+  const schemaSummary = formatInputSchemaSummary(record2.input_schema);
+  lines.push("", "input:");
+  lines.push(schemaSummary || "  no input fields");
   if (record2.example !== void 0) {
     lines.push("", "example input:", JSON.stringify(record2.example, null, 2));
   }
@@ -48301,6 +48993,23 @@ function formatCommandSchema(output) {
   }
   return lines.join("\n");
 }
+function formatInputSchemaSummary(schema) {
+  const root = asRecord3(schema);
+  const properties = asRecord3(root.properties);
+  const required2 = new Set(asStringArray(root.required));
+  const entries = Object.entries(properties);
+  if (entries.length === 0) {
+    return "";
+  }
+  return entries.map(([key, value]) => {
+    const prop = asRecord3(value);
+    const type = Array.isArray(prop.type) ? prop.type.join("|") : field2(prop, "type");
+    const enumValues = asStringArray(prop.enum);
+    const description = typeof prop.description === "string" ? ` \u2014 ${prop.description}` : "";
+    const enumText = enumValues.length > 0 ? ` enum=${enumValues.join("|")}` : "";
+    return `  ${key}${required2.has(key) ? " (required)" : " (optional)"}: ${type}${enumText}${description}`;
+  }).join("\n");
+}
 function formatCommandList(output) {
   const commands = Array.isArray(asRecord3(output).commands) ? asRecord3(output).commands : [];
   if (commands.length === 0) {
@@ -48427,10 +49136,12 @@ async function printCommandOutput(io, client, commandId, body = {}, format, opti
 `);
     return 0;
   } catch (error51) {
-    if (io.interactive === true) {
+    const envAutoConfirm = process.env[`${cliBrand.envPrefix}_CLI_AUTO_CONFIRM`] === "1";
+    if (io.interactive === true || options.autoConfirm === true || envAutoConfirm) {
       const pending = pendingConfirmationFromError2(error51);
       if (pending && pending.commandId === commandId) {
-        io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the interactive CLI user.
+        const reason = io.interactive === true ? "interactive CLI user" : options.autoConfirm === true ? "explicit CLI auto-confirm" : `${cliBrand.envPrefix}_CLI_AUTO_CONFIRM environment auto-confirm`;
+        io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the ${reason}.
 `);
         try {
           const approved = await client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
@@ -48475,6 +49186,14 @@ function printCommandError2(io, error51) {
       io.stderr.write(`\u2192 try: ${redactForLog(help)}
 `);
     }
+    if (error51.response.error.code === "COMMAND_CONFIRMATION_REQUIRED") {
+      const details = asRecord3(error51.response.error.details);
+      const expiresAt = details.expiresAt;
+      if (typeof expiresAt === "string" && expiresAt.length > 0) {
+        io.stderr.write(`confirmation expires at: ${redactForLog(expiresAt)}
+`);
+      }
+    }
     if (error51.status === 409) {
       return 3;
     }
@@ -48496,7 +49215,7 @@ function parseJsonBody(args) {
   return JSON.parse(body);
 }
 function isCommand(value) {
-  return value === "login" || value === "logout" || value === "signup" || value === "whoami" || value === "tenants" || value === "use" || value === "command" || value === "onboard" || value === "mcp" || value === "skills" || value === "init" || value === "docs" || value === "reference" || value === "help";
+  return value === "login" || value === "logout" || value === "signup" || value === "whoami" || value === "tenants" || value === "use" || value === "command" || value === "onboard" || value === "mcp" || value === "skills" || value === "init" || value === "docs" || value === "reference" || value === "doctor" || value === "help";
 }
 function printUsage(io) {
   io.stdout.write([
@@ -48510,6 +49229,7 @@ function printUsage(io) {
     `${cliBrand.binName} command <id> [--seat <seat-id>] --json [json-body]`,
     `${cliBrand.binName} command schema <id> [--json]`,
     `${cliBrand.binName} command list [--json]`,
+    `${cliBrand.binName} doctor`,
     ...operationUsageLines(cliBrand.binName),
     `${cliBrand.binName} onboard status`,
     `${cliBrand.binName} onboard run`,