@rosthq/cli 0.7.19 → 0.7.21

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAoN3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAqN3D,CAAC"}

package/dist/index.js

@@ -37741,7 +37741,7 @@ var dryRunTranscriptSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/scrub.ts
-var SECRET_SHAPED_VALUE = /(sk-ant-|sk-proj-|sk-live-|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
+var SECRET_SHAPED_VALUE = /(sk-ant-|sk-proj-|sk-live-|sk-[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|BEGIN [A-Z ]*PRIVATE KEY|api[_-]?key\s*=|secret\s*=|password\s*=|authorization:\s*bearer\s+|x-api-key\s*:|api[-_ ]?key\s*:\s*\S{3,}|secret\s*:\s*\S{3,}|password\s*:\s*\S{3,}|token\s*:\s*\S{3,})/i;
 var SECRET_KEY = /(api[_-]?key|secret|password|token|authorization|credential|private[_-]?key)/i;
 function hasSecretShapedContent(value) {
   if (typeof value === "string") {
@@ -38895,6 +38895,21 @@ var aicosSessionSchema = external_exports.object({
   updatedAt: external_exports.string().datetime({ offset: true }),
   createdAt: external_exports.string().datetime({ offset: true })
 }).strict();
+var AICOS_ATTACHMENT_CONTENT_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+var AICOS_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var AICOS_MAX_ATTACHMENTS_PER_TURN = 4;
+var aicosAttachmentContentTypeSchema = external_exports.enum(AICOS_ATTACHMENT_CONTENT_TYPES);
+var aicosAttachmentSchema = external_exports.object({
+  id: uuidSchema4,
+  contentType: aicosAttachmentContentTypeSchema,
+  sizeBytes: external_exports.number().int().positive(),
+  width: external_exports.number().int().positive().nullable(),
+  height: external_exports.number().int().positive().nullable(),
+  filename: external_exports.string().max(255).nullable()
+}).strict();
+var aicosAttachmentUploadResultSchema = external_exports.object({
+  attachment: aicosAttachmentSchema
+}).strict();
 var aicosMessageSchema = external_exports.object({
   id: uuidSchema4,
   sessionId: uuidSchema4,
@@ -38907,6 +38922,7 @@ var aicosMessageSchema = external_exports.object({
   linkedRunId: uuidSchema4.nullable(),
   linkedWorkOrderId: uuidSchema4.nullable(),
   sourceCount: external_exports.number().int().nonnegative().default(0),
+  attachments: external_exports.array(aicosAttachmentSchema).default([]),
   createdAt: external_exports.string().datetime({ offset: true })
 }).strict();
 var aicosSourceSchema = external_exports.object({
@@ -38922,10 +38938,19 @@ var aicosSourceSchema = external_exports.object({
 var aicosTurnRequestSchema = external_exports.object({
   sessionId: uuidSchema4.nullable().optional(),
   purpose: aicosConversationPurposeSchema.default("general"),
-  message: external_exports.string().trim().min(1).max(12e3),
+  // Empty is permitted only when attachments are present (an image-only turn);
+  // runAicosTurn enforces the "message or attachment required" invariant so the
+  // schema stays a plain object for downstream `.shape`/`.extend` consumers.
+  message: external_exports.string().trim().max(12e3).default(""),
+  attachmentIds: external_exports.array(uuidSchema4).max(AICOS_MAX_ATTACHMENTS_PER_TURN).default([]),
   routeContext: aicosRouteContextSchema,
   model: aicosModelRequestSchema.optional()
 }).strict();
+var aicosNavigationTargetSchema = external_exports.object({
+  href: external_exports.string().trim().min(1).max(500),
+  label: external_exports.string().trim().min(1).max(180),
+  consentRequired: external_exports.literal(true)
+}).strict();
 var aicosTurnResultSchema = external_exports.object({
   session: aicosSessionSchema,
   messages: external_exports.array(aicosMessageSchema),
@@ -38933,6 +38958,7 @@ var aicosTurnResultSchema = external_exports.object({
   executionBackend: aicosLaneSchema,
   status: aicosTurnStatusSchema,
   pendingTurn: aicosPendingTurnSchema.nullable().default(null),
+  navigation: aicosNavigationTargetSchema.nullable().default(null),
   userVisibleNextStep: external_exports.string().min(1),
   capabilitySnapshot: aicosCapabilitySnapshotSchema,
   context: aicosContextSummarySchema.optional()
@@ -42216,19 +42242,35 @@ var softwareProjectSummarySchema = external_exports.object({
   base_branch: external_exports.string().min(1),
   repo_ref: external_exports.string().nullable()
 });
+var softwareProjectCreateInputSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(200).refine((value) => !hasSecretShapedValue(value), {
+    message: "project name must not contain raw secret material"
+  }),
+  slug: external_exports.string().trim().regex(/^[a-z0-9][a-z0-9-]{0,62}$/).refine((value) => !hasSecretShapedValue(value), {
+    message: "slug must not contain raw secret material"
+  }).optional(),
+  base_branch: external_exports.string().trim().min(1).max(255).refine((value) => !hasSecretShapedValue(value), {
+    message: "base_branch must not contain raw secret material"
+  }).default("main"),
+  repo_ref: external_exports.string().trim().min(1).max(255).refine((value) => !hasSecretShapedValue(value), {
+    message: "repo_ref must be repository metadata, never raw secret material"
+  }).optional()
+}).strict();
+var softwareProjectCreateOutputSchema = external_exports.object({
+  project: softwareProjectSummarySchema
+});
 var softwareProjectListInputSchema = external_exports.object({}).strict();
 var softwareProjectListOutputSchema = external_exports.object({
   projects: external_exports.array(softwareProjectSummarySchema)
 });
 var VAULT_REF_PROVIDER = /^(?:infisical|doppler|local-dev):\/\/\S+$/;
-var RAW_SECRET_SUBSTRING = /sk-ant-|sk-proj-|sk-live-|BEGIN |PRIVATE KEY|api[_-]?key=|secret=/i;
-var softwareVaultRefSchema = external_exports.string().min(1).max(500).regex(VAULT_REF_PROVIDER, "vault_ref must be a provider URI, e.g. infisical://path, doppler://path, or local-dev://path").refine((value) => !RAW_SECRET_SUBSTRING.test(value), {
+var softwareVaultRefSchema = external_exports.string().min(1).max(500).regex(VAULT_REF_PROVIDER, "vault_ref must be a provider URI, e.g. infisical://path, doppler://path, or local-dev://path").refine((value) => !hasSecretShapedValue(value), {
   message: "vault_ref must be a pointer, never raw secret material"
 });
-var softwareSecretKeyNameSchema = external_exports.string().trim().min(1).max(200).refine((value) => !RAW_SECRET_SUBSTRING.test(value), {
+var softwareSecretKeyNameSchema = external_exports.string().trim().min(1).max(200).refine((value) => !hasSecretShapedValue(value), {
   message: "key_name must be a config key name, never raw secret material"
 });
-var softwareSecretActionSchema = external_exports.string().trim().min(1).max(120).refine((value) => !RAW_SECRET_SUBSTRING.test(value), {
+var softwareSecretActionSchema = external_exports.string().trim().min(1).max(120).refine((value) => !hasSecretShapedValue(value), {
   message: "action must be an action verb, never raw secret material"
 });
 var softwareTerminationBoundSchema = external_exports.object({
@@ -42470,7 +42512,7 @@ var softwareConfigSetInputSchema = external_exports.object({
     if (!value.plain_value || value.vault_ref !== void 0) {
       context.addIssue({ code: "custom", message: "plain config requires plain_value and no vault_ref" });
     }
-    if (value.plain_value && RAW_SECRET_SUBSTRING.test(value.plain_value)) {
+    if (value.plain_value && hasSecretShapedValue(value.plain_value)) {
       context.addIssue({ code: "custom", message: "plain_value must never contain secret material" });
     }
   }
@@ -42530,7 +42572,15 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // rejects (→ "Command input failed schema validation"). Matches the sibling
   // software-factory schemas that already use `.nullable().optional()`.
   software_project_id: uuid10.nullable().optional(),
-  assign_skills: external_exports.boolean().default(true)
+  assign_skills: external_exports.boolean().default(true),
+  // DER-1264: the install auto-staffs live agents at a pr_only, observe-first
+  // posture. If the tenant's company autonomy ceiling (`agent_policy`) is MORE
+  // permissive than this design's envelope (resolved `max_autonomous_risk` >= high,
+  // i.e. `high_autonomy` or a custom high/critical ceiling), the install refuses to
+  // auto-activate unless the owner explicitly acknowledges that posture. Never
+  // silently inherit a more-permissive-than-designed ceiling (invariant #10). A
+  // tenant within the envelope (locked_down/balanced) never needs this.
+  acknowledge_autonomy_ceiling: external_exports.boolean().default(false)
 }).strict();
 var softwareDeveloperTeamSeatSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
@@ -42558,12 +42608,45 @@ var softwareDeveloperTeamAuthorityGrantSummarySchema = external_exports.object({
   grant_id: uuid10,
   created: external_exports.boolean()
 });
+var softwareDeveloperTeamOccupancySummarySchema = external_exports.object({
+  role: softwareDeveloperTeamRoleSchema,
+  seat_id: uuid10,
+  agent_id: uuid10,
+  template_slug: external_exports.string(),
+  status: external_exports.literal("live"),
+  // false when a live agent already occupied the seat (idempotent re-install).
+  created: external_exports.boolean()
+});
+var softwareDeveloperTeamAgentPolicySummarySchema = external_exports.object({
+  profile: agentPolicyProfileSchema,
+  enforcement: agentPolicyEnforcementSchema,
+  max_autonomous_risk: autonomousRiskLevelSchema,
+  // true when the resolved ceiling is more permissive than this design's envelope
+  // (max_autonomous_risk >= high) and the owner acknowledged it to activate.
+  more_permissive_than_envelope: external_exports.boolean()
+});
+var softwareDeveloperTeamTokenBudgetSummarySchema = external_exports.object({
+  hard_cap_usd: external_exports.string().nullable(),
+  soft_cap_usd: external_exports.string().nullable(),
+  set_by_install: external_exports.boolean()
+});
+var softwareDeveloperTeamGithubPolicySummarySchema = external_exports.object({
+  software_project_id: uuid10,
+  automation_mode_ceiling: softwareAutomationModeSchema,
+  // false when a pre-existing policy was preserved (not created by this install).
+  created: external_exports.boolean()
+});
 var softwareDeveloperTeamInstallOutputSchema = external_exports.object({
   installed: external_exports.boolean(),
   seats: external_exports.array(softwareDeveloperTeamSeatSummarySchema),
   skills: external_exports.array(softwareDeveloperTeamSkillSummarySchema),
   authority_profiles: external_exports.array(softwareDeveloperTeamAuthorityProfileSummarySchema),
-  authority_grants: external_exports.array(softwareDeveloperTeamAuthorityGrantSummarySchema)
+  authority_grants: external_exports.array(softwareDeveloperTeamAuthorityGrantSummarySchema),
+  // DER-1264 auto-staffing additions.
+  occupancies: external_exports.array(softwareDeveloperTeamOccupancySummarySchema),
+  agent_policy: softwareDeveloperTeamAgentPolicySummarySchema,
+  token_budget: softwareDeveloperTeamTokenBudgetSummarySchema,
+  github_policy: softwareDeveloperTeamGithubPolicySummarySchema.nullable()
 });
 var forgeArtifactText = external_exports.string().trim().min(1).max(4e3);
 var forgeArtifactList = external_exports.array(forgeArtifactText).max(50).default([]);
@@ -43511,7 +43594,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-04.8",
+    version: "2026-07-04.11",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -43569,7 +43652,9 @@ AICOS also has an explicit brain selection. Cloud can use the included managed a
 
 Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from scheduled work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same scheduled-work slot. Scheduled and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. The runner treats that loaded tenant clock and context as authoritative instead of substituting its own runtime clock or local files. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
 
-When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
+When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If the runner answer includes a validated in-app link, the web panel can surface the same consent-required navigation suggestion once polling sees that the pending turn is terminal. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
+
+While a runner turn is queued, claimed, or running, the chat panel keeps showing the pending state and polls the session until the answer or terminal status arrives. The composer, model picker, and lane picker are disabled during that active turn so a second browser tab or direct API call cannot overlap another runner turn in the same thread. Terminal runner statuses such as failed, offline, or canceled stay visible only while they are still the latest user turn; if the user continues the conversation in another lane, the stale terminal marker is no longer projected at the bottom of the thread.
 
 MCP mode uses the existing tenant-authorized MCP surfaces. It requires an active seat-scoped MCP token for the AICOS seat and does not grant hidden tenant-admin access or run browser-side MCP tool calls. Users operate MCP AICOS from their authorized agent interface; the web chat remains the same readable thread surface.
 
@@ -43577,6 +43662,8 @@ Model behavior is now explicit in the AICOS session contract. A thread can run i
 
 Assistant answers render safe Markdown for headings, short lists, emphasis, code, tables, and in-app links. User messages remain plain escaped text. Links only become clickable when they target same-origin app routes such as \`/inbox\` or \`/settings\`; external, protocol, script, API-style, or traversal targets are stripped to plain text before transcript storage. When an answer includes a validated app route, the chat can surface one consent-required navigation suggestion and, if the user has enabled the local preference, open that route automatically. Navigation is never authorization; destination pages still enforce their own tenant, role, and seat checks.
 
+You can attach images to a message from the composer. {{brand}} accepts PNG, JPEG, WebP, and GIF up to 10 MB each, and up to four per message. Images are held in a tenant-scoped private store, stripped of embedded metadata such as EXIF on upload, and shown as thumbnails in your message; the panel loads each thumbnail through a short-lived signed link rather than a public URL. In the cloud lane the agent can view the image directly. Runner and MCP viewing of attached images is a scoped follow-up; today the agent still reads the accompanying text on those lanes.
+
 AICOS can also retrieve bounded summaries from prior sessions owned by the same tenant user and surface them as session-memory read models. Setup-limited users do not retrieve sensitive historical run or company-memory summaries through this path. This is a practical memory seam for AICOS continuity; it is not yet the future Company Brain, and it does not make unaccepted knowledge authoritative.
 
 Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
@@ -44392,7 +44479,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-03.15",
+    version: "2026-07-04.11",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -44869,6 +44956,7 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
 | \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
 | \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
+| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\` | Create/list Forge projects and open/read governed Forge build requests. Project creation is tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. | Tenant / Tenant-admin for create | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --software-project-id <id> --title "Add invoice export"\` |
 
 Skills wrapper help:
 
@@ -45108,6 +45196,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_skill_to_seat\` | \`skill.assign_to_seat\` | Propose or human-approve a published Skill version for a Seat after dependency checks. Missing required tools block approval; optional tools warn. | Tenant-admin | Call with \`{"seat_id":"<seat-id>","slug":"invoice-review","status":"proposed","rationale":"Use for AP exception work."}\`. |
 | \`rost_revoke_skill_from_seat\` | \`skill.revoke_from_seat\` | Human-gated revocation that stops future Skill use without deleting historical activations. | Tenant-admin | Call with \`{"assignment_id":"<assignment-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
+| \`rost_create_a_forge_project\` | \`software_factory.project.create\` | Create an active Forge software project before binding repositories or opening build requests. Tenant-admin, human-gated, and entitlement-gated. | Tenant-admin | Call with \`{"name":"Leiluna app","slug":"leiluna-app","base_branch":"main"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"software_project_id":"<project-id>","title":"Add invoice export"}\`. |
 | \`rost_list_forge_projects\` | \`software_factory.project.list\` | List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. | Tenant | Call with \`{}\`; use the returned \`id\` as \`software_project_id\`. |
 | \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, and risk. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
@@ -45118,7 +45207,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_a_forge_authority_profile\` | \`software_factory.authority_profile.create\` | Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset. | Tenant-admin | Call with \`{"name":"Builder","preset":"contributor"}\`. |
 | \`rost_grant_forge_seat_authority\` | \`software_factory.authority.grant\` | Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only and human-gated; emits a durable authority-change event. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","seat_id":"<seat-id>","authority_profile_id":"<profile-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_revoke_forge_seat_authority\` | \`software_factory.authority.revoke\` | Revoke a Forge authority grant (teardown). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install the governed Forge Developer Team template: Forge Lead, Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Entitlement-gated and human-gated; it creates no live agent occupancy by itself. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the template installs tenant-wide either way). Non-interactive callers receive a confirmation handoff. |
+| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install AND activate the governed Forge Developer Team: Forge Lead (human) plus Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Approving ALSO auto-staffs the 6 agent seats as live occupancies at a pull-request-only, observe-first posture (open pull requests, never merge/deploy without a human), steward-chained to the human lead, each with a signed manifest + passed sandbox dry-run; it sets a conservative default token budget (only if none) and, for a supplied project, a default pr_only GitHub automation policy (only if none \u2014 never widening a stricter one). Entitlement-gated and human-gated. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the team installs tenant-wide either way). If the company autonomy ceiling is more permissive than the observe-first envelope, add \`{"acknowledge_autonomy_ceiling":true}\` to activate. Non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_config\` | \`software_factory.config.list\` | List active Forge configuration entries. Plain values may be returned only when they passed the non-secret guard; secret refs appear as metadata and never include the ref value. | Tenant | Call with \`{}\` or \`{"software_project_id":"<project-id>","environment":"preview"}\`. |
 | \`rost_set_forge_config\` | \`software_factory.config.set\` | Human-gated config create/rotation for plain values or secret refs. Secret refs store only a vault pointer and raw secret-shaped plain values are rejected. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"preview","key_name":"PUBLIC_BASE_URL","value_kind":"plain","plain_value":"https://preview.example.com"}\`. |
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
@@ -45128,7 +45217,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_a_forge_github_installation_token\` | \`software_factory.github.installation_token.create\` | Mint a short-lived GitHub App installation token for one bound repository after policy evaluation. The token is returned once and never stored. | Tenant | Call with \`{"software_project_id":"<project-id>","repository_id":789,"requested_actions":["read"],"requested_automation_mode":"plan_only"}\`. |
 | \`rost_list_forge_runner_capacity\` | \`software_factory.capacity.list\` | List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"runner_id":"<runner-id>"}\`. |
 
-The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, runner capacity, configuration status, and Developer Team template install. The template install button deliberately stages a pending confirmation before durable seats, Skills, or authority grants are applied.
+The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, runner capacity, configuration status, and Developer Team install. The install button deliberately stages a pending confirmation before durable seats, Skills, authority grants, or live agent activation are applied; the install page states plainly that approving activates the 6 agents at a pull-request-only, observe-first posture and surfaces the company autonomy ceiling.
 
 #### Forge GitHub App access
 
@@ -45720,7 +45809,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-02.4",
+    version: "2026-07-04.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -45776,7 +45865,7 @@ Avoid vanity numbers, manual-only status fields, and metrics nobody can act on.
 
 - Read: \`{{cli}} signal list --json\` / \`signal.list\` / \`rost_list_signals\` returns measurables with their latest reading and on/off-track state. \`signal.get\` / \`rost_get_signal\` returns one measurable's full reading history.
 - Add a measurable: \`measurable.create\` (scope: seat) defines a measurable a seat owns \u2014 name, unit, direction, target, cadence. The seat owns it; readings attach to it afterward.
-- Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated.
+- Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated. An agent's \`status.record\` never downgrades a human-confirmed reading: a routine agent read that lands on a period a human already confirmed leaves the confirmed value and its confirmation intact (invariants #7/#8 \u2014 agents recommend; humans decide).
 - Confirm a reading: \`{{cli}} signal confirm\` / \`signal.confirm_reading\` / \`rost_confirm_signal_reading\` marks a reading human-verified. \`signal.correct_reading\` / \`rost_correct_signal_reading\` overwrites a reading with a human-confirmed value.
 
 ## Run Signal without an agent
@@ -48308,12 +48397,13 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.capacity.list", "namespace": "software_factory", "action": "capacity.list", "title": "List Forge runner capacity", "description": "List the tenant's Forge runner capacity observations (OS, CPU, memory, active sessions, usage-limit telemetry). Advisory scheduling input only, never an authority input. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on." },
   { "id": "software_factory.config.list", "namespace": "software_factory", "action": "config.list", "title": "List Forge config", "description": "List active Forge config metadata for project environments. Plain config values may be returned; secret refs are represented only as has_secret_ref.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "environment", "flag": "environment", "type": "enum", "required": false, "enumValues": ["development", "preview", "production"] }], "hasComplexInput": false, "help": "List active Forge config entries. Plain config may be shown; secret refs are represented only as metadata." },
   { "id": "software_factory.config.set", "namespace": "software_factory", "action": "config.set", "title": "Set Forge config", "description": "Create or rotate a Forge project config entry. Secret config stores only a vault ref pointer; raw values are never accepted for secret_ref entries.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "value_kind", "flag": "value-kind", "type": "enum", "required": true, "enumValues": ["plain", "secret_ref"] }, { "name": "plain_value", "flag": "plain-value", "type": "string", "required": false }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Set or rotate a Forge project config key. Secret entries store only vault refs and are human-gated." },
-  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install the governed Forge Developer Team template: seats, draft Charters, first-party skill assignments, and authority presets. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
+  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
   { "id": "software_factory.gate.decide", "namespace": "software_factory", "action": "gate.decide", "title": "Decide a Forge gate", "description": "A human approves or rejects a Forge gate. The resolver is recorded (never an agent \u2014 invariant #7); sensitive gates (security sign-off, merge/deploy, authority change, production deploy) also write a linked human decision. Requires confirmation.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "gate_id", "flag": "gate-id", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves or rejects a Forge gate; an agent caller routes to /approvals and can never self-approve. Sensitive gates record a human decision." },
   { "id": "software_factory.github.installation_token.create", "namespace": "software_factory", "action": "github.installation_token.create", "title": "Create a Forge GitHub installation token", "description": "Mint a short-lived GitHub App installation token for one bound repository after server-side policy evaluation. The token is returned once and never persisted.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "requested_actions", "flag": "requested-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requested_automation_mode", "flag": "requested-automation-mode", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Mint a short-lived GitHub App installation token for one bound repository after policy evaluation; token material is returned once and never stored." },
   { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind a Forge GitHub installation", "description": "Bind a GitHub App installation and selected repositories to Forge projects from the authenticated Forge GitHub settings flow. Owner-only and human-gated; webhook payloads never supply tenant authority.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "account_login", "flag": "account-login", "type": "string", "required": true }, { "name": "account_id", "flag": "account-id", "type": "integer", "required": true }, { "name": "account_type", "flag": "account-type", "type": "string", "required": true }], "hasComplexInput": true, "help": "Bind a GitHub App installation and selected repositories to Forge projects from the authenticated Forge GitHub settings flow. Owner-only and human-gated." },
   { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
   { "id": "software_factory.phase.advance", "namespace": "software_factory", "action": "phase.advance", "title": "Advance a Forge build request phase", "description": "Advance a build request to the next phase, enforcing the closed phase state machine server-side (an illegal transition is rejected). Writes a phase-run row and updates the current phase. Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "to_phase", "flag": "to-phase", "type": "enum", "required": true, "enumValues": ["intake", "discovery_scoping", "plan_review", "implementation", "plan_conformance_review", "security_review", "qa_verification", "release_preview", "merge_or_deploy_gate", "closeout"] }, { "name": "owning_seat_id", "flag": "owning-seat-id", "type": "string", "required": false }, { "name": "note", "flag": "note", "type": "string", "required": false }], "hasComplexInput": false, "help": "Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition." },
+  { "id": "software_factory.project.create", "namespace": "software_factory", "action": "project.create", "title": "Create a Forge project", "description": "Create an active Forge software project before binding repositories or opening build requests. Tenant-admin, human-gated, and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "name", "flag": "name", "type": "string", "required": true }, { "name": "slug", "flag": "slug", "type": "string", "required": false }, { "name": "base_branch", "flag": "base-branch", "type": "string", "required": false }, { "name": "repo_ref", "flag": "repo-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create an active Forge software project before binding repositories or opening build requests. Tenant-admin and human-gated; requires the Forge add-on." },
   { "id": "software_factory.project.list", "namespace": "software_factory", "action": "project.list", "title": "List Forge projects", "description": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only and entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
   { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
@@ -50144,6 +50234,7 @@ function operationUsageLines(bin) {
     // Local runner service lifecycle (DER-1142). The orchestrator mirrors this
     // exact line into the mcp-and-cli-guide so the help/guide parity gate passes.
     `${bin} runner install-service|start|stop|restart|status|logs|uninstall --name <name>`,
+    `${bin} forge project-create|project-list|request-create|request-list|request-show`,
     `${bin} notification settings|test|errors`,
     `${bin} settings get|update|product-learning|agent-policy|rename`,
     `${bin} member invite|update|remove`,