@rosthq/cli 0.7.20 → 0.7.22

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAqN3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAwN3D,CAAC"}

package/dist/index.js

@@ -38895,6 +38895,21 @@ var aicosSessionSchema = external_exports.object({
   updatedAt: external_exports.string().datetime({ offset: true }),
   createdAt: external_exports.string().datetime({ offset: true })
 }).strict();
+var AICOS_ATTACHMENT_CONTENT_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+var AICOS_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var AICOS_MAX_ATTACHMENTS_PER_TURN = 4;
+var aicosAttachmentContentTypeSchema = external_exports.enum(AICOS_ATTACHMENT_CONTENT_TYPES);
+var aicosAttachmentSchema = external_exports.object({
+  id: uuidSchema4,
+  contentType: aicosAttachmentContentTypeSchema,
+  sizeBytes: external_exports.number().int().positive(),
+  width: external_exports.number().int().positive().nullable(),
+  height: external_exports.number().int().positive().nullable(),
+  filename: external_exports.string().max(255).nullable()
+}).strict();
+var aicosAttachmentUploadResultSchema = external_exports.object({
+  attachment: aicosAttachmentSchema
+}).strict();
 var aicosMessageSchema = external_exports.object({
   id: uuidSchema4,
   sessionId: uuidSchema4,
@@ -38907,6 +38922,7 @@ var aicosMessageSchema = external_exports.object({
   linkedRunId: uuidSchema4.nullable(),
   linkedWorkOrderId: uuidSchema4.nullable(),
   sourceCount: external_exports.number().int().nonnegative().default(0),
+  attachments: external_exports.array(aicosAttachmentSchema).default([]),
   createdAt: external_exports.string().datetime({ offset: true })
 }).strict();
 var aicosSourceSchema = external_exports.object({
@@ -38922,7 +38938,11 @@ var aicosSourceSchema = external_exports.object({
 var aicosTurnRequestSchema = external_exports.object({
   sessionId: uuidSchema4.nullable().optional(),
   purpose: aicosConversationPurposeSchema.default("general"),
-  message: external_exports.string().trim().min(1).max(12e3),
+  // Empty is permitted only when attachments are present (an image-only turn);
+  // runAicosTurn enforces the "message or attachment required" invariant so the
+  // schema stays a plain object for downstream `.shape`/`.extend` consumers.
+  message: external_exports.string().trim().max(12e3).default(""),
+  attachmentIds: external_exports.array(uuidSchema4).max(AICOS_MAX_ATTACHMENTS_PER_TURN).default([]),
   routeContext: aicosRouteContextSchema,
   model: aicosModelRequestSchema.optional()
 }).strict();
@@ -42552,7 +42572,15 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // rejects (→ "Command input failed schema validation"). Matches the sibling
   // software-factory schemas that already use `.nullable().optional()`.
   software_project_id: uuid10.nullable().optional(),
-  assign_skills: external_exports.boolean().default(true)
+  assign_skills: external_exports.boolean().default(true),
+  // DER-1264: the install auto-staffs live agents at a pr_only, observe-first
+  // posture. If the tenant's company autonomy ceiling (`agent_policy`) is MORE
+  // permissive than this design's envelope (resolved `max_autonomous_risk` >= high,
+  // i.e. `high_autonomy` or a custom high/critical ceiling), the install refuses to
+  // auto-activate unless the owner explicitly acknowledges that posture. Never
+  // silently inherit a more-permissive-than-designed ceiling (invariant #10). A
+  // tenant within the envelope (locked_down/balanced) never needs this.
+  acknowledge_autonomy_ceiling: external_exports.boolean().default(false)
 }).strict();
 var softwareDeveloperTeamSeatSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
@@ -42580,12 +42608,45 @@ var softwareDeveloperTeamAuthorityGrantSummarySchema = external_exports.object({
   grant_id: uuid10,
   created: external_exports.boolean()
 });
+var softwareDeveloperTeamOccupancySummarySchema = external_exports.object({
+  role: softwareDeveloperTeamRoleSchema,
+  seat_id: uuid10,
+  agent_id: uuid10,
+  template_slug: external_exports.string(),
+  status: external_exports.literal("live"),
+  // false when a live agent already occupied the seat (idempotent re-install).
+  created: external_exports.boolean()
+});
+var softwareDeveloperTeamAgentPolicySummarySchema = external_exports.object({
+  profile: agentPolicyProfileSchema,
+  enforcement: agentPolicyEnforcementSchema,
+  max_autonomous_risk: autonomousRiskLevelSchema,
+  // true when the resolved ceiling is more permissive than this design's envelope
+  // (max_autonomous_risk >= high) and the owner acknowledged it to activate.
+  more_permissive_than_envelope: external_exports.boolean()
+});
+var softwareDeveloperTeamTokenBudgetSummarySchema = external_exports.object({
+  hard_cap_usd: external_exports.string().nullable(),
+  soft_cap_usd: external_exports.string().nullable(),
+  set_by_install: external_exports.boolean()
+});
+var softwareDeveloperTeamGithubPolicySummarySchema = external_exports.object({
+  software_project_id: uuid10,
+  automation_mode_ceiling: softwareAutomationModeSchema,
+  // false when a pre-existing policy was preserved (not created by this install).
+  created: external_exports.boolean()
+});
 var softwareDeveloperTeamInstallOutputSchema = external_exports.object({
   installed: external_exports.boolean(),
   seats: external_exports.array(softwareDeveloperTeamSeatSummarySchema),
   skills: external_exports.array(softwareDeveloperTeamSkillSummarySchema),
   authority_profiles: external_exports.array(softwareDeveloperTeamAuthorityProfileSummarySchema),
-  authority_grants: external_exports.array(softwareDeveloperTeamAuthorityGrantSummarySchema)
+  authority_grants: external_exports.array(softwareDeveloperTeamAuthorityGrantSummarySchema),
+  // DER-1264 auto-staffing additions.
+  occupancies: external_exports.array(softwareDeveloperTeamOccupancySummarySchema),
+  agent_policy: softwareDeveloperTeamAgentPolicySummarySchema,
+  token_budget: softwareDeveloperTeamTokenBudgetSummarySchema,
+  github_policy: softwareDeveloperTeamGithubPolicySummarySchema.nullable()
 });
 var forgeArtifactText = external_exports.string().trim().min(1).max(4e3);
 var forgeArtifactList = external_exports.array(forgeArtifactText).max(50).default([]);
@@ -42642,8 +42703,7 @@ var softwareGithubAutomationPolicyInputSchema = external_exports.object({
     message: "production deploy must remain human-gated"
   })
 }).strict();
-var softwareGithubRepositoryBindingInputSchema = external_exports.object({
-  software_project_id: uuid10,
+var softwareGithubConnectedRepositoryInputSchema = external_exports.object({
   repository_id: external_exports.number().int().positive(),
   repository_name: external_exports.string().trim().min(1).max(255),
   repository_full_name: external_exports.string().trim().min(1).max(500),
@@ -42651,18 +42711,65 @@ var softwareGithubRepositoryBindingInputSchema = external_exports.object({
   default_branch: external_exports.string().trim().min(1).max(255).default("main"),
   permissions: external_exports.record(external_exports.string().min(1), external_exports.enum(["read", "write"])).default({})
 }).strict();
-var softwareGithubInstallationBindInputSchema = external_exports.object({
+var softwareGithubInstallationConnectInputSchema = external_exports.object({
   app_slug: external_exports.string().trim().min(1).max(120).default("rost-forge"),
   installation_id: external_exports.number().int().positive(),
   account_login: external_exports.string().trim().min(1).max(255),
   account_id: external_exports.number().int().positive(),
   account_type: external_exports.string().trim().min(1).max(80),
-  repositories: external_exports.array(softwareGithubRepositoryBindingInputSchema).min(1).max(100)
+  repositories: external_exports.array(softwareGithubConnectedRepositoryInputSchema).min(1).max(200)
+}).strict();
+var softwareGithubInstallationConnectOutputSchema = external_exports.object({
+  github_installation_id: uuid10,
+  repositories_connected: external_exports.number().int().nonnegative()
+});
+var softwareGithubRepositoryBindMappingSchema = external_exports.object({
+  repository_id: external_exports.number().int().positive(),
+  software_project_id: uuid10
+}).strict();
+var softwareGithubInstallationBindInputSchema = external_exports.object({
+  app_slug: external_exports.string().trim().min(1).max(120).default("rost-forge"),
+  installation_id: external_exports.number().int().positive(),
+  bindings: external_exports.array(softwareGithubRepositoryBindMappingSchema).min(1).max(100)
 }).strict();
 var softwareGithubInstallationBindOutputSchema = external_exports.object({
   github_installation_id: uuid10,
   repositories_bound: external_exports.number().int().nonnegative()
 });
+var softwareGithubRepositoryUnbindInputSchema = external_exports.object({
+  app_slug: external_exports.string().trim().min(1).max(120).default("rost-forge"),
+  installation_id: external_exports.number().int().positive(),
+  repository_id: external_exports.number().int().positive(),
+  disconnect: external_exports.boolean().default(false)
+}).strict();
+var softwareGithubRepositoryUnbindOutputSchema = external_exports.object({
+  repository_id: external_exports.number().int().positive(),
+  status: external_exports.enum(["connected", "revoked"])
+});
+var softwareGithubInstallationListInputSchema = external_exports.object({ app_slug: external_exports.string().trim().min(1).max(120).default("rost-forge") }).strict();
+var softwareGithubInstallationRepositoryViewSchema = external_exports.object({
+  repository_id: external_exports.number().int().positive(),
+  repository_name: external_exports.string(),
+  repository_full_name: external_exports.string(),
+  private: external_exports.boolean(),
+  default_branch: external_exports.string(),
+  status: external_exports.enum(["connected", "active"]),
+  software_project_id: uuid10.nullable(),
+  software_project_name: external_exports.string().nullable(),
+  software_project_slug: external_exports.string().nullable()
+});
+var softwareGithubInstallationViewSchema = external_exports.object({
+  id: uuid10,
+  installation_id: external_exports.number().int().positive(),
+  account_login: external_exports.string(),
+  account_id: external_exports.number().int().positive(),
+  account_type: external_exports.string(),
+  status: external_exports.enum(["active", "suspended", "revoked"]),
+  repositories: external_exports.array(softwareGithubInstallationRepositoryViewSchema)
+});
+var softwareGithubInstallationListOutputSchema = external_exports.object({
+  installations: external_exports.array(softwareGithubInstallationViewSchema)
+});
 var softwareGithubAutomationPolicyUpsertOutputSchema = external_exports.object({
   policy_id: uuid10,
   software_project_id: uuid10,
@@ -43533,7 +43640,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-04.10",
+    version: "2026-07-04.11",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -43601,6 +43708,8 @@ Model behavior is now explicit in the AICOS session contract. A thread can run i
 
 Assistant answers render safe Markdown for headings, short lists, emphasis, code, tables, and in-app links. User messages remain plain escaped text. Links only become clickable when they target same-origin app routes such as \`/inbox\` or \`/settings\`; external, protocol, script, API-style, or traversal targets are stripped to plain text before transcript storage. When an answer includes a validated app route, the chat can surface one consent-required navigation suggestion and, if the user has enabled the local preference, open that route automatically. Navigation is never authorization; destination pages still enforce their own tenant, role, and seat checks.
 
+You can attach images to a message from the composer. {{brand}} accepts PNG, JPEG, WebP, and GIF up to 10 MB each, and up to four per message. Images are held in a tenant-scoped private store, stripped of embedded metadata such as EXIF on upload, and shown as thumbnails in your message; the panel loads each thumbnail through a short-lived signed link rather than a public URL. In the cloud lane the agent can view the image directly. Runner and MCP viewing of attached images is a scoped follow-up; today the agent still reads the accompanying text on those lanes.
+
 AICOS can also retrieve bounded summaries from prior sessions owned by the same tenant user and surface them as session-memory read models. Setup-limited users do not retrieve sensitive historical run or company-memory summaries through this path. This is a practical memory seam for AICOS continuity; it is not yet the future Company Brain, and it does not make unaccepted knowledge authoritative.
 
 Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
@@ -44416,7 +44525,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-04.1",
+    version: "2026-07-04.14",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -45144,17 +45253,18 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_a_forge_authority_profile\` | \`software_factory.authority_profile.create\` | Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset. | Tenant-admin | Call with \`{"name":"Builder","preset":"contributor"}\`. |
 | \`rost_grant_forge_seat_authority\` | \`software_factory.authority.grant\` | Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only and human-gated; emits a durable authority-change event. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","seat_id":"<seat-id>","authority_profile_id":"<profile-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_revoke_forge_seat_authority\` | \`software_factory.authority.revoke\` | Revoke a Forge authority grant (teardown). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install the governed Forge Developer Team template: Forge Lead, Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Entitlement-gated and human-gated; it creates no live agent occupancy by itself. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the template installs tenant-wide either way). Non-interactive callers receive a confirmation handoff. |
+| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install AND activate the governed Forge Developer Team: Forge Lead (human) plus Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Approving ALSO auto-staffs the 6 agent seats as live occupancies at a pull-request-only, observe-first posture (open pull requests, never merge/deploy without a human), steward-chained to the human lead, each with a signed manifest + passed sandbox dry-run; it sets a conservative default token budget (only if none) and, for a supplied project, a default pr_only GitHub automation policy (only if none \u2014 never widening a stricter one). Entitlement-gated and human-gated. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the team installs tenant-wide either way). If the company autonomy ceiling is more permissive than the observe-first envelope, add \`{"acknowledge_autonomy_ceiling":true}\` to activate. Non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_config\` | \`software_factory.config.list\` | List active Forge configuration entries. Plain values may be returned only when they passed the non-secret guard; secret refs appear as metadata and never include the ref value. | Tenant | Call with \`{}\` or \`{"software_project_id":"<project-id>","environment":"preview"}\`. |
 | \`rost_set_forge_config\` | \`software_factory.config.set\` | Human-gated config create/rotation for plain values or secret refs. Secret refs store only a vault pointer and raw secret-shaped plain values are rejected. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"preview","key_name":"PUBLIC_BASE_URL","value_kind":"plain","plain_value":"https://preview.example.com"}\`. |
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
 | \`rost_grant_a_forge_secret\` | \`software_factory.secret.grant\` | A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"production","seat_id":"<seat-id>","action":"vercel.env.sync","key_name":"OPENAI_API_KEY","vault_ref":"infisical://prod/OPENAI_API_KEY"}\`. |
 | \`rost_revoke_a_forge_secret_grant\` | \`software_factory.secret.revoke\` | Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"]}\`. |
+| \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. The allowed-actions and human-gated-actions lists are stored server-side as structured JSON arrays. Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"]}\`. |
 | \`rost_create_a_forge_github_installation_token\` | \`software_factory.github.installation_token.create\` | Mint a short-lived GitHub App installation token for one bound repository after policy evaluation. The token is returned once and never stored. | Tenant | Call with \`{"software_project_id":"<project-id>","repository_id":789,"requested_actions":["read"],"requested_automation_mode":"plan_only"}\`. |
+| \`rost_list_forge_github_installations\` | \`software_factory.github.installation.list\` | List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only. | Tenant | Call with \`{}\`; a \`connected\` repository is verified but not yet bound to a project. |
 | \`rost_list_forge_runner_capacity\` | \`software_factory.capacity.list\` | List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"runner_id":"<runner-id>"}\`. |
 
-The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, runner capacity, configuration status, and Developer Team template install. The template install button deliberately stages a pending confirmation before durable seats, Skills, or authority grants are applied.
+The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, runner capacity, configuration status, and Developer Team install. The install button deliberately stages a pending confirmation before durable seats, Skills, authority grants, or live agent activation are applied; the install page states plainly that approving activates the 6 agents at a pull-request-only, observe-first posture and surfaces the company autonomy ceiling.
 
 #### Forge GitHub App access
 
@@ -45162,7 +45272,7 @@ Forge repository access is through a tenant-bound GitHub App installation, not t
 
 Installation tokens are short lived and are not stored. The durable record is audit metadata: installation id, repository id, requested action, policy decision, reason, and related Forge request when one exists. GitHub issue titles, labels, and bodies are treated as untrusted source content; labels may request an automation mode, but only server-side Forge automation policy can allow \`pr_only\`, \`merge_after_checks\`, \`deploy_preview\`, or \`deploy_production\`. Production deploy remains human-gated.
 
-Tenant GitHub App installation binding is intentionally not a CLI or MCP tool. Start at \`/forge/settings/github\`: the settings flow preserves the signed GitHub setup state, performs user-scoped GitHub App authorization, verifies admin repositories server-side, and then submits the governed bind command from the UI.
+Tenant GitHub App connect and bind are intentionally not CLI or MCP mutation tools; only the read \`software_factory.github.installation.list\` is exposed. Start at \`/forge/settings/github\`. Connect and bind are decoupled (DER-1281): user-scoped GitHub App authorization verifies the repositories you administer server-side and records them as **connected** (unbound, no project) via \`software_factory.github.installation.connect\` \u2014 this persists on any successful ownership proof, not only the one-shot post-install redirect, so a missed setup redirect is no longer fatal (a persistent "Verify ownership & add repositories" action re-runs it any time). Binding is a separate, always-available step: \`software_factory.github.installation.bind\` maps a connected repository to a Forge project (no GitHub re-authorization), and \`software_factory.github.repository.unbind\` returns a repository to connected/unbound (re-bindable) or disconnects it. Token minting and issue intake only ever see \`active\` (bound) repositories, so an unbound repository never enters automation.
 
 The Forge GitHub App itself is org-owned. App private key, webhook secret, and client secret values are platform-owned ROST operator credentials stored through the vault's reserved ROST system namespace, not through a customer tenant namespace or a tenant UUID deployment variable. Manifest conversion and manual secret storage also require the app-level \`GITHUB_APP_OPERATOR_EMAILS\` allowlist, which should contain only approved ROST platform operator emails. Deployment config carries only refs (\`GITHUB_APP_PRIVATE_KEY_REF\`, \`GITHUB_APP_WEBHOOK_SECRET_REF\`, \`GITHUB_APP_CLIENT_SECRET_REF\`); raw secret env vars are local/legacy compatibility only. The dogfood app is \`ROST Forge\` under \`agenticoperatingsystem\` with App ID \`4208495\` and Client ID \`Iv23liImH7qlBvXYQ0Wx\`. The base app omits \`administration\` and \`workflows\`; elevated repo creation or workflow mutation needs a separate human-approved power path.
 
@@ -45746,7 +45856,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-02.4",
+    version: "2026-07-04.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -45802,7 +45912,7 @@ Avoid vanity numbers, manual-only status fields, and metrics nobody can act on.
 
 - Read: \`{{cli}} signal list --json\` / \`signal.list\` / \`rost_list_signals\` returns measurables with their latest reading and on/off-track state. \`signal.get\` / \`rost_get_signal\` returns one measurable's full reading history.
 - Add a measurable: \`measurable.create\` (scope: seat) defines a measurable a seat owns \u2014 name, unit, direction, target, cadence. The seat owns it; readings attach to it afterward.
-- Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated.
+- Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated. An agent's \`status.record\` never downgrades a human-confirmed reading: a routine agent read that lands on a period a human already confirmed leaves the confirmed value and its confirmation intact (invariants #7/#8 \u2014 agents recommend; humans decide).
 - Confirm a reading: \`{{cli}} signal confirm\` / \`signal.confirm_reading\` / \`rost_confirm_signal_reading\` marks a reading human-verified. \`signal.correct_reading\` / \`rost_correct_signal_reading\` overwrites a reading with a human-confirmed value.
 
 ## Run Signal without an agent
@@ -48334,11 +48444,14 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.capacity.list", "namespace": "software_factory", "action": "capacity.list", "title": "List Forge runner capacity", "description": "List the tenant's Forge runner capacity observations (OS, CPU, memory, active sessions, usage-limit telemetry). Advisory scheduling input only, never an authority input. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on." },
   { "id": "software_factory.config.list", "namespace": "software_factory", "action": "config.list", "title": "List Forge config", "description": "List active Forge config metadata for project environments. Plain config values may be returned; secret refs are represented only as has_secret_ref.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "environment", "flag": "environment", "type": "enum", "required": false, "enumValues": ["development", "preview", "production"] }], "hasComplexInput": false, "help": "List active Forge config entries. Plain config may be shown; secret refs are represented only as metadata." },
   { "id": "software_factory.config.set", "namespace": "software_factory", "action": "config.set", "title": "Set Forge config", "description": "Create or rotate a Forge project config entry. Secret config stores only a vault ref pointer; raw values are never accepted for secret_ref entries.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "value_kind", "flag": "value-kind", "type": "enum", "required": true, "enumValues": ["plain", "secret_ref"] }, { "name": "plain_value", "flag": "plain-value", "type": "string", "required": false }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Set or rotate a Forge project config key. Secret entries store only vault refs and are human-gated." },
-  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install the governed Forge Developer Team template: seats, draft Charters, first-party skill assignments, and authority presets. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
+  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
   { "id": "software_factory.gate.decide", "namespace": "software_factory", "action": "gate.decide", "title": "Decide a Forge gate", "description": "A human approves or rejects a Forge gate. The resolver is recorded (never an agent \u2014 invariant #7); sensitive gates (security sign-off, merge/deploy, authority change, production deploy) also write a linked human decision. Requires confirmation.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "gate_id", "flag": "gate-id", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves or rejects a Forge gate; an agent caller routes to /approvals and can never self-approve. Sensitive gates record a human decision." },
   { "id": "software_factory.github.installation_token.create", "namespace": "software_factory", "action": "github.installation_token.create", "title": "Create a Forge GitHub installation token", "description": "Mint a short-lived GitHub App installation token for one bound repository after server-side policy evaluation. The token is returned once and never persisted.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "requested_actions", "flag": "requested-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requested_automation_mode", "flag": "requested-automation-mode", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Mint a short-lived GitHub App installation token for one bound repository after policy evaluation; token material is returned once and never stored." },
-  { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind a Forge GitHub installation", "description": "Bind a GitHub App installation and selected repositories to Forge projects from the authenticated Forge GitHub settings flow. Owner-only and human-gated; webhook payloads never supply tenant authority.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "account_login", "flag": "account-login", "type": "string", "required": true }, { "name": "account_id", "flag": "account-id", "type": "integer", "required": true }, { "name": "account_type", "flag": "account-type", "type": "string", "required": true }], "hasComplexInput": true, "help": "Bind a GitHub App installation and selected repositories to Forge projects from the authenticated Forge GitHub settings flow. Owner-only and human-gated." },
+  { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind Forge GitHub repositories to projects", "description": "Bind already-connected GitHub repositories to Forge projects. Owner-only and human-gated; operates on repositories already verified and connected in this tenant, so no GitHub re-authorization is required. Available any time, add or re-map bindings.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }], "hasComplexInput": true, "help": "Bind already-connected GitHub repositories to Forge projects from the Forge GitHub settings flow. Owner-only and human-gated; no GitHub re-authorization required." },
+  { "id": "software_factory.github.installation.connect", "namespace": "software_factory", "action": "github.installation.connect", "title": "Connect a Forge GitHub installation", "description": "Record a proven GitHub App installation and its verified repositories as connected (unbound) so they can be bound to Forge projects later. Owner-only and human-gated; starts from the authenticated Forge GitHub settings flow. Idempotent \u2014 re-connecting reconciles metadata and never unbinds an already-bound repository.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "account_login", "flag": "account-login", "type": "string", "required": true }, { "name": "account_id", "flag": "account-id", "type": "integer", "required": true }, { "name": "account_type", "flag": "account-type", "type": "string", "required": true }], "hasComplexInput": true, "help": "Record a verified GitHub App installation and its repositories as connected (unbound) so they can be bound to Forge projects later. Owner-only and human-gated." },
+  { "id": "software_factory.github.installation.list", "namespace": "software_factory", "action": "github.installation.list", "title": "List Forge GitHub installations", "description": "List connected GitHub App installations and their repositories with bind state (connected or active) and the Forge project each bound repository maps to. Read-only; requires the Forge add-on.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only." },
   { "id": "software_factory.github.policy.upsert", "namespace": "software_factory", "action": "github.policy.upsert", "title": "Set a Forge GitHub automation policy", "description": "Set the server-side policy for GitHub actions and automation-mode ceilings. Owner-only and human-gated; production deploy remains human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "authority_profile_id", "flag": "authority-profile-id", "type": "string", "required": false }, { "name": "automation_mode_ceiling", "flag": "automation-mode-ceiling", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "allowed_actions", "flag": "allowed-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requires_human_for", "flag": "requires-human-for", "type": "array", "required": true, "itemType": "string" }], "hasComplexInput": false, "help": "Set Forge's server-side GitHub automation policy for actions, mode ceilings, and human-gated operations." },
+  { "id": "software_factory.github.repository.unbind", "namespace": "software_factory", "action": "github.repository.unbind", "title": "Unbind a Forge GitHub repository", "description": "Remove a GitHub repository's Forge project binding. By default the repository stays connected (unbound) and can be re-bound later; pass disconnect to remove it entirely. Owner-only and human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "disconnect", "flag": "disconnect", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Remove a GitHub repository's Forge project binding; the repository stays connected for re-binding unless disconnect is set. Owner-only and human-gated." },
   { "id": "software_factory.phase.advance", "namespace": "software_factory", "action": "phase.advance", "title": "Advance a Forge build request phase", "description": "Advance a build request to the next phase, enforcing the closed phase state machine server-side (an illegal transition is rejected). Writes a phase-run row and updates the current phase. Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "to_phase", "flag": "to-phase", "type": "enum", "required": true, "enumValues": ["intake", "discovery_scoping", "plan_review", "implementation", "plan_conformance_review", "security_review", "qa_verification", "release_preview", "merge_or_deploy_gate", "closeout"] }, { "name": "owning_seat_id", "flag": "owning-seat-id", "type": "string", "required": false }, { "name": "note", "flag": "note", "type": "string", "required": false }], "hasComplexInput": false, "help": "Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition." },
   { "id": "software_factory.project.create", "namespace": "software_factory", "action": "project.create", "title": "Create a Forge project", "description": "Create an active Forge software project before binding repositories or opening build requests. Tenant-admin, human-gated, and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "name", "flag": "name", "type": "string", "required": true }, { "name": "slug", "flag": "slug", "type": "string", "required": false }, { "name": "base_branch", "flag": "base-branch", "type": "string", "required": false }, { "name": "repo_ref", "flag": "repo-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create an active Forge software project before binding repositories or opening build requests. Tenant-admin and human-gated; requires the Forge add-on." },
   { "id": "software_factory.project.list", "namespace": "software_factory", "action": "project.list", "title": "List Forge projects", "description": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only and entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only; requires the Forge add-on." },