@rosthq/cli 0.7.170 → 0.7.172

package/dist/config.d.ts

@@ -30,5 +30,18 @@ export declare function resolveAppUrl(value: string, env?: NodeJS.ProcessEnv): {
     warning: string | null;
 };
 export declare function inspectAppUrlPolicy(value: string, env?: NodeJS.ProcessEnv): AppUrlPolicyInspection;
+/** Shown in place of an app_url with no usable origin. */
+export declare const withheldAppUrlDisplay = "(withheld: app_url is not a valid URL)";
+/**
+ * Render a configured app_url for display: scheme, host, port and base path,
+ * with no trailing slash. Fails closed to {@link withheldAppUrlDisplay}.
+ */
+export declare function displayAppUrl(value: string): string;
+/**
+ * Compose a known in-app route onto a configured app_url's credential-free
+ * display base. `route` is a codebase-owned literal (never caller data) and
+ * is relative so a base path survives. Strips a leading slash defensively.
+ */
+export declare function appUrlLink(value: string, route: string): string;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAC7E,eAAO,MAAM,sBAAsB,QAAiD,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAYF,QAAA,MAAM,YAAY;;;;kBAIP,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAE1E;AAED,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAC/E,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAcA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CASA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,sBAAsB,CAsG/G"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAC7E,eAAO,MAAM,sBAAsB,QAAiD,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAYF,QAAA,MAAM,YAAY;;;;kBAIP,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAE1E;AAED,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAC/E,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAcA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CASA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,sBAAsB,CA8H/G;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,2CAA2C,CAAC;AAyB9E;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUnD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/dist/index.js

@@ -13372,13 +13372,13 @@ var init_command_discovery = __esm({
       { "id": "friction.stale_candidates", "title": "Find stale friction", "description": "List open or diagnosing Friction issues whose linked remediation task has already shipped, making them high-confidence candidates for bulk resolution, with per-row evidence. Read-only \u2014 it never resolves anything.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "stale_after_days": { "default": 14, "type": "integer", "minimum": 1, "maximum": 365 }, "limit": { "default": 50, "type": "integer", "minimum": 1, "maximum": 200 } }, "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "candidates": { "type": "array", "items": { "type": "object", "properties": { "issue_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "summary": { "type": "string" }, "severity": { "type": "string", "enum": ["low", "med", "high", "critical"] }, "status": { "type": "string", "enum": ["open", "diagnosing"] }, "created_at": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$" }, "updated_at": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$" }, "days_stale": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "action_task_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "action_task_status": { "anyOf": [{ "type": "string" }, { "type": "null" }] }, "action_task_done": { "type": "boolean" }, "confidence": { "type": "string", "enum": ["low", "medium", "high"] }, "evidence": { "type": "array", "items": { "type": "string" } } }, "required": ["issue_id", "summary", "severity", "status", "created_at", "updated_at", "days_stale", "action_task_id", "action_task_status", "action_task_done", "confidence", "evidence"], "additionalProperties": false } }, "total": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": ["candidates", "total"], "additionalProperties": false }, "help": "List open or diagnosing issues whose remediation task already shipped \u2014 high-confidence candidates for a bulk close-the-loop pass. Read-only.", "guide_slugs": ["friction-guide"], "stages": ["operating_rhythm"], "related_command_ids": [] },
       { "id": "friction.update_status", "title": "Update Friction issue status", "description": "Move a non-terminal issue between open and diagnosing. Terminal issues (resolved/dropped) cannot be reopened here.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "eligible", "risk_flags": [], "rationale": "Eligible for Trusted execution only when the signed Charter manifest, tenant policy, budget, and command guard allow it." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "issue_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "status": { "type": "string", "enum": ["open", "diagnosing"] } }, "required": ["issue_id", "status"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "issue_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "status": { "type": "string", "enum": ["open", "diagnosing"] }, "event_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["issue_id", "status", "event_id"], "additionalProperties": false }, "help": "Move a non-terminal issue between open and diagnosing while it is being worked.", "guide_slugs": ["friction-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.answer_gap", "confirmation.approve", "escalation.raise", "friction.assist", "friction.file_issue", "friction.get", "friction.link_task", "friction.list", "friction.resolve", "onboarding.finish", "task.accept", "task.complete", "task.confirm_proposal", "task.create", "task.decline", "task.decline_proposal", "task.list"] },
       { "id": "gate.decide", "title": "Decide a conversational gate", "description": "A human approves or rejects a conversational gate bound to an artifact digest (a prototype URL, deliverable, or artifact). The agent drafts the decision and the human confirms it; the resolver is always a human. On approval the artifact must be unchanged since the gate was drafted \u2014 a stale digest re-blocks. Requires confirmation.", "required_scope": "tenant", "confirmation": "human_required", "trusted_execution": { "mode": "always_human", "risk_flags": [], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "subject_kind": { "type": "string", "enum": ["prototype", "deliverable", "artifact"] }, "subject_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "artifact_ref": { "type": "object", "properties": { "href": { "type": "string", "minLength": 1, "maxLength": 2048 }, "label": { "type": "string", "minLength": 1, "maxLength": 200 } }, "required": ["href", "label"], "additionalProperties": false }, "artifact_digest": { "type": "string", "minLength": 1, "maxLength": 200 }, "decision": { "type": "string", "enum": ["approve", "reject"] }, "ask": { "type": "string", "minLength": 1, "maxLength": 400 }, "consequence": { "type": "string", "minLength": 1, "maxLength": 600 }, "unblocked_targets": { "default": [], "maxItems": 20, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 } }, "rationale": { "type": "string", "maxLength": 4e3 } }, "required": ["subject_kind", "subject_id", "artifact_ref", "artifact_digest", "decision", "ask", "consequence"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "decision_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "subject_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "artifact_digest": { "type": "string" }, "decision": { "type": "string", "enum": ["approve", "reject"] }, "decided_by": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "gate_status": { "type": "string", "enum": ["approved", "rejected"] } }, "required": ["decision_id", "subject_id", "artifact_digest", "decision", "decided_by", "gate_status"] }, "help": "A human approves or rejects a conversational gate bound to an artifact digest; the agent drafts, the human confirms (invariant #7).", "guide_slugs": ["agent-reference-map", "mcp-and-cli-guide"], "stages": ["operating_rhythm"], "related_command_ids": [] },
-      { "id": "goal.bind_measurable", "title": "Bind a Signal to a Cascade goal", "description": "Role defaults to 'informs' \u2014 a conservative informative indicator allowed at any goal level (many per goal) that never changes goal status. Role 'drives_status' makes it the goal's status driver: allowed only on a childless seat goal or milestone, at most one per goal, requires a second_anchor (a prior closed period + expected value confirming the Signal matched the books). This signal will set the goal's status from confirmed readings. You can turn this off later. Explicit auto_status_enabled: false opts out at bind time; goal.set_auto_status changes it after the fact. Binding a driver over an existing informs binding of the same Signal promotes it. Binding is human-gated.", "required_scope": "seat", "confirmation": "human_required", "trusted_execution": { "mode": "eligible_bounded", "risk_flags": [], "rationale": "Binding an informs-level Signal never changes goal status, so it is a bounded worker action safe to auto-apply under a standing Trusted grant." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "role": { "default": "informs", "type": "string", "enum": ["drives_status", "informs"] }, "auto_status_enabled": { "type": "boolean" }, "second_anchor": { "type": "object", "properties": { "period_start": { "type": "string", "minLength": 1 }, "expected_value": { "type": "number" } }, "required": ["period_start", "expected_value"], "additionalProperties": false } }, "required": ["goal_id", "measurable_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "role": { "type": "string", "enum": ["drives_status", "informs"] }, "auto_status_enabled": { "type": "boolean" }, "signal_state": { "type": "string", "enum": ["ok", "risk", "crit", "pending"] }, "computed_status": { "anyOf": [{ "type": "string", "enum": ["on", "off", "done", "dropped"] }, { "type": "null" }] }, "pinned_divergence": { "type": "boolean" }, "already_bound": { "type": "boolean" }, "driver_anchor": { "anyOf": [{ "type": "object", "properties": { "period_start": { "type": "string", "minLength": 1 }, "expected_value": { "type": "number" } }, "required": ["period_start", "expected_value"], "additionalProperties": false }, { "type": "null" }] } }, "required": ["goal_id", "measurable_id", "role", "auto_status_enabled", "signal_state", "computed_status", "pinned_divergence", "already_bound", "driver_anchor"], "additionalProperties": false }, "help": "Bind a Signal to a goal. Defaults to role informs (a conservative indicator at any level that never changes status); pass role drives_status with a second_anchor (a prior closed period + expected value confirming the Signal matched the books) to make it a childless leaf goal's status driver \u2014 this promotes an existing informs binding. A new drives_status binding defaults auto_status_enabled to true (pass auto_status_enabled:false to opt out at bind time).", "guide_slugs": ["cascade-guide", "signal-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["agent.run_now", "agent.trust.create", "agent.update_schedule", "command.describe", "command.list", "compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "friction.resolve", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish", "skill.assign_to_seat"] },
+      { "id": "goal.bind_measurable", "title": "Bind a Signal to a Cascade goal", "description": "Role defaults to 'informs' \u2014 a conservative informative indicator allowed at any goal level (many per goal) that never changes goal status. Role 'drives_status' makes it the goal's status driver: allowed only on a childless seat goal or milestone, at most one per goal, requires a second_anchor (a prior closed period + expected value confirming the Signal matched the books). This signal will set the goal's status from confirmed readings. You can turn this off later. Explicit auto_status_enabled: false opts out at bind time; goal.set_auto_status changes it after the fact. Binding a driver over an existing informs binding of the same Signal promotes it. Binding is human-gated.", "required_scope": "seat", "confirmation": "human_required", "trusted_execution": { "mode": "eligible_bounded", "risk_flags": [], "rationale": "Binding an informs-level Signal never changes goal status, so it is a bounded worker action safe to auto-apply under a standing Trusted grant." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "role": { "default": "informs", "type": "string", "enum": ["drives_status", "informs"] }, "auto_status_enabled": { "type": "boolean" }, "second_anchor": { "type": "object", "properties": { "period_start": { "type": "string", "minLength": 1 }, "expected_value": { "type": "number" } }, "required": ["period_start", "expected_value"], "additionalProperties": false } }, "required": ["goal_id", "measurable_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "role": { "type": "string", "enum": ["drives_status", "informs"] }, "auto_status_enabled": { "type": "boolean" }, "signal_state": { "type": "string", "enum": ["ok", "risk", "crit", "pending"] }, "computed_status": { "anyOf": [{ "type": "string", "enum": ["on", "off", "done", "dropped"] }, { "type": "null" }] }, "pinned_divergence": { "type": "boolean" }, "already_bound": { "type": "boolean" }, "driver_anchor": { "anyOf": [{ "type": "object", "properties": { "period_start": { "type": "string", "minLength": 1 }, "expected_value": { "type": "number" } }, "required": ["period_start", "expected_value"], "additionalProperties": false }, { "type": "null" }] }, "warnings": { "type": "array", "items": { "type": "string" } } }, "required": ["goal_id", "measurable_id", "role", "auto_status_enabled", "signal_state", "computed_status", "pinned_divergence", "already_bound", "driver_anchor"], "additionalProperties": false }, "help": "Bind a Signal to a goal. Defaults to role informs (a conservative indicator at any level that never changes status); pass role drives_status with a second_anchor (a prior closed period + expected value confirming the Signal matched the books) to make it a childless leaf goal's status driver \u2014 this promotes an existing informs binding. A new drives_status binding defaults auto_status_enabled to true (pass auto_status_enabled:false to opt out at bind time).", "guide_slugs": ["cascade-guide", "signal-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["agent.run_now", "agent.trust.create", "agent.update_schedule", "command.describe", "command.list", "compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "friction.resolve", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish", "skill.assign_to_seat"] },
       { "id": "goal.create", "title": "Create Cascade goal", "description": "Create a Cascade goal. Defaults to a seat goal: pass seat_id and parent_goal_id, and the parent chain must terminate at a company objective in the same cycle (enforced server-side). Pass kind 'company_objective' to author a company objective \u2014 the Cascade root \u2014 with no seat and no parent; it anchors on the tenant's active Compass, which must already carry a one_year horizon goal, and requires an owner membership (a seat-scoped caller may create seat goals beneath one).", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "kind": { "type": "string", "enum": ["company_objective", "seat_goal"] }, "seat_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "parent_goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "title": { "type": "string", "minLength": 1 }, "definition_of_done": { "type": "string", "minLength": 1 }, "status": { "type": "string", "enum": ["on", "off"] }, "target_date": { "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" } }, "required": ["cycle_id", "title", "definition_of_done"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "parent_goal_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "title": { "type": "string" }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] }, "status_source": { "type": "string", "enum": ["human", "agent", "rollup", "signal"] }, "target_date": { "anyOf": [{ "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" }, { "type": "null" }] }, "warnings": { "type": "array", "items": { "type": "string" } } }, "required": ["goal_id", "cycle_id", "seat_id", "parent_goal_id", "title", "status", "status_source", "target_date"], "additionalProperties": false }, "help": "Create a seat goal under an existing objective (the default), or pass kind 'company_objective' to author the Cascade root itself against the active Compass (owner authority).", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "goal.bind_measurable", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish"] },
       { "id": "goal.drop", "title": "Drop Cascade goal", "description": "Drop (retire) a goal by setting status to dropped. Dropping retires the commitment, so it is human-gated. The row is retained for audit (never deleted).", "required_scope": "tenant_admin", "confirmation": "human_required", "trusted_execution": { "mode": "always_human", "risk_flags": ["admin", "destructive"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["goal_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "parent_goal_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "title": { "type": "string" }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] }, "status_source": { "type": "string", "enum": ["human", "agent", "rollup", "signal"] }, "target_date": { "anyOf": [{ "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" }, { "type": "null" }] }, "warnings": { "type": "array", "items": { "type": "string" } } }, "required": ["goal_id", "cycle_id", "seat_id", "parent_goal_id", "title", "status", "status_source", "target_date"], "additionalProperties": false }, "help": "Drop a goal to retire a commitment; the goal is retained for audit and dropping is human-gated.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "goal.bind_measurable", "goal.create", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish"] },
       { "id": "goal.get", "title": "Get Cascade goal", "description": "Get one goal's core detail and status by id. Seat-scoped callers may only read their own seat's goals.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["goal_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "title": { "type": "string" }, "kind": { "type": "string", "enum": ["objective", "cycle_goal", "company_objective", "seat_goal", "milestone"] }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] }, "status_source": { "type": "string", "enum": ["human", "agent", "rollup", "signal"] }, "progress_pct": { "anyOf": [{ "type": "integer", "minimum": 0, "maximum": 100 }, { "type": "null" }] }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "parent_goal_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "definition_of_done": { "type": "string" }, "target_date": { "anyOf": [{ "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" }, { "type": "null" }] } }, "required": ["id", "title", "kind", "status", "status_source", "progress_pct", "seat_id", "parent_goal_id", "definition_of_done", "target_date"], "additionalProperties": false } }, "required": ["goal"], "additionalProperties": false }, "help": "Get one goal's core detail and status by id; seat tokens may only read their own goals.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "goal.bind_measurable", "goal.create", "goal.drop", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish"] },
       { "id": "goal.list", "title": "List Cascade goals", "description": "List goals in the tenant, optionally filtered by cycle or seat. Seat-scoped callers see only their own seat's goals.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "seat_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goals": { "type": "array", "items": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "kind": { "type": "string", "enum": ["objective", "cycle_goal", "company_objective", "seat_goal", "milestone"] }, "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "parent_goal_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "title": { "type": "string" }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] }, "status_source": { "type": "string", "enum": ["human", "agent", "rollup", "signal"] } }, "required": ["goal_id", "kind", "cycle_id", "seat_id", "parent_goal_id", "title", "status", "status_source"], "additionalProperties": false } } }, "required": ["goals"], "additionalProperties": false }, "help": "List Cascade goals to find goal ids, parentage, and seat ownership before mutating the tree.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "goal.bind_measurable", "goal.create", "goal.drop", "goal.get", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish"] },
       { "id": "goal.list_at_risk", "title": "List at-risk Cascade goals", "description": "List goals projected to miss their cycle pace (at-risk or projected-miss), with how many days behind pace. Read-only; status-only goals (no progress) are excluded.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": {}, "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goals": { "type": "array", "items": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "title": { "type": "string" }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "progress_pct": { "type": "integer", "minimum": 0, "maximum": 100 }, "classification": { "type": "string", "enum": ["on_track", "at_risk", "projected_miss", "untracked"] }, "expected_pct": { "anyOf": [{ "type": "number" }, { "type": "null" }] }, "behind_days": { "anyOf": [{ "type": "number" }, { "type": "null" }] } }, "required": ["goal_id", "title", "seat_id", "cycle_id", "progress_pct", "classification", "expected_pct", "behind_days"], "additionalProperties": false } } }, "required": ["goals"], "additionalProperties": false }, "help": "List goals projected off pace (at-risk or projected-miss), with how many days behind pace. Read-only; status-only goals are excluded.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "goal.bind_measurable", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.reassign_owner", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish"] },
-      { "id": "goal.list_measurables", "title": "List a Cascade goal's Signals", "description": "List the status-driver Signal bound to a Cascade goal (role drives_status), with its current signal indicator and latest confirmed reading. Read-only. Informative (informs) bindings appear in the goal-detail panel's Direct indicators, not here.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["goal_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "bindings": { "type": "array", "items": { "type": "object", "properties": { "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "name": { "type": "string" }, "unit": { "type": "string" }, "role": { "type": "string", "const": "drives_status" }, "auto_status_enabled": { "type": "boolean" }, "signal_state": { "type": "string", "enum": ["ok", "risk", "crit", "pending"] }, "computed_status": { "anyOf": [{ "type": "string", "enum": ["on", "off", "done", "dropped"] }, { "type": "null" }] }, "last_reading_value": { "anyOf": [{ "type": "number" }, { "type": "null" }] }, "driver_anchor": { "anyOf": [{ "type": "object", "properties": { "period_start": { "type": "string", "minLength": 1 }, "expected_value": { "type": "number" } }, "required": ["period_start", "expected_value"], "additionalProperties": false }, { "type": "null" }] } }, "required": ["measurable_id", "name", "unit", "role", "auto_status_enabled", "signal_state", "computed_status", "last_reading_value", "driver_anchor"], "additionalProperties": false } } }, "required": ["goal_id", "bindings"], "additionalProperties": false }, "help": "List the Signals bound to a goal (role drives_status) with each one's current indicator and latest confirmed reading.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": [] },
+      { "id": "goal.list_measurables", "title": "List a Cascade goal's Signals", "description": "List a Cascade goal's Signal bindings, split by role. `bindings` is the status-driver Signal (role drives_status, at most one per goal, childless leaf only) with its current signal indicator and latest confirmed reading. `informs_bindings` is the informative indicators (role informs, any goal level, many per goal) \u2014 these never drive the goal's status, including on a company_objective, which is structurally barred from a driver and takes its status from its children's roll-up or from a human. Read-only.", "required_scope": "tenant", "confirmation": "none", "trusted_execution": { "mode": "not_applicable", "risk_flags": [], "rationale": "This command is not part of the Trusted positive allowlist." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["goal_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "bindings": { "type": "array", "items": { "type": "object", "properties": { "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "name": { "type": "string" }, "unit": { "type": "string" }, "role": { "type": "string", "const": "drives_status" }, "auto_status_enabled": { "type": "boolean" }, "signal_state": { "type": "string", "enum": ["ok", "risk", "crit", "pending"] }, "computed_status": { "anyOf": [{ "type": "string", "enum": ["on", "off", "done", "dropped"] }, { "type": "null" }] }, "last_reading_value": { "anyOf": [{ "type": "number" }, { "type": "null" }] }, "driver_anchor": { "anyOf": [{ "type": "object", "properties": { "period_start": { "type": "string", "minLength": 1 }, "expected_value": { "type": "number" } }, "required": ["period_start", "expected_value"], "additionalProperties": false }, { "type": "null" }] } }, "required": ["measurable_id", "name", "unit", "role", "auto_status_enabled", "signal_state", "computed_status", "last_reading_value", "driver_anchor"], "additionalProperties": false } }, "informs_bindings": { "type": "array", "items": { "type": "object", "properties": { "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "name": { "type": "string" }, "unit": { "type": "string" }, "role": { "type": "string", "const": "informs" }, "signal_state": { "type": "string", "enum": ["ok", "risk", "crit", "pending"] }, "computed_status": { "anyOf": [{ "type": "string", "enum": ["on", "off", "done", "dropped"] }, { "type": "null" }] }, "last_reading_value": { "anyOf": [{ "type": "number" }, { "type": "null" }] } }, "required": ["measurable_id", "name", "unit", "role", "signal_state", "computed_status", "last_reading_value"], "additionalProperties": false } } }, "required": ["goal_id", "bindings", "informs_bindings"], "additionalProperties": false }, "help": "List a goal's Signal bindings, split by role: `bindings` is the status driver (role drives_status, at most one), `informs_bindings` the informative indicators (role informs, many) that never drive status. A Signal on a company objective is always informs.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": [] },
       { "id": "goal.reassign_owner", "title": "Reassign Cascade goal owner seat", "description": "Reassign a seat goal's owner seat to a different seat in the same tenant. The goal's cycle and parent (ancestry chain) are unchanged \u2014 only the owning seat changes. Reassigning accountable ownership is human-gated. Emits a status event naming the previous and new seat.", "required_scope": "tenant_admin", "confirmation": "human_required", "trusted_execution": { "mode": "always_human", "risk_flags": ["admin"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "seat_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["goal_id", "seat_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "previous_seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "seat_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "title": { "type": "string" }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] } }, "required": ["goal_id", "cycle_id", "previous_seat_id", "seat_id", "title", "status"], "additionalProperties": false }, "help": "Reassign a seat goal's owner seat to a different seat in the same tenant; cycle and parent ancestry are unchanged. Reassigning accountable ownership is human-gated.", "guide_slugs": ["cascade-guide", "confirmations-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "confirmation.remint", "credential.ingress", "friction.resolve", "goal.bind_measurable", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reparent", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "mcp_token.create", "onboarding.activate", "onboarding.finish", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
       { "id": "goal.reparent", "title": "Reparent Cascade goal", "description": "Move a goal under a different parent. Reparenting changes accountable structure, so it is human-gated. One-root and no-cycle are enforced server-side.", "required_scope": "tenant_admin", "confirmation": "human_required", "trusted_execution": { "mode": "always_human", "risk_flags": ["admin"], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "parent_goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": ["goal_id", "parent_goal_id"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "cycle_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "seat_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "parent_goal_id": { "anyOf": [{ "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, { "type": "null" }] }, "title": { "type": "string" }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] }, "status_source": { "type": "string", "enum": ["human", "agent", "rollup", "signal"] }, "target_date": { "anyOf": [{ "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" }, { "type": "null" }] }, "warnings": { "type": "array", "items": { "type": "string" } } }, "required": ["goal_id", "cycle_id", "seat_id", "parent_goal_id", "title", "status", "status_source", "target_date"], "additionalProperties": false }, "help": "Reparent a goal only when it clarifies accountable structure; reparenting changes authority and is human-gated.", "guide_slugs": ["cascade-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["agent_grant_intervention.decide", "agent.activation_sign", "agent.go_live", "agent.trust.create", "agent.trust.expire", "agent.trust.revoke", "agent.trust.supersede", "charter.approve", "compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "confirmation.remint", "credential.ingress", "friction.resolve", "goal.bind_measurable", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.set_auto_status", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "mcp_token.create", "onboarding.activate", "onboarding.finish", "onboarding.setup", "seat.create_complete", "staffing.assign_user", "task.confirm_proposal", "task.decline_proposal"] },
       { "id": "goal.set_auto_status", "title": "Toggle Signal-driven auto-status", "description": "Opt a goal's drives_status binding into (or out of) auto-status. Default OFF. Enabling lets confirmed readings drive the goal's status; a human status pin still wins. Human-gated opt-in.", "required_scope": "seat", "confirmation": "human_required", "trusted_execution": { "mode": "always_human", "risk_flags": [], "rationale": "Trusted mode cannot bypass this command's human confirmation or high-risk boundary." }, "expose_over_mcp": true, "input_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "enabled": { "type": "boolean" } }, "required": ["goal_id", "measurable_id", "enabled"], "additionalProperties": false }, "output_schema": { "type": "object", "properties": { "goal_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "measurable_id": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "auto_status_enabled": { "type": "boolean" }, "status": { "type": "string", "enum": ["on", "off", "done", "dropped"] }, "status_source": { "type": "string", "enum": ["human", "agent", "rollup", "signal"] }, "applied_from_signal": { "type": "boolean" } }, "required": ["goal_id", "measurable_id", "auto_status_enabled", "status", "status_source", "applied_from_signal"], "additionalProperties": false }, "help": "Opt a goal's Signal binding into (or out of) auto-status. Default OFF. Enabling lets confirmed readings drive the status; a human status pin still wins.", "guide_slugs": ["cascade-guide", "signal-guide"], "stages": ["operating_rhythm"], "related_command_ids": ["compass.alignment", "compass.approve_version", "compass.set", "confirmation.approve", "goal.bind_measurable", "goal.create", "goal.drop", "goal.get", "goal.list", "goal.list_at_risk", "goal.reassign_owner", "goal.reparent", "goal.set_progress", "goal.set_status", "goal.unbind_measurable", "goal.update", "onboarding.finish"] },
@@ -34840,7 +34840,12 @@ var goalBindMeasurableOutputSchema = external_exports.object({
   // DER-1126: the second anchor recorded when this binding was promoted to (or created
   // as) the status driver. Null for an 'informs' binding (no anchor) and for a legacy
   // driver bound before the anchor gate existed.
-  driver_anchor: goalDriverAnchorSchema.nullable()
+  driver_anchor: goalDriverAnchorSchema.nullable(),
+  // DER-3763: present only when the command has a non-blocking explanatory note to
+  // surface (matches the `goalMutationOutputSchema.warnings` convention, :616). Set for
+  // an 'informs' bind — pointing the caller at the read-back surface a company-objective
+  // Signal has no other way to reach — and omitted entirely for 'drives_status'.
+  warnings: external_exports.array(external_exports.string()).optional()
 }).strict();
 var goalUnbindMeasurableInputSchema = external_exports.object({
   goal_id: uuidSchema14,
@@ -34887,12 +34892,28 @@ var goalMeasurableBindingSchema = external_exports.object({
   // <period>: expected <value>".
   driver_anchor: goalDriverAnchorSchema.nullable()
 }).strict();
+var goalInformsBindingSchema = external_exports.object({
+  measurable_id: uuidSchema14,
+  name: external_exports.string(),
+  unit: external_exports.string(),
+  role: external_exports.literal("informs"),
+  signal_state: goalSignalStateSchema,
+  computed_status: goalStatusSchema.nullable(),
+  last_reading_value: external_exports.number().nullable()
+}).strict();
 var goalListMeasurablesInputSchema = external_exports.object({
   goal_id: uuidSchema14
 }).strict();
 var goalListMeasurablesOutputSchema = external_exports.object({
   goal_id: uuidSchema14,
-  bindings: external_exports.array(goalMeasurableBindingSchema)
+  bindings: external_exports.array(goalMeasurableBindingSchema),
+  // DER-3763: the separate informative-list — never merged into `bindings`. Before this
+  // field existed, `listGoalInformsBindings` (packages/db/src/goal-measurables.ts) had zero
+  // command/CLI/MCP consumers: every `informs` bind (the default role, and the ONLY role a
+  // company_objective can carry — SIGNAL_DRIVABLE_KINDS structurally bars it from
+  // drives_status) was persisted but unreadable through this, the only read command for
+  // bindings.
+  informs_bindings: external_exports.array(goalInformsBindingSchema)
 }).strict();
 var goalCoreSchema = external_exports.object({
   id: uuidSchema14,
@@ -43692,7 +43713,7 @@ var eventEnvelopeReaderSchema = external_exports.discriminatedUnion("type", [
 var KEYED_SECRET_PATTERN = /((?:authorization|token|secret|password|api[_-]?key|connection[_-]?string|database[_-]?url)["']?\s*[:=]\s*["']?)([^\s"',}]+)/gi;
 var ROST_TOKEN_PATTERN2 = rostTokenPattern("replace");
 function redactSecrets(value) {
-  return value.replace(/(Bearer\s+)([A-Za-z0-9._~+/=-]+)/gi, "$1[redacted]").replace(ROST_TOKEN_PATTERN2, "[redacted]").replace(KEYED_SECRET_PATTERN, "$1[redacted]").replace(/([a-z][a-z0-9+.-]*:\/\/[^:@/\s]+:)([^@/\s]+)(@)/gi, "$1[redacted]$3");
+  return value.replace(/(Bearer\s+)([A-Za-z0-9._~+/=-]+)/gi, "$1[redacted]").replace(ROST_TOKEN_PATTERN2, "[redacted]").replace(KEYED_SECRET_PATTERN, "$1[redacted]").replace(/([a-z][a-z0-9+.-]*:\/\/)([^@/\s]+@)/gi, "$1[redacted]@");
 }
 function redactForLog(value) {
   return redactSecrets(typeof value === "string" ? value : JSON.stringify(value, null, 2));
@@ -43897,19 +43918,32 @@ function inspectAppUrlPolicy(value, env = process.env) {
   try {
     parsed = new URL(normalized);
   } catch {
+    const withheld = normalized.length > 0 ? withheldAppUrlDisplay : "(empty)";
     return {
       input: value,
       normalized,
-      displayUrl: normalized.length > 0 ? normalized : "(empty)",
+      displayUrl: withheld,
       kind: "development",
       status: "error",
       allowDevelopmentOptIn: allowDevelopmentAppUrl,
       warning: null,
-      error: `Configured app_url ${normalized.length > 0 ? normalized : "(empty)"} is not a valid URL. Use ${canonicalAppUrl} for production, http://localhost or http://127.0.0.1 for local development, or set ${allowInsecureAppUrlEnv}=1 only for explicit development.`
+      error: `Configured app_url ${withheld} is not a valid URL. Use ${canonicalAppUrl} for production, http://localhost or http://127.0.0.1 for local development, or set ${allowInsecureAppUrlEnv}=1 only for explicit development.`
     };
   }
   const displayUrl = `${parsed.protocol}//${parsed.host}`;
   const isLocalHttpHost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+  if (parsed.username !== "" || parsed.password !== "") {
+    return {
+      input: value,
+      normalized,
+      displayUrl,
+      kind: "development",
+      status: "error",
+      allowDevelopmentOptIn: allowDevelopmentAppUrl,
+      warning: null,
+      error: `Refusing app_url ${displayUrl}: it embeds credentials in the URL. Remove the "user:password@" prefix from ${brandEnvKey("APP_URL")} (or NEXT_PUBLIC_APP_URL, or the ${brandEnvKey("APP_URL")} entry in the runner service plist) and authenticate with a supported mechanism \u2014 \`${cliBrand.binName} login\` for a CLI session, or \`${cliBrand.binName} runner serve --user-code <code>\` for a runner.`
+    };
+  }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
     return {
       input: value,
@@ -43982,6 +44016,41 @@ function inspectAppUrlPolicy(value, env = process.env) {
     error: null
   };
 }
+var withheldAppUrlDisplay = "(withheld: app_url is not a valid URL)";
+function appUrlDisplayBase(value) {
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (parsed.origin === "null") {
+    return null;
+  }
+  const base = new URL(parsed.pathname, parsed.origin);
+  if (!base.pathname.endsWith("/")) {
+    base.pathname = `${base.pathname}/`;
+  }
+  return base;
+}
+function displayAppUrl(value) {
+  if (value.trim().length === 0) {
+    return "(empty)";
+  }
+  const base = appUrlDisplayBase(value);
+  if (base === null) {
+    return withheldAppUrlDisplay;
+  }
+  const rendered = base.toString();
+  return rendered.endsWith("/") ? rendered.slice(0, -1) : rendered;
+}
+function appUrlLink(value, route) {
+  const base = appUrlDisplayBase(value);
+  if (base === null) {
+    return displayAppUrl(value);
+  }
+  return new URL(route.replace(/^\/+/, ""), base).toString();
+}
 function brandEnvKey(suffix) {
   return `${cliBrand.envPrefix}_${suffix}`;
 }
@@ -54777,7 +54846,7 @@ var COMMAND_MANIFEST = [
   { "id": "goal.get", "namespace": "goal", "action": "get", "title": "Get Cascade goal", "description": "Get one goal's core detail and status by id. Seat-scoped callers may only read their own seat's goals.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Get one goal's core detail and status by id; seat tokens may only read their own goals." },
   { "id": "goal.list", "namespace": "goal", "action": "list", "title": "List Cascade goals", "description": "List goals in the tenant, optionally filtered by cycle or seat. Seat-scoped callers see only their own seat's goals.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "cycle_id", "flag": "cycle-id", "type": "string", "required": false }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "bootstrapClass": "read", "help": "List Cascade goals to find goal ids, parentage, and seat ownership before mutating the tree." },
   { "id": "goal.list_at_risk", "namespace": "goal", "action": "list_at_risk", "title": "List at-risk Cascade goals", "description": "List goals projected to miss their cycle pace (at-risk or projected-miss), with how many days behind pace. Read-only; status-only goals (no progress) are excluded.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List goals projected off pace (at-risk or projected-miss), with how many days behind pace. Read-only; status-only goals are excluded." },
-  { "id": "goal.list_measurables", "namespace": "goal", "action": "list_measurables", "title": "List a Cascade goal's Signals", "description": "List the status-driver Signal bound to a Cascade goal (role drives_status), with its current signal indicator and latest confirmed reading. Read-only. Informative (informs) bindings appear in the goal-detail panel's Direct indicators, not here.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "List the Signals bound to a goal (role drives_status) with each one's current indicator and latest confirmed reading." },
+  { "id": "goal.list_measurables", "namespace": "goal", "action": "list_measurables", "title": "List a Cascade goal's Signals", "description": "List a Cascade goal's Signal bindings, split by role. `bindings` is the status-driver Signal (role drives_status, at most one per goal, childless leaf only) with its current signal indicator and latest confirmed reading. `informs_bindings` is the informative indicators (role informs, any goal level, many per goal) \u2014 these never drive the goal's status, including on a company_objective, which is structurally barred from a driver and takes its status from its children's roll-up or from a human. Read-only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "List a goal's Signal bindings, split by role: `bindings` is the status driver (role drives_status, at most one), `informs_bindings` the informative indicators (role informs, many) that never drive status. A Signal on a company objective is always informs." },
   { "id": "goal.reassign_owner", "namespace": "goal", "action": "reassign_owner", "title": "Reassign Cascade goal owner seat", "description": "Reassign a seat goal's owner seat to a different seat in the same tenant. The goal's cycle and parent (ancestry chain) are unchanged \u2014 only the owning seat changes. Reassigning accountable ownership is human-gated. Emits a status event naming the previous and new seat.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Reassign a seat goal's owner seat to a different seat in the same tenant; cycle and parent ancestry are unchanged. Reassigning accountable ownership is human-gated." },
   { "id": "goal.reparent", "namespace": "goal", "action": "reparent", "title": "Reparent Cascade goal", "description": "Move a goal under a different parent. Reparenting changes accountable structure, so it is human-gated. One-root and no-cycle are enforced server-side.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "parent_goal_id", "flag": "parent-goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Reparent a goal only when it clarifies accountable structure; reparenting changes authority and is human-gated." },
   { "id": "goal.set_auto_status", "namespace": "goal", "action": "set_auto_status", "title": "Toggle Signal-driven auto-status", "description": "Opt a goal's drives_status binding into (or out of) auto-status. Default OFF. Enabling lets confirmed readings drive the goal's status; a human status pin still wins. Human-gated opt-in.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }, { "name": "enabled", "flag": "enabled", "type": "boolean", "required": true }], "hasComplexInput": false, "help": "Opt a goal's Signal binding into (or out of) auto-status. Default OFF. Enabling lets confirmed readings drive the status; a human status pin still wins." },
@@ -57276,7 +57345,11 @@ External connectors are being rolled out provider by provider, conservatively (r
     // instructions verbatim got only the active ones. Both drain examples now
     // pass `--resolved all` / `"resolved":"all"` so the copy matches what the
     // example actually does.
-    version: "2026-08-13.2",
+    // DER-3763: the `goal.list_measurables` row said "Driver-only — informs
+    // bindings (direct indicators) are not returned", which this issue makes
+    // false: the command now also returns `informs_bindings`. That row was the
+    // only agent-facing copy asserting the old shape.
+    version: "2026-08-13.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -58173,7 +58246,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_import_a_ninety_v_to_into_a_compass_draft\` | \`compass.import\` | AI-draft a Compass from a ninety V/TO (Core Values \u2192 principles, 10/3/1-Year \u2192 horizon goals, Rocks \u2192 cycle objectives), landed as a draft a human confirms by supersession \u2014 never an accepted Compass. Idempotent by document content (a re-upload of the same V/TO short-circuits without re-drafting). | Tenant | Call with the extracted V/TO \`text\` (and optional \`source_name\`). |
 | \`rost_list_cascade_goals\` | \`goal.list\` | List Cascade goals, optionally by cycle or seat. | Seat or tenant-admin | Call with \`{}\` or \`{"cycle_id":"<id>"}\`. |
 | \`rost_get_cascade_goal\` | \`goal.get\` | Get one goal's core detail and status by id. Seat-scoped callers may only read their own seat's goals. | Seat or tenant-admin | Call with \`{"goal_id":"<id>"}\`. |
-| \`rost_list_a_cascade_goals_signals\` | \`goal.list_measurables\` | List the goal's status-driving Signal binding (role drives_status; 0-or-1 per goal) with its current indicator and latest confirmed reading. Driver-only \u2014 informs bindings (direct indicators) are not returned. Read-only. | Seat or tenant-admin | Call with \`{"goal_id":"<id>"}\`. |
+| \`rost_list_a_cascade_goals_signals\` | \`goal.list_measurables\` | List a goal's Signal bindings, split by role. \`bindings\` is the status-driving Signal (role drives_status; 0-or-1 per goal) with its current indicator and latest confirmed reading; \`informs_bindings\` is the informative indicators (role informs; many per goal), which never drive status. A Signal bound to a company objective is always informs, so it appears under \`informs_bindings\`. Read-only. | Seat or tenant-admin | Call with \`{"goal_id":"<id>"}\`. |
 | \`rost_create_cascade_goal\` | \`goal.create\` | Create a Cascade goal. Default (no \`kind\`, or \`kind: "seat_goal"\`): a seat goal under an existing objective. \`kind: "company_objective"\` instead authors the Cascade ROOT. | Tenant; a company objective additionally requires an owner membership | Seat goal: call with cycle, seat, parent, title, definition of done, and an optional target date. Company objective: \`{"kind":"company_objective","cycle_id":"<id>","title":"\u2026","definition_of_done":"\u2026"}\` \u2014 pass NO \`seat_id\` and NO \`parent_goal_id\` (the root has neither; supplying either is rejected, not ignored). The anchor is resolved server-side, so there is no id to pass, and the tenant's active one_year horizon goal must already be set or the call fails with a precondition error. |
 | \`rost_update_cascade_goal\` | \`goal.update\` | Update a goal's title or definition of done. | Tenant | Call with \`goal_id\` and the changed fields (title, definition of done, or target date). |
 | \`rost_set_cascade_goal_status\` | \`goal.set_status\` | Set a goal's status (on/off/done). | Seat or tenant-admin | Seats may set only their own goals. |
@@ -59713,7 +59786,9 @@ Every notification should include the seat, cause, evidence, and requested decis
     // service (a foreground `runner serve` on the same state file authenticates
     // as the same runner id); runner health is reported as unattributed
     // information only. Server-observed, service-attributed readiness is DER-3322.
-    version: "2026-08-09.7",
+    // DER-3774: .8 names Settings > Connections > Connected machines and the
+    // working `/settings?section=runners` deep link (the previous Runners settings page 404s).
+    version: "2026-08-09.8",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -59741,7 +59816,7 @@ The local runner is for human-controlled local agent work. It should retrieve {{
 
 ## Install a local Runner
 
-Use Local Runner when a Seat should run on a machine you control. Install it from the public CLI \u2014 no repository checkout and no desktop app are required. A signed desktop app is planned; until verified installers ship, Settings > Runners shows no desktop download link.
+Use Local Runner when a Seat should run on a machine you control. Install it from the public CLI \u2014 no repository checkout and no desktop app are required. A signed desktop app is planned; until verified installers ship, Settings > Connections > Connected machines (\`/settings?section=runners\`) shows no desktop download link.
 
 Recommended paths:
 
@@ -59751,7 +59826,7 @@ Recommended paths:
 Two ways to authenticate and pair \u2014 both first-class, an agent can drive either entirely from the terminal:
 
 - **CLI-native (agent):** \`{{cli}} login --device\` prints a code for one human OAuth approval; after that the session is stored locally and the agent runs unattended ("approve once, then autonomous"). Then \`{{cli}} runner serve\`/\`install-service\` pairs against your active company \u2014 an authenticated CLI can also self-issue a pairing code with \`runner.pairing.start\` and claim it.
-- **Web-guided (human):** issue a pairing code from Settings > Runners > Add a Runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. An explicit user code always claims that code, even if the host has an older local runner state file, so the browser and terminal do not accidentally point at different runner ids. The host stores only the runner bearer secret in an owner-only file and never logs in.
+- **Web-guided (human):** issue a pairing code from Settings > Connections > Connected machines (\`/settings?section=runners\`) > Add a runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. An explicit user code always claims that code, even if the host has an older local runner state file, so the browser and terminal do not accidentally point at different runner ids. The host stores only the runner bearer secret in an owner-only file and never logs in.
 
 Headless and service accounts are supported first-class: when no usable OS keychain exists (for example a service or SSH account), the CLI stores the session in an owner-only file (directory 0700, file 0600) automatically \u2014 no development flag. That file holds only the CLI session token, never tenant secrets, API keys, or vault refs.
 
@@ -69629,7 +69704,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
     userCode = await startPairing(client, config2);
   } else {
     throw new Error(
-      `No paired runner state at ${config2.stateFile}. Provide --user-code <code> from Settings > Runners (Add a runner), or run \`${cliBrand.binName} login --device\` once to pair this runner.`
+      `No paired runner state at ${config2.stateFile}. Provide --user-code <code> from Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}), or run \`${cliBrand.binName} login --device\` once to pair this runner.`
     );
   }
   const serviceKey = runnerServiceKeyPairForState(priorState);
@@ -72647,7 +72722,7 @@ async function installService(options) {
 ` : `Loaded runner service in launchd domain ${result.domain}.
 `
   );
-  const pairingLine = options.userCode !== void 0 ? `Paired with the supplied user code; the bearer secret is stored locally and never printed.` : `Pair it once so it can claim work: \`${cliBrand.binName} runner serve --once --user-code <code> --name ${safeName} --state-file "${paths.stateFile}"\` (get a code from Settings > Runners), or re-run install-service with --user-code <code>. The bearer secret is stored locally and never printed.`;
+  const pairingLine = options.userCode !== void 0 ? `Paired with the supplied user code; the bearer secret is stored locally and never printed.` : `Pair it once so it can claim work: \`${cliBrand.binName} runner serve --once --user-code <code> --name ${safeName} --state-file "${paths.stateFile}"\` (get a code from Settings > Connections > Connected machines (${appUrlLink(options.appUrl, "settings?section=runners")})), or re-run install-service with --user-code <code>. The bearer secret is stored locally and never printed.`;
   options.io.stdout.write(
     `${[
       `Installed runner service ${label}.`,
@@ -73630,7 +73705,7 @@ async function runRunnerLogin(options) {
     const state = await loadState(resolvedStateFile);
     if (state === null || typeof state.runner_id !== "string") {
       io.stderr.write(
-        `No paired runner state at ${resolvedStateFile}. Pair this runner first (Settings > Runners, or \`${cliBrand.binName} runner serve --user-code <code>\`).
+        `No paired runner state at ${resolvedStateFile}. Pair this runner first (Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}), or \`${cliBrand.binName} runner serve --user-code <code>\`).
 `
       );
       return 1;
@@ -76000,7 +76075,7 @@ async function runStart2(options) {
       };
       return finishVerb("start", options, parsed, sidecar.setup_id, progress, null);
     }
-    return renderError(io, parsed.json, "start", 1, "No paired runner state found. Provide --user-code <code> from Settings > Runners.");
+    return renderError(io, parsed.json, "start", 1, `No paired runner state found. Provide --user-code <code> from Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}).`);
   }
   if (advance.kind === "claim_failed" || advance.kind === "login_failed") {
     return renderError(io, parsed.json, "start", advance.exitCode, advance.message ?? "");
@@ -76215,7 +76290,7 @@ async function runResume(options) {
     expectedTenantId ?? void 0
   );
   if (advance.kind === "needs_user_code") {
-    return renderError(io, parsed.json, "resume", 1, "No paired runner state found. Provide --user-code <code> from Settings > Runners.");
+    return renderError(io, parsed.json, "resume", 1, `No paired runner state found. Provide --user-code <code> from Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}).`);
   }
   if (advance.kind === "claim_failed" || advance.kind === "login_failed") {
     return renderError(io, parsed.json, "resume", advance.exitCode, advance.message ?? "");