@rosthq/cli 0.7.110 → 0.7.112

package/dist/index.js

@@ -40689,7 +40689,7 @@ var aicosPulseSnapshotSchema = external_exports.object({
 // ../../packages/protocol/src/command-introspection.ts
 var requiredScopeSchema = external_exports.enum(["tenant_admin", "tenant", "seat", "user"]);
 var confirmationSchema = external_exports.enum(["none", "human_required", "credential_flow", "dangerous"]);
-var trustedExecutionModeSchema = external_exports.enum(["eligible", "always_human", "not_applicable"]);
+var trustedExecutionModeSchema = external_exports.enum(["eligible", "eligible_bounded", "always_human", "not_applicable"]);
 var trustedExecutionRiskFlagSchema = external_exports.enum([
   "admin",
   "credential",
@@ -48239,7 +48239,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-07-14.2",
+    version: "2026-07-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -48297,7 +48297,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - From a template: list with \`agent_template.list\` / \`rost_list_agent_templates\`, then \`agent.create_from_template\` / \`rost_create_agent_from_template\` with \`seat_id\` and \`template_slug\`. Returns a draft agent and draft Charter only.
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
-- Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
+- Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. It is \`human_required\` (DER-1766/DER-2081): a human requesting a run acts directly, an agent re-running its OWN seat (same-seat) may auto-execute under a standing Trusted grant, and a cross-seat dispatch (one seat running a different seat's agent) always asks a human. It still requires a live staffed agent and passes the normal server-side tool guard.
 - Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call, guard-denied, and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include \`denied_tool_call_count\` and \`held_tool_call_count\` rollups: hard guard denials stay separate from actions escalated for review. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
 
 ## Review readiness before go-live
@@ -48312,7 +48312,7 @@ The lane a live agent runs on \u2014 cloud (the {{brand}}-managed runtime), a pa
 
 ## When to stop for confirmation
 
-\`agent.create_from_template\`, \`agent.create_custom\`, \`staffing.assign_user\`, \`agent.go_live\`, \`agent.update_schedule\`, \`agent_setup.relane\`, and \`mcp_token.create\` are \`human_required\`; \`agent.configure_tools\` and \`credential.ingress\` are \`credential_flow\` (both gate through the vault-backed credential path with human approval; \`agent.configure_tools\` stages the request and only \`credential.ingress\` takes the raw secret, as a vault reference); \`agent.decommission\` is \`dangerous\`. \`agent.run_now\` is not human-gated because it does not expand authority or change the schedule; it only queues an immediate run for an already-live agent. An agent may draft, configure (with vault refs), dry-run, and request an on-demand run; the human approves go-live, credentials, schedule changes, and decommission. \`run_dry_run\` is ungated by human approval, but it is **precondition-gated**: the seat's permission manifest must be signed first (\`charter.sign_manifest\`). Attempting a dry run before sign-off returns a clean \`COMMAND_PRECONDITION_FAILED\` naming \`charter.sign_manifest\`, not a generic failure. Go-live after a passed dry run is \`human_required\`. See the confirmations guide.
+\`agent.create_from_template\`, \`agent.create_custom\`, \`staffing.assign_user\`, \`agent.go_live\`, \`agent.update_schedule\`, \`agent_setup.relane\`, and \`mcp_token.create\` are \`human_required\`; \`agent.configure_tools\` and \`credential.ingress\` are \`credential_flow\` (both gate through the vault-backed credential path with human approval; \`agent.configure_tools\` stages the request and only \`credential.ingress\` takes the raw secret, as a vault reference); \`agent.decommission\` is \`dangerous\`. \`agent.run_now\` is \`human_required\` (DER-1766/DER-2081): a cross-seat run always asks, while a same-seat re-run of the acting seat's own live agent may auto-execute only under a standing Trusted grant. An agent may draft, configure (with vault refs), dry-run, and request an on-demand run; the human approves go-live, credentials, schedule changes, and decommission. \`run_dry_run\` is ungated by human approval, but it is **precondition-gated**: the seat's permission manifest must be signed first (\`charter.sign_manifest\`). Attempting a dry run before sign-off returns a clean \`COMMAND_PRECONDITION_FAILED\` naming \`charter.sign_manifest\`, not a generic failure. Go-live after a passed dry run is \`human_required\`. See the confirmations guide.
 
 ## Non-negotiables
 
@@ -50009,7 +50009,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-07-15.1",
+    version: "2026-07-20.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -50123,6 +50123,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Run the weekly Sync (compile, run, complete, assign): sync-rhythm-playbook.
 - Operate local runners and work orders: runner-guide.
 - Approve or reject a pending confirmation (human only): confirmations-guide.
+- Explain what a command or agent can do automatically versus what always asks a human, or how Trusted mode and the auto band work: governed-command-capability-matrix, then confirmations-guide.
 - Manage members, settings, and notifications: settings-guide, settings-members-and-invites-guide, notifications-guide.
 - Explain company-wide billing, payment, invoices, or usage true-ups: billing-and-pricing-guide, then settings-guide.
 - Diagnose a failure on any surface: troubleshooting-guide, then security-model-guide.
@@ -50133,7 +50134,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Graph design: responsibility-graph-playbook
 - Charter design: charter-design-playbook, charter-authoring-deep-dive
 - Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, agent-definition-import-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
-- Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
+- Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, governed-command-capability-matrix, steward-queue-guide, sync-rhythm-playbook, notifications-guide
 - Local agents and runners: mcp-and-cli-guide, runner-guide, agent-reference-map
 - Security and troubleshooting: ai-model-data-handling-guide, security-model-guide, troubleshooting-guide
 
@@ -50253,7 +50254,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-20.1",
+    version: "2026-07-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -50312,7 +50313,7 @@ Avoid vanity numbers, manual-only status fields, and metrics nobody can act on.
 - Add a measurable: \`measurable.create\` (scope: seat) defines a measurable a seat owns \u2014 name, unit, direction, target, cadence. The seat owns it; readings attach to it afterward.
 - Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated. An agent's \`status.record\` never downgrades a human-confirmed reading: a routine agent read that lands on a period a human already confirmed leaves the confirmed value and its confirmation intact (invariants #7/#8 \u2014 agents recommend; humans decide).
 - Confirm a reading: \`{{cli}} signal confirm\` / \`signal.confirm_reading\` / \`rost_confirm_signal_reading\` marks a reading human-verified. \`signal.correct_reading\` / \`rost_correct_signal_reading\` overwrites a reading with a human-confirmed value.
-- Draft first readings from a connected source: \`signal.draft_first_readings\` pulls a measurable's bound source once (read-only, SSRF-guarded \u2014 the same pull path as \`signal.preview\`) and lands the value as a DRAFT reading for the current period, for a human to confirm. It is for a measurable that has a connected source but no confirmed reading yet: the Signal page shows a "Draft first readings" button on those rows so the row stops being a permanent blank. Nothing is published \u2014 a human clears the draft with \`signal.confirm_reading\` (invariant #7) \u2014 and it never fabricates a value: a non-numeric or blocked pull drafts nothing and says so.
+- Draft first readings from a connected source: \`signal.draft_first_readings\` pulls a measurable's bound source once (read-only, SSRF-guarded \u2014 the same pull path as \`signal.preview\`) and lands the value as a DRAFT reading for the current period, for a human to confirm. It is strictly for a measurable that has a connected source but has never had a confirmed reading \u2014 in ANY period, not just the current one. A measurable that already carries a confirmed reading (even an older one) is rejected with an "already has readings" outcome and no pull happens, so the first-reading flow can never be repurposed as an ongoing draft source; use \`signal.report\` to add a current-period datapoint or \`signal.correct_reading\` to change a confirmed value instead. The Signal page shows a "Draft first readings" button on the eligible (never-measured) rows so the row stops being a permanent blank. Nothing is published \u2014 a human clears the draft with \`signal.confirm_reading\` (invariant #7) \u2014 and it never fabricates a value: a non-numeric or blocked pull drafts nothing and says so.
 
 ## Run Signal without an agent
 
@@ -50708,6 +50709,86 @@ The billing area in Settings answers:
 Settings labels subscription usage separately from the setup model allowance and the inference hard cap. Payment methods and invoice payment stay in Stripe. {{brand}} renders subscription ids/status and invoice summaries only; it does not store card, bank, payment-method, or invoice-payment details.
 
 Do not claim that a live charge happened unless Stripe test/live evidence proves it. For internal or design-partner validation, use Stripe test mode only unless a human owner explicitly completes a real live-payment step.`
+  },
+  {
+    slug: "governed-command-capability-matrix",
+    order: 72,
+    title: "Governed command capability matrix",
+    summary: "How to read {{brand}}'s command capability classification: the four confirmation classes, the Trusted-eligibility classes, the five-command auto band, and the always-human floor.",
+    version: "2026-07-20.1",
+    public: true,
+    audiences: ["human", "cli", "mcp", "in_app_agent"],
+    stages: ["charter_design", "staffing", "operating_rhythm"],
+    relatedCommandIds: [
+      "command.list",
+      "command.describe",
+      "agent.update_schedule",
+      "goal.bind_measurable",
+      "skill.assign_to_seat",
+      "friction.resolve",
+      "agent.run_now",
+      "agent.trust.create",
+      "confirmation.approve"
+    ],
+    legal: {
+      publicRisk: "low",
+      notes: [
+        "Describes {{brand}}-native command governance classification; no third-party or proprietary content."
+      ]
+    },
+    sources: [
+      {
+        label: "Governed command capability matrix (generated)",
+        internalPath: "docs/reference/governed-command-capability-matrix.md",
+        note: "Authoritative, command-by-command capability table regenerated from the command registry (`pnpm generate:capability-matrix`) and kept in sync by a drift test."
+      }
+    ],
+    body: `# Governed command capability matrix
+
+Every {{brand}} command that changes state \u2014 through the human app, the CLI, an MCP client, or the in-app AI Chief of Staff \u2014 carries the same registry-derived governance classification. This guide answers the question every agent and every human operator eventually asks: what can my agents do right now, and how do I change that? Which commands ask a human every time, which can automate under Trusted mode, and which stay off-limits to automation no matter what.
+
+The full command-by-command table is generated directly from the command registry and lives at \`docs/reference/governed-command-capability-matrix.md\`. A drift test keeps it honest: it fails CI the moment the registry changes without the table being regenerated, so the table can never quietly go stale. This guide is the curated companion \u2014 read it first to understand the classification scheme, then open the generated table to look up any specific command's exact row.
+
+## The four confirmation classes
+
+Every command declares one of four confirmation classes:
+
+- **None** \u2014 no human gate at all. The command runs immediately (for example a status update, a work log entry, or a task creation the acting seat already owns).
+- **Human required** \u2014 the durable-change default. The command mints a pending confirmation a human must approve before it takes effect, unless it qualifies for Trusted auto-band execution (below).
+- **Credential flow** \u2014 the command routes through the vault-backed credential flow. A raw secret never appears in a prompt, a log, or a CLI argument.
+- **Dangerous** \u2014 an irreversible or high-blast-radius action (for example decommissioning an agent) that always asks, with extra confirmation friction.
+
+## The Trusted-eligibility classes
+
+Turning on Trusted mode for a seat does not change a command's confirmation class. It changes whether that seat may execute a \`human_required\` command's proposal automatically, under a standing authorization a human deliberately established. Every action taken this way is still recorded as its own human-authorized decision \u2014 Trusted mode automates the button-press, not the accountability. Every command falls into one of four Trusted-eligibility classes:
+
+- **Auto** \u2014 a small, confirmation-free allowlist of low-risk worker actions (status updates, task creation, work logging, and similar) that already run without a human gate and are safe for a Trusted agent to keep doing unattended.
+- **Auto-bounded** \u2014 a \`human_required\` command that may auto-execute under Trusted, but only for a narrow, founder-approved bounded sub-case of its input (the five-command auto band, below). Every other input on the same command still mints a normal human confirmation.
+- **Always ask** \u2014 a command carrying a protected risk category (credential, spend, external send, production/go-live, destructive, self-approval, or admin) or otherwise gated. Trusted mode never changes this; it always asks a human.
+- **Not applicable** \u2014 a discovery or read command with no durable action to automate.
+
+## The five-command auto band
+
+Exactly five commands carry an auto band today \u2014 a founder-approved, narrow bounded sub-case where a \`human_required\` command may auto-execute under a standing Trusted grant on a human-initiated turn. Any input outside the described bound still mints a human confirmation:
+
+1. **\`agent.update_schedule\`** (schedule set) \u2014 setting or changing a seat's routine schedule. Clearing a schedule is out of band and still asks.
+2. **\`goal.bind_measurable\`** (informs Signal bind) \u2014 binding a Signal in the conservative "informs" role, which never drives goal status. A "drives status" binding is out of band and still asks.
+3. **\`skill.assign_to_seat\`** (published skill assign) \u2014 assigning an already-published, immutable skill version to a seat. A proposed (non-approved) assignment, or a version that does not resolve to a published skill, is out of band and still asks.
+4. **\`friction.resolve\`** (routine Friction resolve) \u2014 resolving a Friction the acting seat already owns within its own member-seat subtree. A Friction outside that subtree, or a turn with no identifiable human initiator, is out of band and still asks.
+5. **\`agent.run_now\`** (same-seat run now) \u2014 re-running the acting seat's own live agent. A cross-seat dispatch, where one seat runs a different seat's agent, is out of band and still asks.
+
+Widening this set, or adding a sixth command, is a deliberate founder decision \u2014 not something a code change alone can slip in. The registry enforces it: a command cannot carry an auto band unless it is one of these five ids.
+
+## The always-human floor
+
+A command carrying any of these risk categories always asks a human, even under Trusted mode: credential handling, spend or billing changes, external sends (invitations, outbound messages), production or go-live actions, destructive actions, self-approval of your own confirmation, or an admin-scope change. No autonomy setting removes this floor. It is a deliberate, conservative-by-default boundary \u2014 see confirmations-guide for how human gates work end to end.
+
+## Where to look up a specific command
+
+- The generated, authoritative table: \`docs/reference/governed-command-capability-matrix.md\` \u2014 one row per command with its required scope, confirmation class, Trusted mode, autonomy class, auto-band class (when it has one), MCP exposure, CLI availability, and whether the AI Chief of Staff can reach it as a governed tool call.
+- A single command's exact schema and classification: {{cli}} command schema <id> (CLI) or rost_describe_command (MCP).
+- How pending confirmations are approved or rejected: confirmations-guide.
+- How Trusted grants are created, inspected, and revoked: agent-staffing-playbook.`
   },
   {
     slug: "settings-guide",
@@ -50920,7 +51001,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-20.1",
+    version: "2026-07-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -51016,7 +51097,7 @@ Use this flow when a headless or desktop runner cannot use the interactive web c
 
 ## When to stop for confirmation
 
-\`runner.pairing.start\`, \`work_order.enqueue\`, and \`agent.run_now\` are \`none\`, so they do not create a separate pending confirmation, but \`runner.pairing.start\` is still owner/admin-only at the command authorization layer. \`runner.revoke\` and \`work_order.cancel\` are \`human_required\`. List and status reads are not gated. Revoking a runner or cancelling work is the human-approved act. An agent inspects runner state and proposes the action.
+\`runner.pairing.start\` and \`work_order.enqueue\` are \`none\`, so they do not create a separate pending confirmation, but \`runner.pairing.start\` is still owner/admin-only at the command authorization layer. \`runner.revoke\`, \`work_order.cancel\`, and \`agent.run_now\` are \`human_required\` (DER-1766/DER-2081): a cross-seat run always asks, and a same-seat re-run of the acting seat's own agent may auto-execute only under a standing Trusted grant. List and status reads are not gated. Revoking a runner or cancelling work is the human-approved act. An agent inspects runner state and proposes the action.
 
 ## Guardrails
 
@@ -52916,7 +52997,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.resume", "namespace": "agent", "action": "resume", "title": "Resume agent", "description": "Resume a paused agent back to live. Blocks if the steward chain no longer resolves to a human.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resume a paused agent back to live; the no-orphan guard blocks a resume whose steward chain no longer resolves to a human." },
   { "id": "agent.run_dry_run", "namespace": "agent", "action": "run_dry_run", "title": "Run agent dry run", "description": "Run the sandbox dry run for a draft agent. Durable and idempotent per Charter version; a passed result is reused, never re-run.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Run the sandbox dry run for a draft agent after the manifest is signed; the result is durable and idempotent per Charter version, and a passed run is reused.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
   { "id": "agent.run_heartbeats", "namespace": "agent", "action": "run_heartbeats", "title": "Get run heartbeats", "description": "Reads the per-seat run-heartbeat roll-up (quiet-but-healthy vs stalled) for long-running agent programs.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_ids", "flag": "seat-ids", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Read the per-seat run-heartbeat roll-up to tell a quiet-but-healthy long-running agent program apart from a stalled one." },
-  { "id": "agent.run_now", "namespace": "agent", "action": "run_now", "title": "Run agent now", "description": "Queue and dispatch an immediate work order for a live cloud or runner agent on a seat. task_id is cloud-lane only; a runner-lane agent rejects it.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Queue and dispatch an immediate live agent run without changing the agent's saved schedule. task_id is cloud-lane only; a runner-lane agent rejects it (run task-linked runner work as an interactive agent turn)." },
+  { "id": "agent.run_now", "namespace": "agent", "action": "run_now", "title": "Run agent now", "description": "Queue and dispatch an immediate work order for a live cloud or runner agent on a seat. task_id is cloud-lane only; a runner-lane agent rejects it.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Queue and dispatch an immediate live agent run without changing the agent's saved schedule. task_id is cloud-lane only; a runner-lane agent rejects it (run task-linked runner work as an interactive agent turn)." },
   { "id": "agent.show_markdown", "namespace": "agent", "action": "show_markdown", "title": "Show agent setup as markdown", "description": "Compose a seat's agent setup, steward, model, tools, and Charter into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card to show your human a quick review." },
   { "id": "agent.status", "namespace": "agent", "action": "status", "title": "Get agent status", "description": "Return the agent occupancy, lane, schedule, live/offline state, steward chain, dry-run result, and Runner availability for a seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Check an agent's lane, live state, steward chain, dry-run result, and Runner availability before relying on it." },
   { "id": "agent.trust.create", "namespace": "agent", "action": "trust.create", "title": "Create agent Trusted grant", "description": "Create a bounded Trusted execution grant for a live agent after a human steward/admin signs the current activation receipt digest.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "expected_scope_digest", "flag": "expected-scope-digest", "type": "string", "required": true }, { "name": "budget_cents", "flag": "budget-cents", "type": "integer", "required": true }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a bounded Trusted execution grant only after reviewing the activation receipt digest, budget, and always-human boundary. Human steward/admin only." },
@@ -57737,6 +57818,7 @@ ${usage()}
   let failed = false;
   let activeSessions = 0;
   const activeTurnExecutionIds = /* @__PURE__ */ new Set();
+  let serverHeartbeatContractVersion = null;
   do {
     const detectedCapabilities = await detectCapabilities(cliVersion, env, homeDir, config2.maxSessionsOverride);
     const capabilities = capabilitiesForConfiguredRuntime(detectedCapabilities, config2.runtime);
@@ -57745,7 +57827,8 @@ ${usage()}
       const heartbeat = await post2(fetchImpl, options.appUrl, "/api/runner/heartbeat", buildHeartbeatBody({
         capabilities,
         telemetry: detectTelemetry(capabilities, env, activeSessions, cliVersion),
-        activeTurnExecutionIds: [...activeTurnExecutionIds]
+        activeTurnExecutionIds: [...activeTurnExecutionIds],
+        serverContractVersion: serverHeartbeatContractVersion
       }), state.runner_secret);
       if (heartbeat.status !== 200) {
         options.io.stderr.write(`heartbeat ${heartbeat.status}: ${redactForLog(JSON.stringify(heartbeat.json))}
@@ -57753,6 +57836,10 @@ ${usage()}
         failed = true;
       } else {
         heartbeatSucceeded = true;
+        const learnedVersion = readHeartbeatContractVersion(heartbeat.json);
+        if (learnedVersion !== null) {
+          serverHeartbeatContractVersion = learnedVersion;
+        }
         options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
 `);
       }
@@ -57766,7 +57853,11 @@ ${usage()}
           capabilities,
           io: options.io,
           telemetry: () => detectTelemetry(capabilities, env, activeSessions, cliVersion),
-          activeTurnIds: () => [...activeTurnExecutionIds]
+          activeTurnIds: () => [...activeTurnExecutionIds],
+          serverContractVersion: () => serverHeartbeatContractVersion,
+          recordServerContractVersion: (v) => {
+            serverHeartbeatContractVersion = v;
+          }
         });
         try {
           await claimAndExecute(fetchImpl, options.appUrl, state, config2, options.io, localRuntime, activeTurnExecutionIds);
@@ -57791,13 +57882,17 @@ ${usage()}
         localRuntime,
         capabilities,
         () => detectTelemetry(capabilities, env, activeSessions, cliVersion),
-        activeTurnExecutionIds
+        activeTurnExecutionIds,
+        () => serverHeartbeatContractVersion,
+        (v) => {
+          serverHeartbeatContractVersion = v;
+        }
       );
     }
   } while (!config2.once);
   return heartbeatSucceeded && !failed ? 0 : 1;
 }
-async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runtime, capabilities, telemetry, activeTurnExecutionIds) {
+async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runtime, capabilities, telemetry, activeTurnExecutionIds, serverContractVersion, recordServerContractVersion) {
   const deadline = Date.now() + config2.heartbeatMs;
   const stopWait = runtime ? startTurnHeartbeat({
     fetchImpl,
@@ -57807,7 +57902,9 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     capabilities,
     io,
     telemetry,
-    activeTurnIds: () => [...activeTurnExecutionIds]
+    activeTurnIds: () => [...activeTurnExecutionIds],
+    serverContractVersion,
+    recordServerContractVersion
   }) : null;
   try {
     while (Date.now() < deadline) {
@@ -57827,12 +57924,17 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     stopWait?.();
   }
 }
+var HEARTBEAT_ACTIVE_TURN_MIN_CONTRACT_VERSION = 2;
+function readHeartbeatContractVersion(json2) {
+  const value = json2.heartbeat_contract_version;
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function buildHeartbeatBody(input) {
   const body = {
     capabilities: input.capabilities,
     telemetry: input.telemetry
   };
-  if (input.activeTurnExecutionIds.length > 0) {
+  if (input.activeTurnExecutionIds.length > 0 && (input.serverContractVersion ?? 0) >= HEARTBEAT_ACTIVE_TURN_MIN_CONTRACT_VERSION) {
     body.active_turn_execution_ids = input.activeTurnExecutionIds;
   }
   return body;
@@ -57853,11 +57955,17 @@ function startTurnHeartbeat(deps) {
         const response = await post2(deps.fetchImpl, deps.appUrl, "/api/runner/heartbeat", buildHeartbeatBody({
           capabilities: deps.capabilities,
           telemetry: deps.telemetry(),
-          activeTurnExecutionIds: deps.activeTurnIds()
+          activeTurnExecutionIds: deps.activeTurnIds(),
+          serverContractVersion: deps.serverContractVersion()
         }), deps.secret, controller.signal);
         if (!stopped && response.status !== 200) {
           deps.io.stderr.write(`turn heartbeat ${response.status}: ${redactForLog(JSON.stringify(response.json))}
 `);
+        } else if (!stopped && response.status === 200) {
+          const learnedVersion = readHeartbeatContractVersion(response.json);
+          if (learnedVersion !== null) {
+            deps.recordServerContractVersion(learnedVersion);
+          }
         }
       } catch (error51) {
         if (!stopped) {