@rosthq/cli 0.7.158 → 0.7.159

package/dist/index.js

@@ -13337,7 +13337,7 @@ var init_command_discovery = __esm({
       { "id": "confirmation.approve", "title": "Approve pending confirmation", "description": "Approve an in-flight confirmation and execute the original command as the approving human.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "always_human", "risk_flags": ["self_approval"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "minLength": 1 }, "reviewed": { "type": "boolean" } }, "required": ["confirmation_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "minLength": 1 }, "command_id": { "type": "string", "minLength": 1 }, "approved": { "type": "boolean", "const": true }, "output": {}, "effect": { "type": "object", "properties": { "attempted": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "applied": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "skipped": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "outcome": { "type": "string", "enum": ["applied", "partial", "none"] }, "skips": { "maxItems": 50, "type": "array", "items": { "type": "object", "properties": { "target_kind": { "type": "string", "minLength": 1 }, "target_id": { "anyOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] }, "reason": { "type": "string", "minLength": 1 }, "detail": { "type": "string", "minLength": 1 } }, "required": ["target_kind", "target_id", "reason"], "additionalProperties": false } }, "skips_omitted": { "default": 0, "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": ["attempted", "applied", "skipped", "outcome", "skips"], "additionalProperties": false } }, "required": ["confirmation_id", "command_id", "approved", "output"], "additionalProperties": false }, "help": "Approve pending confirmations only when the requested durable change is clear to the human owner.", "guide_slugs": ["charter-design-playbook", "agent-staffing-playbook"], "stages": ["charter_design", "staffing"], "related_command_ids": ["agent_grant_intervention.decide", "agent_grant_intervention.list", "agent_grant_intervention.resume", "agent_setup.get", "agent_setup.relane", "agent_setup.start", "agent_setup.update", "agent_template.list", "agent.activation_sign", "agent.configure_tools", "agent.create_custom", "agent.create_from_template", "agent.decommission", "agent.fleet_digest", "agent.get_run", "agent.go_live", "agent.list_fleet", "agent.list_runs", "agent.list_tool_calls", "agent.pause", "agent.resume", "agent.run_dry_run", "agent.run_now", "agent.status", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "agent.update_schedule", "aicos.brain_settings.get", "aicos.brain_settings.update", "cascade.import", "charter.apply_seat_type_recommendation", "charter.approve", "charter.backfill_stock_evidence", "charter.draft", "charter.draft_all", "charter.get", "charter.list", "charter.preview_signal_reconciliation", "charter.reconcile_signals", "charter.set", "charter.sign_manifest", "charter.skip", "charter.update_draft", "coach.draft_guide", "command.describe", "command.list", "compass.alignment", "compass.answer_gap", "compass.approve_version", "compass.draft", "compass.get_current", "compass.list_gaps", "compass.reject_draft", "compass.set", "compass.update_draft", "confirmation.activation_set.list", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "confirmation.remint", "credential.ingress", "deliverable.accept", "deliverable.attach", "deliverable.create", "deliverable.get", "deliverable.list", "deliverable.reject", "device.pairing.list", "error_log.list", "error_log.resolve", "error_log.supersede", "escalation.get", "escalation.list", "escalation.raise", "escalation.reject", "escalation.resolve", "friction.assist", "friction.file_issue", "friction.get", "friction.link_task", "friction.list", "friction.resolve", "friction.update_status", "goal.bind_measurable", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "graph.get", "implementation_access.abandon", "implementation_access.complete", "implementation_access.status", "integration.connect_rest", "integration.list", "integration.readiness", "integration.status", "integration.test", "mcp_token.create", "mcp_token.list", "mcp_token.revoke", "notification.list_errors", "notification.settings.get", "notification.settings.update", "notification.test", "onboarding.activate", "onboarding.advance_step", "onboarding.attach_reference", "onboarding.create_invite", "onboarding.finish", "onboarding.rehearse", "onboarding.resume", "onboarding.setup", "onboarding.source_ingest", "onboarding.status", "onboarding.upload_context", "runner.diagnose", "runner.list", "runner.pairing.start", "runner.repair", "runner.revoke", "runner.status", "seat.create", "seat.create_complete", "seat.decommission", "seat.get", "seat.rename", "seat.reparent", "seat.set_type", "signal.bind", "signal.confirm_reading", "signal.draft_first_readings", "signal.list", "signal.report", "skill.assign_to_seat", "skill.assigned.list", "skill.catalog", "skill.check_dependencies", "skill.create", "skill.enable_catalog", "skill.file.get", "skill.get", "skill.import_github", "skill.import_upload", "skill.install_local", "skill.list", "skill.publish", "skill.revoke_from_seat", "skill.sync_local", "skill.update_draft", "staffing.assign", "staffing.assign_agent_dry_run", "staffing.assign_user", "sync.brief.compile", "sync.brief.get", "sync.item.assign", "sync.run.complete", "sync.run.start", "system.health", "task.accept", "task.complete", "task.confirm_proposal", "task.create", "task.decline", "task.decline_proposal", "task.list", "tenant.anthropic_key.disable", "tenant.model_gateway_policy.update", "tenant.rename", "tool_grants.tenant.update", "tool.catalog", "usage.report", "usage.snapshot", "user.tenants", "user.use_tenant", "user.whoami", "work_order.cancel", "work_order.enqueue", "work_order.list"] },
       { "id": "confirmation.dismiss", "title": "Dismiss an expired confirmation", "description": "Clear a single expired, unactioned confirmation from the queue without re-executing the original command.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["confirmation_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "dismissed": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "status": { "type": "string", "const": "dismissed" } }, "required": ["id", "status"], "additionalProperties": false } }, "required": ["dismissed"], "additionalProperties": false }, "help": "Clear a single expired, unactioned confirmation from the queue. Dismiss is human-only queue hygiene \u2014 it never re-executes the original command.", "guide_slugs": ["confirmations-guide", "mcp-and-cli-guide"], "stages": ["charter_design", "staffing", "operating_rhythm"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "confirmation.approve", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "confirmation.remint", "credential.ingress", "friction.resolve", "goal.reassign_owner", "goal.reparent", "mcp_token.create", "onboarding.activate", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
       { "id": "confirmation.dismiss_stale", "title": "Dismiss all expired confirmations", "description": "Clear every expired, unactioned confirmation in your authority scope from the queue without re-executing any command.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": {}, "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "dismissed_count": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "dismissed_ids": { "type": "array", "items": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } } }, "required": ["dismissed_count", "dismissed_ids"], "additionalProperties": false }, "help": "Clear every expired, unactioned confirmation in your authority scope at once. Each dismissal is audited; none re-executes the original command.", "guide_slugs": ["confirmations-guide", "mcp-and-cli-guide"], "stages": ["charter_design", "staffing", "operating_rhythm"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "confirmation.approve", "confirmation.dismiss", "confirmation.list", "confirmation.reject", "confirmation.remint", "credential.ingress", "friction.resolve", "goal.reassign_owner", "goal.reparent", "mcp_token.create", "onboarding.activate", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
-      { "id": "confirmation.list", "title": "List pending confirmations", "description": "List in-flight confirmations awaiting a human decision, including seat-scoped cards the caller occupies and target-scoped cards the caller may decide as steward/admin.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "limit": { "type": "integer", "minimum": 1, "maximum": 200 } }, "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "confirmations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "command_id": { "type": "string" }, "redacted_args": {}, "actor_kind": { "type": "string", "enum": ["user", "agent", "system", "operator"] }, "source": { "type": "string" }, "scope_kind": { "type": "string", "enum": ["tenant_admin", "tenant", "seat"] }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "seat_name": { "anyOf": [{ "type": "string" }, { "type": "null" }] }, "seat_type": { "anyOf": [{ "type": "string", "enum": ["human", "agent", "hybrid"] }, { "type": "null" }] }, "risk_level": { "type": "string", "enum": ["normal", "sensitive", "dangerous"] }, "summary": { "type": "string" }, "expires_at": { "type": "string" }, "created_at": { "type": "string" } }, "required": ["id", "command_id", "redacted_args", "actor_kind", "source", "scope_kind", "seat_id", "seat_name", "seat_type", "risk_level", "summary", "expires_at", "created_at"], "additionalProperties": false } } }, "required": ["confirmations"], "additionalProperties": false }, "help": "List pending confirmations awaiting a human decision before approving or rejecting them. Each redacted_args may be a partial projection on generic paths: content may be omitted. Only dedicated complete-card contracts currently render full lossless projections (seat.create_complete and onboarding.activate); onboarding.setup remains partial/HOLD.", "guide_slugs": ["charter-design-playbook", "agent-staffing-playbook"], "stages": ["charter_design", "staffing"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.reject", "confirmation.remint", "credential.ingress", "friction.resolve", "goal.reassign_owner", "goal.reparent", "mcp_token.create", "onboarding.activate", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
+      { "id": "confirmation.list", "title": "List pending confirmations", "description": "List in-flight confirmations awaiting a human decision, including seat-scoped cards the caller occupies and target-scoped cards the caller may decide as steward/admin.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "limit": { "type": "integer", "minimum": 1, "maximum": 200 } }, "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "confirmations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "command_id": { "type": "string" }, "redacted_args": {}, "actor_kind": { "type": "string", "enum": ["user", "agent", "system", "operator"] }, "source": { "type": "string" }, "scope_kind": { "type": "string", "enum": ["tenant_admin", "tenant", "seat"] }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "seat_name": { "anyOf": [{ "type": "string" }, { "type": "null" }] }, "seat_type": { "anyOf": [{ "type": "string", "enum": ["human", "agent", "hybrid"] }, { "type": "null" }] }, "risk_level": { "type": "string", "enum": ["normal", "sensitive", "dangerous"] }, "summary": { "type": "string" }, "expires_at": { "type": "string" }, "created_at": { "type": "string" }, "implementation_run_live": { "type": "boolean" } }, "required": ["id", "command_id", "redacted_args", "actor_kind", "source", "scope_kind", "seat_id", "seat_name", "seat_type", "risk_level", "summary", "expires_at", "created_at"], "additionalProperties": false } } }, "required": ["confirmations"], "additionalProperties": false }, "help": "List pending confirmations awaiting a human decision before approving or rejecting them. Each redacted_args may be a partial projection on generic paths: content may be omitted. Only dedicated complete-card contracts currently render full lossless projections (seat.create_complete and onboarding.activate); onboarding.setup remains partial/HOLD.", "guide_slugs": ["charter-design-playbook", "agent-staffing-playbook"], "stages": ["charter_design", "staffing"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.reject", "confirmation.remint", "credential.ingress", "friction.resolve", "goal.reassign_owner", "goal.reparent", "mcp_token.create", "onboarding.activate", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
       { "id": "confirmation.reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "always_human", "risk_flags": ["self_approval"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "minLength": 1 }, "reason": { "type": "string", "minLength": 1 } }, "required": ["confirmation_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "minLength": 1 }, "command_id": { "type": "string", "minLength": 1 }, "rejected": { "type": "boolean", "const": true } }, "required": ["confirmation_id", "command_id", "rejected"], "additionalProperties": false }, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear.", "guide_slugs": ["charter-design-playbook", "agent-staffing-playbook"], "stages": ["charter_design", "staffing"], "related_command_ids": ["agent_grant_intervention.decide", "agent_grant_intervention.list", "agent_grant_intervention.resume", "agent_setup.get", "agent_setup.start", "agent_setup.update", "agent_template.list", "agent.activation_sign", "agent.configure_tools", "agent.create_custom", "agent.create_from_template", "agent.fleet_digest", "agent.get_run", "agent.go_live", "agent.list_fleet", "agent.list_runs", "agent.list_tool_calls", "agent.run_dry_run", "agent.status", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "charter.draft", "compass.set", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.remint", "credential.ingress", "deliverable.accept", "deliverable.attach", "deliverable.create", "deliverable.get", "deliverable.list", "deliverable.reject", "device.pairing.list", "error_log.list", "error_log.resolve", "error_log.supersede", "escalation.get", "escalation.list", "escalation.raise", "escalation.reject", "escalation.resolve", "friction.resolve", "goal.reassign_owner", "goal.reparent", "graph.get", "implementation_access.abandon", "implementation_access.complete", "implementation_access.status", "integration.list", "integration.readiness", "integration.status", "integration.test", "mcp_token.create", "mcp_token.list", "mcp_token.revoke", "notification.list_errors", "notification.settings.get", "notification.settings.update", "notification.test", "onboarding.activate", "onboarding.attach_reference", "onboarding.rehearse", "onboarding.resume", "onboarding.setup", "onboarding.status", "onboarding.upload_context", "runner.diagnose", "runner.repair", "seat.create", "seat.create_complete", "seat.decommission", "seat.get", "seat.rename", "seat.reparent", "seat.set_type", "skill.assign_to_seat", "skill.assigned.list", "skill.catalog", "skill.check_dependencies", "skill.create", "skill.enable_catalog", "skill.file.get", "skill.get", "skill.import_github", "skill.import_upload", "skill.install_local", "skill.list", "skill.publish", "skill.revoke_from_seat", "skill.sync_local", "skill.update_draft", "staffing.assign", "staffing.assign_user", "system.health", "task.confirm_proposal", "task.decline_proposal", "tenant.anthropic_key.disable", "tenant.rename", "tool_grants.tenant.update", "usage.report", "usage.snapshot", "user.tenants", "user.use_tenant", "user.whoami"] },
       { "id": "confirmation.remint", "title": "Re-mint an expired confirmation", "description": "Stage a fresh confirmation for the same command as an expired one, re-running the normal minting authorization checks.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "always_human", "risk_flags": ["self_approval"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "minLength": 1 } }, "required": ["confirmation_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "confirmation_id": { "type": "string", "minLength": 1 }, "command_id": { "type": "string", "minLength": 1 }, "reminted": { "type": "boolean", "const": true }, "new_confirmation": { "type": "object", "properties": { "confirmationId": { "type": "string", "minLength": 1 }, "commandId": { "type": "string", "minLength": 1 }, "summary": { "type": "string", "minLength": 1 }, "riskLevel": { "type": "string", "enum": ["normal", "sensitive", "dangerous"] }, "diff": {}, "expiresAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$" }, "approveVia": { "type": "object", "properties": { "webUrl": { "type": "string", "minLength": 1 }, "cliCommand": { "type": "string", "minLength": 1 } }, "required": ["webUrl", "cliCommand"], "additionalProperties": false } }, "required": ["confirmationId", "commandId", "summary", "riskLevel", "expiresAt", "approveVia"], "additionalProperties": false } }, "required": ["confirmation_id", "command_id", "reminted", "new_confirmation"], "additionalProperties": false }, "help": "Re-mint an expired confirmation into a fresh one before approving, instead of re-running the original command from scratch.", "guide_slugs": ["charter-design-playbook", "agent-staffing-playbook"], "stages": ["charter_design", "staffing"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "credential.ingress", "friction.resolve", "goal.reassign_owner", "goal.reparent", "mcp_token.create", "onboarding.activate", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
       { "id": "credential.ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "required_scope": "seat", "confirmation": "credential_flow", "trusted_execution": { "mode": "always_human", "risk_flags": ["credential"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": false, "input_schema": { "type": "object", "properties": { "seat_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "provider": { "type": "string", "minLength": 1 }, "scope_description": { "type": "string", "minLength": 1 }, "secret_name": { "type": "string", "minLength": 1 }, "secret": { "type": "string", "minLength": 1 } }, "required": ["provider", "scope_description", "secret_name", "secret"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "credential_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "provider": { "type": "string", "minLength": 1 }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] } }, "required": ["credential_id", "provider", "seat_id"], "additionalProperties": false }, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs.", "guide_slugs": ["ai-model-data-handling-guide", "tool-access-and-vault", "security-model-guide"], "stages": ["staffing"], "related_command_ids": ["agent_grant_intervention.decide", "agent_setup.get", "agent_setup.start", "agent_setup.update", "agent.activation_sign", "agent.configure_tools", "agent.create_custom", "agent.get_run", "agent.go_live", "agent.list_tool_calls", "agent.run_dry_run", "agent.run_now", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "cascade.import", "charter.approve", "charter.draft", "charter.draft_all", "charter.set", "charter.sign_manifest", "charter.update_draft", "compass.answer_gap", "compass.approve_version", "compass.draft", "compass.get_current", "compass.list_gaps", "compass.reject_draft", "compass.set", "compass.update_draft", "confirmation.activation_set.list", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "confirmation.remint", "friction.file_issue", "friction.list", "friction.resolve", "goal.reassign_owner", "goal.reparent", "integration.connect_rest", "integration.list", "integration.readiness", "integration.status", "integration.test", "mcp_token.create", "mcp_token.list", "mcp_token.revoke", "onboarding.activate", "onboarding.advance_step", "onboarding.attach_reference", "onboarding.create_invite", "onboarding.finish", "onboarding.rehearse", "onboarding.setup", "onboarding.source_ingest", "onboarding.status", "onboarding.upload_context", "runner.pairing.start", "seat.create", "seat.create_complete", "seat.set_type", "signal.bind", "signal.confirm_reading", "signal.draft_first_readings", "signal.report", "skill.assign_to_seat", "skill.catalog", "skill.check_dependencies", "skill.file.get", "skill.get", "skill.list", "staffing.assign_agent_dry_run", "staffing.assign_user", "sync.brief.compile", "sync.brief.get", "sync.item.assign", "sync.run.complete", "sync.run.start", "task.confirm_proposal", "task.decline_proposal", "tenant.anthropic_key.disable", "tenant.anthropic_key.save", "tool.catalog", "work_order.enqueue"] },
@@ -30113,7 +30113,7 @@ function rostTokenPattern(usage2) {
 }
 
 // ../../packages/protocol/src/scrub.ts
-var SECRET_SHAPED_VALUE = /(sk-ant-|sk-proj-|sk-live-|sk-[A-Za-z0-9_-]{12,}|gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baoprs]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{20,}|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
+var SECRET_SHAPED_VALUE = /(sk-ant-|sk-proj-|sk-live-|sk_live_|rk_live_|sk_test_|rk_test_|whsec_|sk-[A-Za-z0-9_-]{12,}|gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baoprs]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{20,}|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
 var ROST_TOKEN_PATTERN = rostTokenPattern("test");
 var SECRET_SHAPED_VALUE_PATTERN_SOURCE = SECRET_SHAPED_VALUE.source;
 var SECRET_SHAPE_AT_BOUNDARY_EXACT_CASE = new RegExp(`(?:^|[^A-Za-z0-9])${SECRET_SHAPED_VALUE.source}`);
@@ -32498,7 +32498,7 @@ var tenantIdSchema = external_exports.uuid();
 var seatIdSchema = external_exports.uuid();
 var secretProviderSchema = external_exports.string().trim().min(1).max(80).regex(/^[a-z0-9][a-z0-9_-]*$/);
 var secretNameSchema = external_exports.string().trim().min(1).max(120).regex(/^[A-Z0-9_]+$/);
-var BROAD_SECRET_SUBSTRING_PATTERN = /(sk-ant-|sk-proj-|sk-live-|BEGIN |PRIVATE KEY|api[_-]?key=|secret=)/i;
+var BROAD_SECRET_SUBSTRING_PATTERN = /(sk-ant-|sk-proj-|sk-live-|sk_live_|rk_live_|sk_test_|rk_test_|whsec_|BEGIN |PRIVATE KEY|api[_-]?key=|secret=)/i;
 var vaultRefSchema = external_exports.string().trim().min(12).max(700).superRefine((value, context) => {
   let parsed;
   try {
@@ -36190,30 +36190,149 @@ var onboardingSourceIngestOutputSchema = external_exports.object({
 }).strict();
 var URL_OR_PATH_PATTERN = /(?:[a-z][a-z0-9+.-]*:\/\/|(?:^|\s)(?:\.{1,2}[\\/]\S+|\/(?:Users|Volumes|Applications|System|Library|private|var|tmp|home|etc)\/|[A-Za-z]:\\))/i;
 var EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i;
+var ISO_DATE_TOKEN = /\b(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])\b/g;
 var CONTACT_OR_PAYMENT_CANDIDATE = /\+?[0-9][0-9 .()/-]*[0-9]/g;
 var MIN_CONTACT_NUMBER_DIGITS = 9;
-var MAX_QUOTED_SUBSTRING = 80;
+var UNICODE_DECIMAL_DIGIT = new RegExp("\\p{Nd}", "gu");
+var INVISIBLE_FORMAT_OR_MARK = /[\p{Cf}\p{Mn}]/gu;
+var NUMERIC_GROUP_SEPARATOR = "[\\s.,;:|_/()\\-\\u2013\\u2014]";
+var NUMERIC_GROUP_RUN = new RegExp(
+  `\\d{1,19}(?:${NUMERIC_GROUP_SEPARATOR}{1,32}\\d{1,19})*`,
+  "g"
+);
+var NUMERIC_GROUP_SPLIT = new RegExp(`(${NUMERIC_GROUP_SEPARATOR}{1,32})`);
+var THOUSANDS_GROUP_SEPARATOR = ",";
+var PLAUSIBLE_YEAR = /^(?:19|20)\d{2}$/;
+function looksLikeIssuedCardRange(digits) {
+  const lead = digits.slice(0, 1);
+  if (lead === "3" || lead === "4" || lead === "5" || lead === "6") return true;
+  const prefix = Number.parseInt(digits.slice(0, 4), 10);
+  return Number.isInteger(prefix) && prefix >= 2221 && prefix <= 2720;
+}
+var MIN_PAYMENT_CARD_DIGITS = 13;
+var MAX_PAYMENT_CARD_DIGITS = 19;
 var CONTENT_LINT_REMEDY = {
   secret: "Store credentials as a vault reference (credentials.vault_ref); never inline secret material in a setup plan.",
   url_or_path: "Reference setup content by its source_key, never a URL or local file path.",
   email: "Reference a person through their Seat and occupancy, not a raw email address.",
-  contact_or_payment_number: "Remove direct phone or payment identifiers (runs of 9+ digits). ISO dates (YYYY-MM-DD) and short numeric references are allowed."
+  contact_or_payment_number: "Remove direct phone or payment identifiers (runs of 9+ digits, and grouped numbers of payment-card length and checksum). ISO dates (YYYY-MM-DD), currency amounts, and short numeric references are allowed."
 };
-function quotedContentSubstring(substring) {
-  const trimmed = substring.trim();
-  const bounded = trimmed.length > MAX_QUOTED_SUBSTRING ? `${trimmed.slice(0, MAX_QUOTED_SUBSTRING)}\u2026` : trimmed;
-  return `"${bounded}"`;
+function redactedMatchDescription(description, match) {
+  const raw = match[0];
+  const leadingWhitespace = raw.length - raw.trimStart().length;
+  const offset = (match.index ?? 0) + leadingWhitespace;
+  return `${description} at character offset ${offset} (${REDACTION_SENTINEL})`;
+}
+function urlOrPathDescription(match) {
+  const start = match.trimStart();
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(start)) return "a URL";
+  if (/^\.{1,2}[\\/]/.test(start)) return "a relative file path";
+  if (/^[A-Za-z]:\\/.test(start)) return "a Windows file path";
+  return "an absolute local file path";
+}
+function maskedContactNumber(finding) {
+  const lastFour = finding.digits.slice(-4);
+  const shape = finding.kind === "contact" ? "run" : looksLikeIssuedCardRange(finding.digits) ? "payment-card-shaped run" : "grouped number matching a payment-card checksum";
+  return `a ${finding.digits.length}-digit ${shape} ending in ${lastFour}`;
+}
+function isLuhnValid(digits) {
+  if (digits.length === 0) return false;
+  let sum = 0;
+  let double = false;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    const digit = digits.charCodeAt(index) - 48;
+    if (digit < 0 || digit > 9) return false;
+    const weighted = double ? digit * 2 : digit;
+    sum += weighted > 9 ? weighted - 9 : weighted;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+function foldDecimalDigit(char) {
+  const code = char.codePointAt(0);
+  if (code === void 0) return char;
+  if (code >= 48 && code <= 57) return char;
+  for (let value = 0; value <= 9; value += 1) {
+    const candidateZero = code - value;
+    if (!new RegExp("\\p{Nd}", "u").test(String.fromCodePoint(candidateZero))) return char;
+    if (!new RegExp("\\p{Nd}", "u").test(String.fromCodePoint(candidateZero - 1))) return String(value);
+  }
+  return char;
+}
+function normalizeForNumericDetection(value) {
+  return value.normalize("NFKC").replace(INVISIBLE_FORMAT_OR_MARK, "").replace(UNICODE_DECIMAL_DIGIT, foldDecimalDigit);
+}
+function isPaymentCardGrouping(groups, separators, start, end) {
+  const first = groups[start];
+  if (first === void 0) return false;
+  if (end === start) return true;
+  if (first.length <= 3) {
+    let uniformThousands = true;
+    for (let index = start + 1; index <= end; index += 1) {
+      if (groups[index]?.length !== 3 || separators[index - 1] !== THOUSANDS_GROUP_SEPARATOR) {
+        uniformThousands = false;
+        break;
+      }
+    }
+    if (uniformThousands) return true;
+  }
+  if (first.length === 4) {
+    let uniformFours = true;
+    for (let index = start + 1; index < end; index += 1) {
+      if (groups[index]?.length !== 4) {
+        uniformFours = false;
+        break;
+      }
+    }
+    const last = groups[end];
+    if (uniformFours && last !== void 0 && last.length >= 1 && last.length <= 4) {
+      return true;
+    }
+  }
+  return end - start === 2 && first.length === 4 && groups[start + 1]?.length === 6 && groups[start + 2]?.length === 5;
+}
+function isPlausibleYearList(groups, start, end) {
+  for (let index = start; index <= end; index += 1) {
+    if (!PLAUSIBLE_YEAR.test(groups[index] ?? "")) return false;
+  }
+  return true;
+}
+function firstPaymentCardRun(normalized) {
+  for (const match of normalized.matchAll(NUMERIC_GROUP_RUN)) {
+    const parts = match[0].split(NUMERIC_GROUP_SPLIT);
+    const groups = [];
+    const separators = [];
+    for (let index = 0; index < parts.length; index += 1) {
+      const part = parts[index];
+      if (part === void 0) continue;
+      if (index % 2 === 0) groups.push(part);
+      else separators.push(part);
+    }
+    for (let start = 0; start < groups.length; start += 1) {
+      let digits = "";
+      for (let end = start; end < groups.length; end += 1) {
+        digits += groups[end];
+        if (digits.length > MAX_PAYMENT_CARD_DIGITS) break;
+        if (digits.length < MIN_PAYMENT_CARD_DIGITS) continue;
+        if (isPaymentCardGrouping(groups, separators, start, end) && !isPlausibleYearList(groups, start, end) && isLuhnValid(digits)) {
+          return digits;
+        }
+      }
+    }
+  }
+  return null;
 }
-function maskedContactNumber(substring) {
-  const digits = substring.replace(/\D/g, "");
-  const lastFour = digits.slice(-4);
-  return `a ${digits.length}-digit run ending in ${lastFour}`;
+function nonDateDigits(run2) {
+  return run2.replace(ISO_DATE_TOKEN, " ").replace(/\D/g, "");
 }
 function firstContactOrPaymentRun(value) {
-  for (const match of value.matchAll(CONTACT_OR_PAYMENT_CANDIDATE)) {
-    const run2 = match[0];
-    if (run2.replace(/\D/g, "").length >= MIN_CONTACT_NUMBER_DIGITS) {
-      return run2;
+  const normalized = normalizeForNumericDetection(value);
+  const card = firstPaymentCardRun(normalized);
+  if (card !== null) return { kind: "card", digits: card };
+  for (const match of normalized.matchAll(CONTACT_OR_PAYMENT_CANDIDATE)) {
+    const digits = nonDateDigits(match[0]);
+    if (digits.length >= MIN_CONTACT_NUMBER_DIGITS) {
+      return { kind: "contact", digits };
     }
   }
   return null;
@@ -36225,11 +36344,17 @@ function contentViolationsForString(value) {
   }
   const urlMatch = value.match(URL_OR_PATH_PATTERN);
   if (urlMatch) {
-    found.push({ rule_id: "url_or_path", found: `the URL or path ${quotedContentSubstring(urlMatch[0])}` });
+    found.push({
+      rule_id: "url_or_path",
+      found: redactedMatchDescription(urlOrPathDescription(urlMatch[0]), urlMatch)
+    });
   }
   const emailMatch = value.match(EMAIL_PATTERN);
   if (emailMatch) {
-    found.push({ rule_id: "email", found: `the email address ${quotedContentSubstring(emailMatch[0])}` });
+    found.push({
+      rule_id: "email",
+      found: redactedMatchDescription("an email address", emailMatch)
+    });
   }
   const contactRun = firstContactOrPaymentRun(value);
   if (contactRun) {
@@ -37672,7 +37797,27 @@ var confirmationSummarySchema = external_exports.object({
   risk_level: external_exports.enum(["normal", "sensitive", "dangerous"]),
   summary: external_exports.string(),
   expires_at: external_exports.string(),
-  created_at: external_exports.string()
+  created_at: external_exports.string(),
+  // DER-3264: false when the implementation run that staged this confirmation
+  // can no longer execute it — its bootstrap bearer lapsed, the run closed, or
+  // the initiating owner lost their role. `confirmation.approve` refuses such a
+  // row, so an inventory that reported only `expires_at` was telling every
+  // machine caller the card was decidable for hours after it stopped being one.
+  // Always true for a confirmation with no implementation run behind it.
+  //
+  // `.optional()` tolerates SCHEMA SKEW across mixed server/client versions
+  // (a CLI or MCP client pinned to an older protocol build parsing a newer
+  // server's payload, or the reverse). Be clear about what it does NOT do: the
+  // validation that actually runs against this schema is the server's own
+  // OUTPUT validation, so an optional field means a projection that silently
+  // stopped emitting it would still PASS. Nothing mechanically guarantees
+  // presence today: the command's return type derives from THIS schema
+  // (`z.output`, where the key is optional), so deleting the projection line
+  // in `confirmation.list` would typecheck AND validate cleanly — the field is
+  // present only because the projection emits it. Value derives
+  // from the one shared liveness rule the approve path itself enforces
+  // (packages/db/src/implementation-run-liveness.ts).
+  implementation_run_live: external_exports.boolean().optional()
 }).strict();
 var confirmationListOutputSchema = external_exports.object({
   confirmations: external_exports.array(confirmationSummarySchema)
@@ -54216,7 +54361,7 @@ var referenceDocuments = [
     order: 10,
     title: "{{brand}} implementation method",
     summary: "The staged operating-system setup path used by humans, CLI sessions, MCP clients, and in-app agents.",
-    version: "2026-08-05.3",
+    version: "2026-08-06.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -54351,7 +54496,7 @@ The Compass is drafted, then activated by a human through supersession.
 
 Both commands fail closed on a missing server capability (for example unconfigured document-source storage) with a named, owner-facing remediation string that says what to do next \u2014 never a bare error code or a raw configuration value. \`onboarding.source_ingest\` checks this before decoding the uploaded source; \`onboarding.setup\` checks it before any plan-shape or Responsibility Graph foundation validation runs, so the block happens as early as the command can report it. The web onboarding entry screen surfaces the same deployment-wide readiness state before an owner invests in the flow.
 
-Content-linting on a setup plan reports every violation in one response rather than the first: each names its rule, the exact field path, the offending substring (quoted, with secrets redacted and payment/phone numbers masked), and a one-line remedy. Free-text narrative may contain ISO dates (\`YYYY-MM-DD\`) and short numeric references \u2014 only a run of nine or more digits is treated as a direct phone or payment identifier \u2014 so a date in prose no longer forces a bisection. The approval card also carries non-blocking reachability warnings: for each agent- or integration-sourced Charter measurable whose Seat permission manifest grants no read-capable tool, it names the input the agent cannot read, so the owner sees the gap before approving rather than after an agent escalates at runtime.
+Content-linting on a setup plan reports every violation in one response rather than the first: each names its rule, the exact field path, a safe description of the offending content, and a one-line remedy. The lint never reproduces what it matched \u2014 a path or an email address can itself be a credential \u2014 so it names the shape and the character offset instead (\`a relative file path at character offset 5\`), masks a phone or payment number to its digit count and last four, and names secret-shaped material only by class. The exact field path in each violation is what locates it. Free-text narrative may contain ISO dates (\`YYYY-MM-DD\`), everyday currency amounts, and short numeric references; adjacent dates are read as separate dates, so a date in prose never forces a bisection. Two things are treated as a direct contact or payment identifier: a run of nine or more digits, and a grouped number that carries a payment card's grouping, its 13-to-19-digit length, and its check digit. Digit script does not change that answer \u2014 non-ASCII digits are folded first, and zero-width, bidi, and combining characters are removed before grouping, so a number that survived a copy-paste out of a PDF or a right-to-left document is still read as one number. Separator choice mostly does not either: spaces, tabs, newlines, commas, dashes, and the other grouping punctuation all join digits into one candidate. **The exception is thousands grouping,** which is recognised only when the separator is the one a locale actually emits \u2014 a comma, a period, a space, or a non-breaking space. A number grouped in thousands by a semicolon, a colon, a pipe, an underscore, a tab, a newline, an en-dash, or a comma followed by a space is not read as a card. That narrowing is deliberate: without it, several ordinary amounts sitting next to each other in a sentence merged into one candidate and were rejected about nine times in ten. Three limits are worth stating rather than discovering. **A run of more than 32 consecutive separator characters inside one number splits it,** and the part after the split is no longer examined as a card \u2014 for spaces, periods, hyphens, parentheses, and slashes the nine-or-more-digit rule still catches it, but for tabs, newlines, and the comma family nothing does. **A single amount written with comma thousands separators that reaches 13 digits and happens to satisfy the card check digit is rejected,** and that is deliberate \u2014 it is the same shape a card written with thousands separators takes, so the check fails closed. Its message says it is a grouped number matching a payment-card checksum rather than naming it a card, because nothing about its leading digits identifies an issuer. The frequency rises with magnitude: measured over 2,000 random amounts per size, none below 13 digits is rejected, about 9% of 13-digit amounts are, about 29% of 16-digit, and about 48% of 19-digit. Everyday amounts are therefore untouched, and several *comma-grouped* amounts standing next to each other in a sentence are read as separate numbers rather than merged into one. **Adjacent amounts written without separators are not** \u2014 \`112500000 118750000\` is one 18-digit run to the nine-or-more-digit rule, and is rejected on that ground rather than as a card. Group large figures, or reference them by their Signal, to keep them out of the rule. The approval card also carries non-blocking reachability warnings: for each agent- or integration-sourced Charter measurable whose Seat permission manifest grants no read-capable tool, it names the input the agent cannot read, so the owner sees the gap before approving rather than after an agent escalates at runtime.
 
 The whole composite flow has first-class CLI verbs: \`{{cli}} onboard source-ingest --file <path> ...\` for each allowed local source, \`{{cli}} onboard setup --input-file <plan.json>\` to stage the one owner approval (it prints the confirmation id and exact approval URL), \`{{cli}} onboard setup-status --input-file <plan.json>\` to discover the applied receipt by idempotent re-submission of the identical plan, then \`{{cli}} onboard rehearse\` and \`{{cli}} onboard activate\`. Each uses an existing implementation-bootstrap credential first; only an absent credential leaves the user-session path available, while expiry, read errors, authentication failures, and policy refusals stop without a principal change. The generic \`{{cli}} command <id> --json\` path and the generated MCP tools expose the same schemas.
 
@@ -54556,7 +54701,7 @@ Canonical source: \`github.com/agenticoperatingsystem/rost-implementation-skill\
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-08-04.1",
+    version: "2026-08-06.1",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -54629,7 +54774,7 @@ The same Settings area shows AICOS authority and launch recovery in customer lan
 
 Each turn carries server-normalized page context: route template, current path, safe search state, selected seat or object ids when authorized, onboarding state when relevant, and the current tenant clock. AICOS treats the supplied clock as authoritative for today's date and time instead of guessing from model priors. The server derives tenant and user authority from the authenticated session. Client-supplied tenant context is never accepted as authority.
 
-The current chat harness shows the effective lane and model. Cloud is the default and remains the enforced lane during onboarding, even if a post-onboarding lane has been selected. After onboarding, an owner can select cloud, runner, or MCP only when the server says that lane is ready. On a live, recognized stock AICOS Charter, a lane change does more than update the agent seat: in the same transaction it mints a new Charter successor version carrying manifest evidence for the new lane, supersedes the version it replaces, and repins the agent to that successor \u2014 evidence is never re-minted onto the existing version. Before that receipt is written, the server re-runs every signing gate for the target lane; a matching manifest digest only establishes that the document is eligible to reuse, never that the target lane is authorized, so a target whose gates fail is refused and nothing is written. Those gates cover connector wiring for the target lane, the company autonomy ceiling, connection identity, and required Skill tool access \u2014 a lane change never clears a block the ordinary sign-off would refuse. Each refusal names the remediation that actually clears it: a Charter that is a recognized stock revision but has never been signed off names \`charter.sign_manifest\` and the exact version id to sign; an in-flight draft asks you to approve or discard it first. A manifest that has been **edited**, or is otherwise unrecognized, cannot re-mint automatically at all \u2014 automatic re-minting only recognizes unmodified stock revisions \u2014 so it is refused as such, and the way forward is to restore the Charter to a stock revision with \`charter.set\` and sign it with \`charter.sign_manifest\`. Any failure rolls the whole change back \u2014 no successor, receipt, decision, or audit event is left behind, and the lane itself stays where it was. The browser never decides tenant authority or runner/MCP readiness.
+The current chat harness shows the effective lane and model. Cloud is the default and remains the enforced lane during onboarding, even if a post-onboarding lane has been selected. After onboarding, an owner can select cloud, runner, or MCP only when the server says that lane is ready. On a live, recognized stock AICOS Charter, a lane change does more than update the agent seat: in the same transaction it mints a new Charter successor version carrying manifest evidence for the new lane, supersedes the version it replaces, and repins the agent to that successor \u2014 evidence is never re-minted onto the existing version. Before that receipt is written, the server re-runs every signing gate for the target lane; a matching manifest digest only establishes that the document is eligible to reuse, never that the target lane is authorized, so a target whose gates fail is refused and nothing is written. Those gates cover connector wiring for the target lane, the company autonomy ceiling, connection identity, and required Skill tool access \u2014 a lane change never clears a block the ordinary sign-off would refuse. Each refusal names the remediation that actually clears it: a Charter that is a recognized stock revision but has never been signed off names \`charter.sign_manifest\` and the exact version id to sign; an in-flight draft asks you to approve or discard it first. A manifest that has been **edited**, or is otherwise unrecognized, cannot re-mint automatically at all \u2014 automatic re-minting only recognizes unmodified stock revisions \u2014 so it is refused as such, and the way forward is to restore the Charter to a stock revision with \`charter.set\` and sign it with \`charter.sign_manifest\`. A Charter that grants autonomous authority above the company guardrail ceiling is refused too, and names both ways out \u2014 lower the grant to always-ask, or, as a deliberate loosening, raise the ceiling under Settings -> Company guardrails (\`settings.agent_policy.update\`). The remaining refusals describe seat states rather than Charter contents: an agent mid dry-run must finish or discard the rehearsal first, and a seat carrying more than one active agent pinned to the Charter being replaced must be reduced to one before a lane change can bind evidence to a single target. Any failure rolls the whole change back \u2014 no successor, receipt, decision, or audit event is left behind, and the lane itself stays where it was. The browser never decides tenant authority or runner/MCP readiness.
 
 AICOS also has an explicit brain selection. Cloud can use the included managed allowance or a tenant Anthropic key (BYOK). When cloud is on the managed allowance, an owner can also pick a specific managed model from the AI Gateway's priced, ZDR-rated catalog (today: Anthropic's own "Automatic" default, plus managed OpenAI and xAI entries) instead of leaving the choice on Anthropic's default routing. A managed model without a zero-data-retention tier shows as locked with the reason until a tenant owner explicitly unlocks non-ZDR managed models (\`tenant.model_gateway_policy.update\`, owner-only and dangerous-gated); once unlocked, its per-model data-retention disclosure is shown before it becomes selectable. Selecting one of these managed models updates AICOS settings immediately, but it does not yet change which model actually answers a cloud AICOS turn \u2014 every non-Anthropic option says so plainly, and cloud turns keep running on the existing Anthropic routing until a later runtime cutover wires the persisted selection through. Runner brain preference still records Claude or Codex, but interactive AICOS runner turns are currently gated to Claude while the Codex path remains unverified. MCP is labeled as the MCP client. Read this selection with \`aicos.brain_settings.get\`; owners can update it with \`aicos.brain_settings.update\` (CLI flags: \`--lane\`, \`--cloud-brain managed|byok\`, \`--runner-brain claude-cli|codex-cli\`). BYOK requires an active tenant Anthropic key and does not support a specific managed-model selection. Choosing \`codex-cli\` for AICOS runner mode is currently rejected with a precondition error until the governed interactive runner path is verified. Runner and MCP answers are labeled in the transcript and do not consume the managed cloud allowance. If the selected runner reports that its active local model account has exhausted its allowance, Settings surfaces **Allowance exhausted** before the user sends another AICOS turn so they can switch lanes, switch runner accounts, or keep working manually instead of waiting on a doomed runner round-trip.
 
@@ -54970,7 +55115,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-08-04.1",
+    version: "2026-08-06.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -55048,6 +55193,8 @@ The lane a live agent runs on \u2014 cloud (the {{brand}}-managed runtime), a pa
 
 The governed AICOS seat's own lane change is a separate, owner-only path \u2014 Settings -> AICOS, or \`aicos.brain_settings.update\` \u2014 and behaves differently on a live, recognized stock AICOS Charter: see the AICOS chat guide for the Charter successor it mints. A draft agent's lane is still set directly with \`agent_setup.update\`.
 
+\`agent_setup.update\` sets the lane only while the agent is still in setup. It refuses a lane change on a **paused** agent, because a paused agent carries a real Charter pin whose manifest evidence names its current lane and \`agent.resume\` brings it back live without re-checking that \u2014 so moving the lane there would put an agent live on evidence for a lane it no longer runs on, at a lower authority than either governed path requires. The refusal names the right one for the agent: \`aicos.brain_settings.update\` for the governed AICOS seat (it mints and re-signs the Charter evidence for the new lane), and \`agent_setup.relane\` for every other agent. Re-sending a paused agent's existing lane is unchanged \u2014 that is not a lane change. A \`dry_run\` agent's lane is still settable, and the go-live gate refuses to promote it until a fresh rehearsal and current manifest evidence both match the new lane.
+
 ## When to stop for confirmation
 
 \`agent.create_from_template\`, \`agent.create_custom\`, \`staffing.assign_user\`, \`agent.go_live\`, \`agent.update_schedule\`, \`agent_setup.relane\`, and \`mcp_token.create\` are \`human_required\`; \`agent.configure_tools\` and \`credential.ingress\` are \`credential_flow\` (both gate through the vault-backed credential path with human approval; \`agent.configure_tools\` stages the request and only \`credential.ingress\` takes the raw secret, as a vault reference); \`agent.decommission\` is \`dangerous\`. \`agent.run_now\` is \`human_required\` (DER-1766/DER-2081): a cross-seat run always asks, while a same-seat re-run of the acting seat's own live agent may auto-execute only under a standing Trusted grant. An agent may draft, configure (with vault refs), dry-run, and request an on-demand run; the human approves go-live, credentials, schedule changes, and decommission. \`run_dry_run\` is ungated by human approval, but it is **precondition-gated**: the seat's permission manifest must be signed first (\`charter.sign_manifest\`). Attempting a dry run before sign-off returns a clean \`COMMAND_PRECONDITION_FAILED\` naming \`charter.sign_manifest\`, not a generic failure. Go-live after a passed dry run is \`human_required\`. See the confirmations guide.
@@ -57482,7 +57629,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-08-06.2",
+    version: "2026-08-06.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -57571,6 +57718,14 @@ A held tool call actuates the same way regardless of which command backs it \u20
 
 The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations, open steward escalations, and agent-proposed draft tasks into a single queue, each item shown with its risk or proposal type, the source or proposing seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; anyone else \u2014 including an admin \u2014 sees confirmations for the seats they occupy. The one exception is the stored-target command family described above: those cards never surface through seat occupancy at all \u2014 they appear only when the viewer currently stewards or administers the card's live target, even for a seat they don't occupy. The queue also shows escalations routed to the viewer's steward chain, and task proposals where they occupy or steward the target seat. An admin can still decide (approve or reject) a seat's confirmation by id even when it does not appear in their own queue here; see "Resolving a confirmation" above. Confirming a task proposal runs \`task.confirm_proposal\` and moves the draft to Offered; declining runs \`task.decline_proposal\` and records a human reason. Neither action accepts the task, schedules a run, or executes agent work. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
 
+## When an agent-led run ends before you decide
+
+A confirmation staged by an agent-led implementation run answers to **two** clocks, not one. The card has its own expiry (4 hours at normal risk). The implementation run behind it has a much shorter one: the bootstrap bearer starts at about 55 minutes, and while a gate is waiting it only renews **as the agent keeps working**. If the agent's session ends \u2014 the terminal closes, the host sleeps, the run is completed or abandoned \u2014 nothing renews it, and the bearer lapses long before the card does. Removing or demoting the owner who approved the run has the same effect immediately.
+
+From that moment the card cannot be approved, even though it is still listed and has not expired. {{brand}} says so on every surface rather than letting you find out by clicking: the card on \`/approvals\` is labelled **Run ended**, states that the implementation run behind the proposal has finished, and its Approve (and, once the card expires, its **Re-mint & approve**) is disabled; the \`/onboarding\` banner stops counting it as an approval waiting on you and drops its review link; and the setup lifecycle card replaces "ready for your review" with the same explanation. The waiting-on-you reminder email is not sent for one either \u2014 there is no action left to remind you about.
+
+**Rejecting it still works**, and is how you clear the card. The real fix is to start a new implementation run (\`{{cli}} implementation access start\`) and have the agent re-stage the proposal; nothing you approved earlier is lost, because an applied setup receipt is immutable and independent of the run that produced it. A card with no implementation run behind it \u2014 anything a human staged directly \u2014 is never affected by this.
+
 ## Clearing expired confirmations
 
 A confirmation that expires before a human acts on it is dead \u2014 it can no longer be approved. Re-mint revives one; dismiss is the opposite gesture for a card you do *not* want to revive. \`confirmation.dismiss\` clears one obsolete expired card from the queue, and \`confirmation.dismiss_stale\` clears every currently-expired card in your authority scope at once (bulk "dismiss all stale"). Dismiss is human-only queue hygiene: it never re-executes the original command and never records a decision \u2014 it just marks the dead card \`dismissed\`, notes who dismissed it, and writes an audit event for each row (\`dismiss_stale\` writes one per card). Only an already-expired card is dismissable; a still-live pending confirmation is refused, because its decision is approve or reject, not dismiss. You can only dismiss cards you already have authority over \u2014 an owner over any, anyone else \u2014 including an admin \u2014 over the seats they occupy, plus, for the stored-target command family described above, any card whose current live target they steward or administer even without occupying its original seat. An admin who does not hold that seat and does not steward/administer a stored-target card's live target cannot dismiss it, even though they can still decide (approve or reject) a still-live one.