@rosthq/cli 0.7.2 → 0.7.4

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EA4L3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAyM3D,CAAC"}

package/dist/index.js

@@ -27881,6 +27881,14 @@ var BRAND = {
 };
 var brandSlug = slug(BRAND.name);
 var defaultPackageScope = `@${brandSlug}hq`;
+var RSF_ADDON_BRAND = {
+  internalKey: "software_factory",
+  displayName: process.env.NEXT_PUBLIC_RSF_ADDON_NAME ?? "Forge",
+  shortName: process.env.NEXT_PUBLIC_RSF_ADDON_SHORT_NAME ?? "Forge",
+  categoryLabel: "Developer-agent team",
+  cliGroup: process.env.NEXT_PUBLIC_RSF_CLI_GROUP ?? "forge",
+  routeSegment: process.env.NEXT_PUBLIC_RSF_ROUTE_SEGMENT ?? "forge"
+};
 var BRAND_DISTRIBUTION = {
   cliBinName: process.env.NEXT_PUBLIC_CLI_BIN_NAME ?? brandSlug,
   cliPackageScope: process.env.NEXT_PUBLIC_CLI_NPM_SCOPE ?? defaultPackageScope,
@@ -41877,7 +41885,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-02.6",
+    version: "2026-07-02.9",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -41912,10 +41920,10 @@ In the authenticated app shell, AICOS opens from the floating assistant control.
 Each thread has a purpose:
 
 - **Onboarding** \u2014 setup help and page-aware setup context.
-- **Seat** \u2014 seat and agent setup context.
+- **Seat** \u2014 a seat-scoped assistant pinned to one seat (see "Seat-scoped AICOS" below).
 - **General** \u2014 company operating help.
 
-You can reopen prior threads or start a new one. Session history is stored in tenant-scoped conversation tables so chat history is not reconstructed from analytics, events, or run logs.
+You can reopen prior threads, search thread titles and summaries, or start a new one. Session history is stored in tenant-scoped conversation tables so chat history is not reconstructed from analytics, events, or run logs.
 
 ## What context AICOS receives
 
@@ -41927,19 +41935,38 @@ Runner mode uses the same AICOS sessions and transcript. A web turn in runner mo
 
 MCP mode uses the existing tenant-authorized MCP surfaces. It requires an active seat-scoped MCP token for the AICOS seat and does not grant hidden tenant-admin access or run browser-side MCP tool calls. Users operate MCP AICOS from their authorized agent interface; the web chat remains the same readable thread surface.
 
-Model behavior is now explicit in the AICOS session contract. A thread can run in **Auto** or use a pinned compatible model from the guided catalog. Auto chooses a fast tier for short low-risk turns, the balanced default for normal operating help, and a higher-reasoning tier for onboarding synthesis or large context. The panel shows the effective model, disables lower-context choices once the active thread outgrows them, and tells the user to start a new session for those models. Session context is estimated and compacted into a durable summary when it crosses the configured threshold; raw messages remain in history, but future model calls can use the summary rather than resending the whole thread. Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
+Model behavior is now explicit in the AICOS session contract. A thread can run in **Auto** or use a pinned compatible model from the guided catalog. Auto chooses a fast tier for short low-risk turns, the balanced default for normal operating help, and a higher-reasoning tier for onboarding synthesis or large context. The panel shows the effective model, disables lower-context choices once the active thread outgrows them, and tells the user to start a new session for those models. Session context is estimated and maintained as a bounded rolling summary for memory search; when the thread crosses the configured threshold, that summary becomes the compacted context for future model calls rather than resending the whole thread. Raw messages remain in history. Summaries preserve durable decision cues, open questions, linked artifacts or objects, and unresolved setup facts where the transcript contains them.
+
+AICOS can also retrieve bounded summaries from prior sessions owned by the same tenant user and surface them as session-memory read models. Setup-limited users do not retrieve sensitive historical run or company-memory summaries through this path. This is a practical memory seam for AICOS continuity; it is not yet the future Company Brain, and it does not make unaccepted knowledge authoritative.
+
+Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
 
 During onboarding, the deterministic harness may execute only explicit low-risk draft actions. In the Responsibility Graph step, a user with setup/action authority can ask AICOS to create one named draft seat per turn; the seat stays vacant, is traceable to the AICOS message through artifact sources, and still needs human review before staffing, Charters, manifests, or go-live. Compass and Charter help remains draft guidance and clarifying questions until the live drafting planner lands. AICOS never silently finishes onboarding, approves Compass or Charter content, signs manifests, goes live, stores credentials, changes autonomy policy, or invites external people; those actions remain human-confirmed.
 
 AICOS posture is resolved on the server from the current user's AICOS access scope plus the tenant's Company guardrails. **Report-only** can read, explain, and draft guidance, but it cannot mutate setup or operating state. **Balanced** can perform narrow low-risk internal draft/setup actions and stops at human gates. **High autonomy** can perform allowed internal low-risk actions without changing the hard prohibitions: AICOS still cannot approve its own Charter or manifest, handle credentials, send externally, spend money, perform destructive/admin changes, go live, expand policy/access, or receive hidden sensitive data.
 
-AICOS grounds answers from two source classes before producing user-visible setup or operating guidance:
+## Seat-scoped AICOS
+
+From a seat page you can open **AICOS scoped to that seat** ("Ask AICOS about this seat"). A seat session is pinned to one seat and reads only that seat plus the seats it directly stewards \u2014 what needs attention there, what is blocked, and which tasks, Friction, Signals, goals, or approvals need action. The chat header shows **Seat: <name>** so it is always clear whether you are talking to Company AICOS or a Seat AICOS.
+
+Seat mode is the **intersection** of your access scope and one seat, never an escalation: it can only ever show a narrower slice than your company or own-scope session, and it can never reach data your base scope would already deny. The seat is resolved from the session (pinned when it was opened), re-authorized on the server every turn against your current occupancies and stewardship \u2014 a manually supplied seat id in a turn is ignored, a seat from another tenant or one you are not authorized over is indistinguishable from not-found, and if your occupancy or stewardship ends the session falls back to your base scope rather than widening. Setup-limited access does not get seat operating data. Drafted seat actions stay scoped to the session's seat and remain human-gated where required.
+
+AICOS grounds answers from three source classes before producing user-visible setup or operating guidance:
 
 - **Reference documents** \u2014 public {{brand}} guides such as this chat guide, onboarding guidance, the Responsibility Graph playbook, tool-access guidance, and confirmation guidance. AICOS retrieves the narrowest relevant guide before setup, Charter, Signal, Friction, Cascade, Sync, tool-access, or onboarding advice.
 - **Tenant read models** \u2014 bounded summaries of tenant operating state, including onboarding status, graph/setup readiness, Compass/Charter readiness, operating health, agent/system health, approvals/inbox, and selected Seat context. These read models expose counts and short observations rather than raw database dumps.
+- **Session memory** \u2014 bounded summaries from prior AICOS sessions for the same authorized user, filtered by scope and sensitivity.
 
 Assistant messages can carry source counts and persisted source metadata so a thread can later show which reference docs or read models informed the answer.
 
+## Proactive pulse panels
+
+AICOS does not wait to be asked. Opening the panel shows a **Pulse** view first, with deterministic, structured panels built directly from tenant read models \u2014 never generated prose \u2014 so nothing is invented: setup gaps, top recommended actions, pending confirmations, agent and run health, Friction and task bottlenecks, Signal and goal exceptions, and recent meaningful changes. Every item cites and links its source object (a Friction item, a pending confirmation, a Seat, a Signal, a goal) so the user can go straight to the record instead of trusting a summary. A **Chat** tab switches to the normal thread view; starting or continuing a thread also switches there.
+
+Pulse panels follow the same scope boundary as everything else AICOS reads. A setup-limited implementer sees setup gaps and its own seat-authorized pending confirmations only \u2014 never agent/run health, tenant-wide Friction or task bottlenecks, Signal or goal exceptions, or the recent-change feed. An own-scope user sees a slice limited to the Seats it occupies or directly stewards. Company-scope users see the tenant-wide picture. Pending confirmations reuse the exact same per-user Seat authority the Approvals queue already enforces, so this panel can never show more than that user could already see there.
+
+Clicking "Ask AICOS" on a panel item prefills the chat composer with a suggested message and switches to the Chat tab; it does not send anything on its own and does not call a command directly. The resulting turn still goes through the same draft/confirm/guard pipeline as any other AICOS message, so a high-risk fix still needs a human confirmation before anything durable happens.
+
 ## Governance boundary
 
 AICOS can preserve context and explain what it is ready to do, but durable operating changes still use the same {{brand}} controls:
@@ -42725,7 +42752,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-02.6",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -43250,8 +43277,8 @@ These read-only tools are available to any valid MCP token (like the reference t
 
 | Tool | Purpose | Scope | Safe example |
 |---|---|---|---|
-| \`rost_describe_command\` | Return a command's input/output JSON Schema, scope, confirmation gate, help pointer, guides, a validated example, and related commands. | Any valid MCP token | Query \`{"command_id":"compass.draft"}\` |
-| \`rost_list_commands\` | List every callable command id with its title, scope, confirmation, and stages. | Any valid MCP token | Call with \`{}\` |
+| \`rost_describe_command\` | Return a command's input/output JSON Schema, scope, confirmation gate, MCP tool name, help pointer, guides, a validated example, and related commands. | Any valid MCP token | Query \`{"command_id":"compass.draft"}\` |
+| \`rost_list_commands\` | List callable command ids in bounded pages with title, scope, confirmation, stages, and MCP tool name when callable. Supports \`q\`, \`category\`, \`stage\`, \`limit\`, and \`cursor\`. | Any valid MCP token | Query \`{"q":"status","limit":10}\` |
 
 The equivalent CLI verbs are \`{{cli}} command schema <id>\` and \`{{cli}} command list\`. The discoverable tool catalog is \`{{cli}} tools list\` (MCP \`rost_list_tool_catalog\`, tenant-scoped).
 
@@ -43260,7 +43287,7 @@ The equivalent CLI verbs are \`{{cli}} command schema <id>\` and \`{{cli}} comma
 | Tool or resource | Purpose | Scope | Safe example |
 |---|---|---|---|
 | \`rost_reference_search\` | Search public reference guides. | Any valid MCP token | Query \`{"query":"agent-reference-map","audience":"mcp"}\` |
-| \`rost_reference_get\` | Retrieve a public guide by slug. | Any valid MCP token | Query \`{"slug":"agent-reference-map"}\` |
+| \`rost_reference_get\` | Retrieve a bounded public guide payload by slug, or one requested section by section id/title. The response includes available \`sections\` for follow-up reads. | Any valid MCP token | Query \`{"slug":"agent-reference-map","section":"mcp-surfaces"}\` |
 | \`rost://reference/{slug}\` | Read a public reference guide as a resource. | Any valid MCP token | Resource \`rost://reference/mcp-and-cli-guide\` |
 
 ### Tenant-admin tools
@@ -43437,6 +43464,19 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_skill_to_seat\` | \`skill.assign_to_seat\` | Propose or human-approve a published Skill version for a Seat after dependency checks. Missing required tools block approval; optional tools warn. | Tenant-admin | Call with \`{"seat_id":"<seat-id>","slug":"invoice-review","status":"proposed","rationale":"Use for AP exception work."}\`. |
 | \`rost_revoke_skill_from_seat\` | \`skill.revoke_from_seat\` | Human-gated revocation that stops future Skill use without deleting historical activations. | Tenant-admin | Call with \`{"assignment_id":"<assignment-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
+| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"software_project_id":"<project-id>","title":"Add invoice export"}\`. |
+| \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, and risk. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
+| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, phase-run history, and gates. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
+| \`rost_advance_a_forge_build_request_phase\` | \`software_factory.phase.advance\` | Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition. | Tenant | Call with \`{"build_request_id":"<request-id>","to_phase":"discovery_scoping"}\`. |
+| \`rost_decide_a_forge_gate\` | \`software_factory.gate.decide\` | A human approves or rejects a Forge gate; an agent caller routes to \`/approvals\` and can never self-approve. Sensitive gates record a linked human decision. | Tenant | Call with \`{"gate_id":"<gate-id>","decision":"approve"}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_list_forge_authority_profiles\` | \`software_factory.authority_profile.list\` | List the tenant's Forge authority profiles (seat capability presets, read-only by default). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\`. |
+| \`rost_create_a_forge_authority_profile\` | \`software_factory.authority_profile.create\` | Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset. | Tenant-admin | Call with \`{"name":"Builder","preset":"contributor"}\`. |
+| \`rost_grant_forge_seat_authority\` | \`software_factory.authority.grant\` | Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only and human-gated; emits a durable authority-change event. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","seat_id":"<seat-id>","authority_profile_id":"<profile-id>"}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_revoke_forge_seat_authority\` | \`software_factory.authority.revoke\` | Revoke a Forge authority grant (teardown). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_request_a_forge_secret_grant\` | \`software_factory.secret.request\` | Request access to a project secret by key (draft-and-confirm \u2014 no value, no grant). Never accepts a secret value; a human grants it. | Tenant | Call with \`{"software_project_id":"<project-id>","environment":"preview","seat_id":"<seat-id>","action":"test.run","key_name":"OPENAI_API_KEY"}\`. |
+| \`rost_grant_a_forge_secret\` | \`software_factory.secret.grant\` | A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"production","seat_id":"<seat-id>","action":"vercel.env.sync","key_name":"OPENAI_API_KEY","vault_ref":"infisical://prod/OPENAI_API_KEY"}\`. |
+| \`rost_revoke_a_forge_secret_grant\` | \`software_factory.secret.revoke\` | Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_list_forge_runner_capacity\` | \`software_factory.capacity.list\` | List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"runner_id":"<runner-id>"}\`. |
 
 ### Seat-scoped operating tools
 
@@ -43775,7 +43815,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-07-02.3",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43811,7 +43851,7 @@ Use this map when you are a CLI session, MCP client, or in-app agent and need to
 - Reference resource template: rost://reference/{slug}
 - Operation resources (read-only, scope-enforced): rost://tenant/status, rost://graph, rost://seat/{id}/context, rost://compass/current, rost://sync/latest, rost://skills, rost://skills/{slug}, rost://skills/{slug}/files/{path}, rost://seat/{id}/skills, rost://operations/reference-map
 
-Start with rost_reference_search when the user asks a broad question. Use rost_reference_get when a workflow or command metadata already names a guide slug. Read the operation resources to load current tenant/seat facts before mutating; tenant-wide resources need a tenant-admin token and a seat token may read only its own rost://seat/{id}/context.
+Start with rost_reference_search when the user asks a broad question. Use rost_reference_get when a workflow or command metadata already names a guide slug; pass a section id/title to read one bounded section when the guide is large. Read the operation resources to load current tenant/seat facts before mutating; tenant-wide resources need a tenant-admin token and a seat token may read only its own rost://seat/{id}/context.
 
 ## CLI surface
 
@@ -43823,8 +43863,8 @@ Start with rost_reference_search when the user asks a broad question. Use rost_r
 
 Never guess a command's JSON shape. Before calling a command that changes state, read its exact contract:
 
-- List every callable command: {{cli}} command list (CLI) or rost_list_commands (MCP)
-- Read one command's exact input/output schema, help pointer, and a worked example: {{cli}} command schema <id> (CLI) or rost_describe_command with {"command_id":"<id>"} (MCP)
+- List callable commands: {{cli}} command list (CLI) or rost_list_commands (MCP, bounded pages with q/category/stage/limit/cursor filters)
+- Read one command's exact input/output schema, help pointer, MCP tool name, and a worked example: {{cli}} command schema <id> (CLI) or rost_describe_command with {"command_id":"<id>"} (MCP)
 - List the tool catalog the agent builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance): {{cli}} tools list (CLI) or rost_list_tool_catalog (MCP)
 - List guided model tiers before choosing --model (recommended default, effort, token prices, cost bands, best-fit work, model id): {{cli}} model list (CLI) or rost_list_model_catalog (MCP)
 - Show a Compass, Charter, or agent setup as a markdown card to review with your human: {{cli}} compass show --markdown, {{cli}} charter show --seat-id <id> --markdown, {{cli}} agent show --seat-id <id> --markdown
@@ -44333,7 +44373,7 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 71,
     title: "Billing and pricing guide",
     summary: "How {{brand}} packages company-wide access, Stripe billing, and governed-agent usage without per-human-seat pricing.",
-    version: "2026-07-02.4",
+    version: "2026-07-02.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
@@ -44372,6 +44412,7 @@ The launch billing model has two parts:
 
 - **Company base subscription.** One company subscription covers the operating system: Compass, Responsibility Graph, Cascade, Signal, Friction, Sync, Settings, reference docs, and governed agent setup.
 - **Governed-agent usage.** The base subscription includes a configurable allowance for billable successful agent work. Usage above the included allowance is metered from service-owned closed-period billing finalization.
+- **Add-ons.** Some advanced capabilities ship as separately purchased add-ons gated by their own account entitlement, not part of the base subscription \u2014 for example the Software Factory (Forge) developer-agent add-on (\`software_factory.access\`), which is opt-in and never bundled into the base plan.
 
 Human members are not the billing unit. A company can invite the people needed to run the operating rhythm without paying for each human login. Seat or member limits may still exist as entitlement controls for abuse prevention, package design, or enterprise contracts, but they are not the default subscription meter.
 
@@ -44533,7 +44574,7 @@ Agents may explain which setting is needed and why. They should not ask users to
     order: 73,
     title: "Members and invites guide",
     summary: "How to invite humans into the company without confusing user access with seat accountability.",
-    version: "2026-07-02.1",
+    version: "2026-07-03.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -44558,7 +44599,11 @@ Invite the person as a tenant member. Then assign them to one or more seats only
 
 Tenant roles control app access. Seats control operating accountability. Do not attach goals, tasks, or measurables directly to a user when the work belongs to a seat.
 
-Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
+Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Setup-limited access is intentionally not enough for sensitive operating surfaces: Settings member/invite/token/runner/credential metadata, run and tool-call history, runner diagnostics, integration metadata and tests, system health, Signal operating data, and owner/operating pages require owner/admin or full setup access. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
+
+## Working across several client companies
+
+An implementer invited into more than one client company sees a company switcher in the app sidebar; it always shows the active company so it is clear which client you are working in, and lets you switch between the companies you have an active membership in. Switching is validated against your memberships server-side \u2014 you can only enter a company you are an active member of, and a company you have been removed from disappears and can no longer be opened. Switching changes which company is active; it never grants access you were not given in that company. From the CLI or an agent session the same operation is \`rost use\` (validated by \`user.use_tenant\`).
 
 ## Agent guidance
 
@@ -46571,6 +46616,19 @@ var COMMAND_MANIFEST = [
   { "id": "skill.revoke_from_seat", "namespace": "skill", "action": "revoke_from_seat", "title": "Revoke skill from seat", "description": "Human-gated revocation of a Seat skill assignment. Revocation stops future skill use without deleting historical run activations.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "assignment_id", "flag": "assignment-id", "type": "string", "required": false }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "slug", "flag": "slug", "type": "string", "required": false }, { "name": "skill_version_id", "flag": "skill-version-id", "type": "string", "required": false }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "Revoke future use of an assigned Skill with human confirmation while preserving historical run activation records." },
   { "id": "skill.sync_local", "namespace": "skill", "action": "sync_local", "title": "Sync assigned skills locally", "description": "Resolve all approved published skills assigned to a Seat for local CLI installation. Revoked assignments are reported so the client can mark stale local copies.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "client", "flag": "client", "type": "enum", "required": true, "enumValues": ["claude-code", "codex", "cursor"] }], "hasComplexInput": false, "help": "Resolve all approved Skills assigned to a local agent Seat so the CLI can install or update unchanged-by-hash local copies." },
   { "id": "skill.update_draft", "namespace": "skill", "action": "update_draft", "title": "Update skill draft", "description": "Replace or create the current unpublished draft version for an existing skill from a bounded SKILL.md package.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "slug", "flag": "slug", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["draft", "pending_review"] }], "hasComplexInput": true, "help": "Update the current unpublished Skill draft; published versions stay immutable, so durable corrections should become reviewed new versions." },
+  { "id": "software_factory.authority_profile.create", "namespace": "software_factory", "action": "authority_profile.create", "title": "Create a Forge authority profile", "description": "Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset (conservative by default). Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "name", "flag": "name", "type": "string", "required": true }, { "name": "preset", "flag": "preset", "type": "enum", "required": false, "enumValues": ["read_only", "contributor", "maintainer", "deployer", "power_admin"] }, { "name": "is_default", "flag": "is-default", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to read_only." },
+  { "id": "software_factory.authority_profile.list", "namespace": "software_factory", "action": "authority_profile.list", "title": "List Forge authority profiles", "description": "List the tenant's Forge authority profiles (the seat capability presets, read-only by default). Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "List Forge authority profiles (seat capability presets, read-only by default). Read-only; requires the Forge add-on." },
+  { "id": "software_factory.authority.grant", "namespace": "software_factory", "action": "authority.grant", "title": "Grant Forge seat authority", "description": "Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only, human-gated (an agent caller routes to /approvals). Emits a durable authority-change event. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Grant a seat a Forge authority profile on a project. Owner-only and human-gated; emits a durable authority-change event." },
+  { "id": "software_factory.authority.revoke", "namespace": "software_factory", "action": "authority.revoke", "title": "Revoke Forge seat authority", "description": "Revoke a Forge authority grant (teardown \u2014 ADR-0018 \xA76). Owner-only, human-gated; emits a durable authority-change event. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a Forge authority grant (teardown). Owner-only and human-gated." },
+  { "id": "software_factory.capacity.list", "namespace": "software_factory", "action": "capacity.list", "title": "List Forge runner capacity", "description": "List the tenant's Forge runner capacity observations (OS, CPU, memory, active sessions, usage-limit telemetry). Advisory scheduling input only, never an authority input. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on." },
+  { "id": "software_factory.gate.decide", "namespace": "software_factory", "action": "gate.decide", "title": "Decide a Forge gate", "description": "A human approves or rejects a Forge gate. The resolver is recorded (never an agent \u2014 invariant #7); sensitive gates (security sign-off, merge/deploy, authority change, production deploy) also write a linked human decision. Requires confirmation.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "gate_id", "flag": "gate-id", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves or rejects a Forge gate; an agent caller routes to /approvals and can never self-approve. Sensitive gates record a human decision." },
+  { "id": "software_factory.phase.advance", "namespace": "software_factory", "action": "phase.advance", "title": "Advance a Forge build request phase", "description": "Advance a build request to the next phase, enforcing the closed phase state machine server-side (an illegal transition is rejected). Writes a phase-run row and updates the current phase. Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "to_phase", "flag": "to-phase", "type": "enum", "required": true, "enumValues": ["intake", "discovery_scoping", "plan_review", "implementation", "plan_conformance_review", "security_review", "qa_verification", "release_preview", "merge_or_deploy_gate", "closeout"] }, { "name": "owning_seat_id", "flag": "owning-seat-id", "type": "string", "required": false }, { "name": "note", "flag": "note", "type": "string", "required": false }], "hasComplexInput": false, "help": "Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition." },
+  { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
+  { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
+  { "id": "software_factory.request.show", "namespace": "software_factory", "action": "request.show", "title": "Show a Forge build request", "description": "The Forge request detail: the build request, its current phase, phase-run history, and gates. Read-only, entitlement-gated, tenant-scoped.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Show a Forge build request's detail: current phase, phase-run history, and gates. Read-only; requires the Forge add-on." },
+  { "id": "software_factory.secret.grant", "namespace": "software_factory", "action": "secret.grant", "title": "Grant a Forge secret", "description": "A human grants a seat scoped access to a project secret by VAULT REF (project \xD7 env \xD7 seat \xD7 action \xD7 key). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": true }], "hasComplexInput": false, "help": "A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated." },
+  { "id": "software_factory.secret.request", "namespace": "software_factory", "action": "secret.request", "title": "Request a Forge secret grant", "description": "An agent or user REQUESTS access to a project secret by key (draft-and-confirm \u2014 no value, no grant). Records the ask as a durable event for a human to grant. Never accepts a secret value (invariant #5). Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Request access to a project secret by key (draft-and-confirm; no value, no grant). Never accepts a secret value; a human grants it." },
+  { "id": "software_factory.secret.revoke", "namespace": "software_factory", "action": "secret.revoke", "title": "Revoke a Forge secret grant", "description": "Revoke a Forge secret grant (teardown \u2014 a compromised seat's access can be cut immediately, ADR-0018 \xA76). Owner-only, human-gated. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated." },
   { "id": "staffing.assign", "namespace": "staffing", "action": "assign", "title": "Staff seat", "description": "Compatibility command for the DER-626 MCP staffing tool.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Staff a seat only after the function, Charter, and human accountability are clear." },
   { "id": "staffing.assign_agent_dry_run", "namespace": "staffing", "action": "assign_agent_dry_run", "title": "Assign dry-run agent to seat", "description": "Assign an agent occupancy while the agent remains in dry-run.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Start agent staffing with dry runs and a named human Steward." },
   { "id": "staffing.assign_user", "namespace": "staffing", "action": "assign_user", "title": "Assign user to seat", "description": "Assign a human user occupancy to a seat.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "user_id", "flag": "user-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Assign humans to seats after the seat accountability is clear." },
@@ -48184,7 +48242,8 @@ var SKIP_NAMESPACES = /* @__PURE__ */ new Set([
 var NAMESPACE_TO_GROUP = {
   error_log: "error",
   tool: "tools",
-  skill: "skills"
+  skill: "skills",
+  [RSF_ADDON_BRAND.internalKey]: RSF_ADDON_BRAND.cliGroup
 };
 var EXTRA_SURFACED = /* @__PURE__ */ new Set([
   "seat.decommission_preview",
@@ -48223,6 +48282,10 @@ function buildMergedSpecs() {
       spec.verbs[verb] = verbSpec;
     }
   }
+  const forgeGroup = merged[RSF_ADDON_BRAND.cliGroup];
+  if (forgeGroup && !forgeGroup.summary) {
+    forgeGroup.summary = `${RSF_ADDON_BRAND.shortName}: ${RSF_ADDON_BRAND.categoryLabel} add-on operations.`;
+  }
   return merged;
 }
 var MERGED_SPECS = buildMergedSpecs();
@@ -48994,6 +49057,11 @@ import path3 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify3 } from "node:util";
 var execFile3 = promisify3(execFileCallback3);
+var RUNNER_CHARTER_LOAD_TOOLS = [
+  "mcp__rost__rost_get_context",
+  "mcp__rost__rost_report_status",
+  "mcp__rost__rost_get_tasks"
+];
 async function runRunnerServe(options) {
   const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
@@ -49264,7 +49332,17 @@ function buildTurnCommand(runtime, prompt, configPath) {
   }
   return {
     command: "claude",
-    args: ["-p", prompt, "--mcp-config", configPath, "--strict-mcp-config", "--output-format", "text"]
+    args: [
+      "-p",
+      prompt,
+      "--mcp-config",
+      configPath,
+      "--strict-mcp-config",
+      "--allowedTools",
+      RUNNER_CHARTER_LOAD_TOOLS.join(","),
+      "--output-format",
+      "text"
+    ]
   };
 }
 async function spawnRunnerTurn(appUrl2, workOrder, runtime) {
@@ -49277,14 +49355,14 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime) {
     work_order_id: workOrder.id,
     task_id: workOrder.task_id ?? null,
     seat: workOrder.seat ?? null,
-    charter: workOrder.charter ?? null,
-    permission_manifest: workOrder.permission_manifest ?? null,
+    charter_ref: workOrder.charter_ref ?? null,
     aicos: workOrder.aicos ?? null
   };
   const hasAicosContext = typeof workOrder.aicos === "object" && workOrder.aicos !== null;
   const prompt = [
-    hasAicosContext ? `Load your ${cliBrand.name} context, answer the AICOS user turn using only seat-authorized context and tools, and stop.` : `Load your ${cliBrand.name} context, report one read-only status, and stop.`,
+    hasAicosContext ? `Call rost_get_context first to load your full ${cliBrand.name} charter, answer the AICOS user turn using only seat-authorized context and tools, and stop.` : `Call rost_get_context first to load your full ${cliBrand.name} charter, report one read-only status, and stop.`,
     "Do not call external systems or mutating tools.",
+    "The work order includes only a compact charter pointer; rost_get_context is the canonical full charter load path.",
     `Claimed work order context: ${JSON.stringify(context).slice(0, 8e3)}`
   ].join("\n");
   await writeFile2(configPath, `${mcpConfig}