@rosthq/cli 0.7.69 → 0.7.70

package/dist/index.js

@@ -40845,13 +40845,24 @@ var goalListAtRiskOutputSchema = external_exports.object({
 var goalSignalStateSchema = external_exports.enum(["ok", "risk", "crit", "pending"]);
 var goalStatusSourceSchema = external_exports.enum(["human", "agent", "rollup", "signal"]);
 var goalMeasurableRoleSchema = external_exports.enum(["drives_status", "informs"]);
+var goalDriverAnchorSchema = external_exports.object({
+  // The closed period being anchored on (an ISO date / period label — free-form so a
+  // caller can pass '2026-Q1' or '2026-06-30' as the books define the period).
+  period_start: external_exports.string().min(1),
+  // The value the goal's Signal should show for that closed period per the books.
+  expected_value: external_exports.number()
+}).strict();
 var goalBindMeasurableInputSchema = external_exports.object({
   goal_id: uuidSchema8,
   measurable_id: uuidSchema8,
   // DER-1643: new operator bindings default to the conservative 'informs' role.
   // 'drives_status' is the deliberate leaf-only status driver (childless goal only,
   // one per goal) and stays human-confirmed.
-  role: goalMeasurableRoleSchema.default("informs")
+  role: goalMeasurableRoleSchema.default("informs"),
+  // DER-1126 (ADR-0009 R5): required when role is 'drives_status' — a binding may not
+  // drive status without a second anchor. Optional here (only drives_status needs it);
+  // the command rejects a driver bind that omits it, exactly like signal.bind_confirm.
+  second_anchor: goalDriverAnchorSchema.optional()
 }).strict();
 var goalBindMeasurableOutputSchema = external_exports.object({
   goal_id: uuidSchema8,
@@ -40869,7 +40880,11 @@ var goalBindMeasurableOutputSchema = external_exports.object({
   // DER-1633: false for a fresh binding; true when this exact (goal, Signal) pair was
   // already bound — the command is an idempotent no-op (no new event, no duplicate
   // confirmation). Lets a caller distinguish "just bound" from "already bound".
-  already_bound: external_exports.boolean()
+  already_bound: external_exports.boolean(),
+  // DER-1126: the second anchor recorded when this binding was promoted to (or created
+  // as) the status driver. Null for an 'informs' binding (no anchor) and for a legacy
+  // driver bound before the anchor gate existed.
+  driver_anchor: goalDriverAnchorSchema.nullable()
 }).strict();
 var goalUnbindMeasurableInputSchema = external_exports.object({
   goal_id: uuidSchema8,
@@ -40910,7 +40925,11 @@ var goalMeasurableBindingSchema = external_exports.object({
   computed_status: goalStatusSchema.nullable(),
   // The latest confirmed reading's value (null while awaiting one) — enough to render
   // "measured by <Signal>: <value> <unit>" instead of a bare "Not measured".
-  last_reading_value: external_exports.number().nullable()
+  last_reading_value: external_exports.number().nullable(),
+  // DER-1126: the second anchor recorded when this driver was confirmed (null for a
+  // legacy driver bound before the anchor gate). Lets the driver view show "Anchored on
+  // <period>: expected <value>".
+  driver_anchor: goalDriverAnchorSchema.nullable()
 }).strict();
 var goalListMeasurablesInputSchema = external_exports.object({
   goal_id: uuidSchema8
@@ -43109,6 +43128,37 @@ var systemHealthOutputSchema = external_exports.object({
   findings: external_exports.array(systemHealthFindingSchema)
 }).strict();
 
+// ../../packages/protocol/src/baserow-filter-operators.ts
+var baserowFilterOperatorSchema = external_exports.enum([
+  "equal",
+  "not_equal",
+  "higher_than",
+  "higher_than_or_equal",
+  "lower_than",
+  "lower_than_or_equal",
+  "contains",
+  "contains_not",
+  "empty",
+  "not_empty"
+]);
+var BASEROW_FILTER_OPERATORS = {
+  equal: { requiresValue: true, label: "equals" },
+  not_equal: { requiresValue: true, label: "does not equal" },
+  higher_than: { requiresValue: true, label: "is greater than" },
+  higher_than_or_equal: { requiresValue: true, label: "is greater than or equal to" },
+  lower_than: { requiresValue: true, label: "is less than" },
+  lower_than_or_equal: { requiresValue: true, label: "is less than or equal to" },
+  contains: { requiresValue: true, label: "contains" },
+  contains_not: { requiresValue: true, label: "does not contain" },
+  empty: { requiresValue: false, label: "is empty" },
+  not_empty: { requiresValue: false, label: "is not empty" }
+};
+var baserowFilterOperatorOptions = Object.keys(BASEROW_FILTER_OPERATORS).map((value) => ({
+  value,
+  label: BASEROW_FILTER_OPERATORS[value].label,
+  requiresValue: BASEROW_FILTER_OPERATORS[value].requiresValue
+}));
+
 // ../../packages/protocol/src/signal-source.ts
 var uuid9 = external_exports.string().uuid();
 var signalCadenceSchema = external_exports.enum(["daily", "weekly", "monthly", "quarterly", "annual"]);
@@ -43239,6 +43289,18 @@ var signalBindConfirmOutputSchema = external_exports.object({
   binding_status: external_exports.literal("active")
 }).strict();
 
+// ../../packages/protocol/src/baserow-filtered-count.ts
+var FIELD_KEY_PATTERN = /^field_\d+$/;
+var baserowFilteredCountInputSchema = external_exports.object({
+  endpointHost: external_exports.string().min(1).max(255),
+  // Accept string or number from callers (CLI/MCP/assistant), coerce to a bounded
+  // positive integer before it is ever used as a URL path segment.
+  tableId: external_exports.coerce.number().int().positive().max(2147483647),
+  fieldKey: external_exports.string().regex(FIELD_KEY_PATTERN, "fieldKey must look like field_123"),
+  operator: baserowFilterOperatorSchema,
+  value: external_exports.string().max(200).optional()
+}).strict();
+
 // ../../packages/protocol/src/signal-report.ts
 var uuidSchema14 = external_exports.string().uuid();
 var dateOnlySchema2 = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected YYYY-MM-DD");
@@ -44747,7 +44809,24 @@ var statusEventPayloadSchema = external_exports.object({
     // so every existing status writer (status.record, corrections, imports) is
     // unaffected.
     note: external_exports.string().min(1).max(2e3).optional(),
-    confidence: external_exports.enum(["low", "medium", "high"]).optional()
+    confidence: external_exports.enum(["low", "medium", "high"]).optional(),
+    // DER-1123: when this reading supersedes a materially-different same-period
+    // reading (e.g. an integration pull replacing an agent-reported value), the
+    // prior reading's provenance is captured here — append-only, so the audit
+    // story survives even though the canonical row keeps a single value
+    // (invariant #8, supersession not silent rewrite). Non-secret fields ONLY
+    // (source kind, the numeric value, actor kind, a timestamp); never a vault
+    // ref, token, or raw integration response.
+    supersededFrom: external_exports.object({
+      // The value's origin (agent report / human entry / integration pull).
+      source: external_exports.enum(["agent", "human", "integration"]),
+      value: external_exports.number().finite(),
+      // The actor that last ESTABLISHED the superseded value — its reporter, or the
+      // human who confirmed/corrected it. Optional (a reading may lack a backing
+      // event). Never an actor id — only the coarse kind, so no PII.
+      actorKind: external_exports.enum(["user", "agent", "system"]).optional(),
+      at: external_exports.string().min(1)
+    }).strict().optional()
   }).strict()).optional(),
   goals: external_exports.array(external_exports.object({
     id: uuidSchema16,
@@ -45534,7 +45613,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-10.2",
+    version: "2026-07-10.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -45607,6 +45686,8 @@ The graph is also where you land after onboarding \u2014 it is the mission contr
 - **Signal** \u2014 the worst measurable state per seat.
 - **Scoreboard** \u2014 direct work and direct cost on each seat, plus a separate team/subtree rollup for manager seats. The tenant summary counts direct agent work once, so a parent seat's team cost does not double-count the same run again. A seat whose direct cost is a clear outlier above the rest of the fleet is flagged as cost drift (labelled, not colour-only). Human seats and seats with no direct or team runs read calmly rather than showing a bare zero. For a small fleet the Scoreboard also leads with a two-tile summary \u2014 total work and total cost \u2014 framed as the single question that matters: is it earning its keep.
 
+Switching into Cascade never re-runs the chart layout \u2014 seat positions scale in place to fit taller goal-summary cards, and the connector layer scales to match, so nothing rearranges under you. A company-objectives card anchors above the root seat with the active cycle's objectives; selecting one traces and emphasizes its branch down through the connectors while the rest of the chart recedes. Selecting a seat's goal opens the same goal detail panel \`/cascade\` uses, as a right-hand drawer \u2014 breadcrumb ancestry and child-goal rows let you walk the branch without leaving the graph, and an **Open in Cascade** link round-trips the same cycle, branch, and goal selection to the \`/cascade\` page. Lens, objective, goal, seat, and cycle are all URL state, so a reload or a shared link reopens the same view.
+
 The graph also carries a mission-control panel. It pulls the same operational state visible on the agent and setup-health surfaces: held actions that need steward decisions, failed runs, open Friction, pending Signal readings, stale agents, and setup recommendations. Each item can focus the affected seat on the canvas and links to the route where the operator can act.
 
 ## An agent seat's profile
@@ -46350,7 +46431,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-12.3",
+    version: "2026-07-12.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -47030,7 +47111,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_update_cascade_goal\` | \`goal.update\` | Update a goal's title or definition of done. | Tenant | Call with \`goal_id\` and the changed fields. |
 | \`rost_set_cascade_goal_status\` | \`goal.set_status\` | Set a goal's status (on/off/done). | Seat or tenant-admin | Seats may set only their own goals. |
 | \`rost_set_cascade_goal_progress\` | \`goal.set_progress\` | Report a goal's quantified progress (0-100). An agent's progress is a proposal a human approves before the goal moves. | Seat or tenant-admin | Seats set only their own goals; expect confirmation. |
-| \`rost_bind_a_signal_to_a_cascade_goal\` | \`goal.bind_measurable\` | Bind a measurable to a goal. Defaults to role \`informs\` \u2014 a conservative indicator allowed at any goal level (many per goal) that never changes status. Pass role \`drives_status\` to make it the goal's status driver (childless leaf only, one per goal). Human-gated. | Seat or tenant-admin | Call with \`{"goal_id":"<id>","measurable_id":"<id>"}\` (add \`"role":"drives_status"\` for the driver); expect confirmation. |
+| \`rost_bind_a_signal_to_a_cascade_goal\` | \`goal.bind_measurable\` | Bind a measurable to a goal. Defaults to role \`informs\` \u2014 a conservative indicator allowed at any goal level (many per goal) that never changes status. Pass role \`drives_status\` to make it the goal's status driver (childless leaf only, one per goal); a driver requires a \`second_anchor\` (a prior closed period + expected value confirming the Signal matched the books) and promotes an existing \`informs\` binding of the same Signal. Human-gated. | Seat or tenant-admin | Call with \`{"goal_id":"<id>","measurable_id":"<id>"}\` (add \`"role":"drives_status","second_anchor":{"period_start":"2026-Q1","expected_value":0}\` for the driver); expect confirmation. |
 | \`rost_unbind_a_signal_from_a_cascade_goal\` | \`goal.unbind_measurable\` | Remove a goal\u2194measurable binding (role defaults to \`drives_status\`; pass \`"role":"informs"\` to remove an indicator). | Seat or tenant-admin | Call with \`{"goal_id":"<id>","measurable_id":"<id>"}\`. |
 | \`rost_toggle_signal_driven_auto_status\` | \`goal.set_auto_status\` | Per-goal steward opt-in (default OFF) that lets the bound measurable's latest confirmed reading compute the goal's status. Enabling applies the current signal immediately. Human-gated. | Seat or tenant-admin | Call with \`{"goal_id":"<id>","enabled":true}\`; expect confirmation. |
 | \`rost_list_at_risk_cascade_goals\` | \`goal.list_at_risk\` | List goals projected off pace (at-risk or projected-miss) with days behind pace. Read-only; status-only goals excluded. | Tenant | Call with \`{}\`. |
@@ -47599,7 +47680,7 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
     order: 60,
     title: "Cascade guide",
     summary: "How to connect company goals to seat-level work without turning {{brand}} into a project-management tool.",
-    version: "2026-07-12.1",
+    version: "2026-07-12.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -47678,7 +47759,7 @@ On human and function seat pages, goal visibility includes both direct goals and
 
 ## Drive a goal's status from a Signal
 
-A Signal can be linked to a goal for visibility, or set to compute its status. Bind a Signal with \`goal.bind_measurable\`. By default the binding is **informative** (role \`informs\`): it appears as a direct indicator on the goal, is allowed at any level (company objective, parent, or leaf), can be one of many on the same goal, and never changes the goal's status. To let a Signal **drive** a leaf goal's status instead, bind it with \`--role drives_status\` (the goal must be a childless seat goal or milestone \u2014 a company objective or a goal with children rolls up from its children, so a driver there is rejected). A goal can have at most one driving Signal, and choosing a driver is a deliberate, human-gated act.
+A Signal can be linked to a goal for visibility, or set to compute its status. Bind a Signal with \`goal.bind_measurable\`. By default the binding is **informative** (role \`informs\`): it appears as a direct indicator on the goal, is allowed at any level (company objective, parent, or leaf), can be one of many on the same goal, and never changes the goal's status. To let a Signal **drive** a leaf goal's status instead, bind it with \`--role drives_status\` (the goal must be a childless seat goal or milestone \u2014 a company objective or a goal with children rolls up from its children, so a driver there is rejected). A goal can have at most one driving Signal, and choosing a driver is a deliberate, human-gated act. Promoting a Signal to the status driver requires a **second anchor**: a prior closed period plus the value that period's books show (\`second_anchor: { period_start, expected_value }\`). The instantaneous reading is not enough \u2014 the anchor proves the Signal matched reality at least once before it may automatically flip a goal, and it is recorded durably with the confirmation. Confirming a driver over an existing informative binding of the same Signal promotes that binding in place.
 
 A \`drives_status\` binding starts as an indicator only: nothing changes until a steward opts in with \`goal.set_auto_status --enabled true\`. Once opted in, the goal's status is computed from the measurable's latest confirmed reading against its target and direction \u2014 on target reads on-track, below target reads off-track. Only confirmed readings drive status; an agent's draft reading never auto-flips a goal. A human who sets the status by hand pins it, and that pin wins over the computed value until they change it or re-run \`goal.set_auto_status\`. Remove a binding with \`goal.unbind_measurable\`; the goal keeps its last status. Until a binding is opted in, an off-track Signal never raises an at-risk alert on its own.
 
@@ -47706,7 +47787,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-08.1",
+    version: "2026-07-12.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -47794,7 +47875,7 @@ Once a measurable's number lives in a connected system, you can teach {{brand}}
 - \`signal.bind\` persists the validated recipe as an inert \`draft\` binding. It requires the \`preview_token\` from a preview of the same recipe, so nothing is bound that was not first seen working.
 - \`signal.bind_confirm\` is human-only. It activates the binding (\`draft -> active\`); an agent that calls it produces a pending confirmation instead. Only after a human confirms does the scheduled pull begin writing confirmed readings.
 
-Discovery always returns a \`recipe_presets\` array; it is empty when {{brand}} does not recognize a safe source type. Today the proven self-filling path is Baserow REST through \`integration.connect_rest\`: a tenant admin creates or rotates the Baserow connection through the command/vault path, then Signal runs \`integration.discover -> signal.preview -> signal.bind -> signal.bind_confirm\` against that connected source. Baserow row-field recipes and custom filtered-count recipes are supported when the human supplies the real table, field, filter, host, and value path. A first-class filtered-count preset is still a follow-up; do not imply every filtered count appears as a one-click preset. Google Sheets Signal pulls are not live yet: Google uses OAuth JSON credentials and remains withheld from REST presets until the pull executor extracts and refreshes the Google access token instead of treating the stored credential blob as a bearer token. A preset includes a label, cadence, required metadata, a draft \`rest_for_signals\` recipe, and the host allowlist to preview with. The human still fills in the real Baserow table/row/field or exact REST URL and value path before running \`signal.preview\`; presets are starter recipes, not secret stores.
+Discovery always returns a \`recipe_presets\` array; it is empty when {{brand}} does not recognize a safe source type. Today the proven self-filling path is Baserow REST through \`integration.connect_rest\`: a tenant admin creates or rotates the Baserow connection through the command/vault path, then Signal runs \`integration.discover -> signal.preview -> signal.bind -> signal.bind_confirm\` against that connected source. Baserow discovery now offers two first-class presets: \`baserow.row-field\` (read one scalar field from a row) and \`baserow.filtered-count\` (count rows matching a condition). The filtered-count builder takes a table id, field key, comparison operator, and comparison value and assembles a validated \`rest_for_signals\` recipe whose \`value_path\` is the response \`count\`; the field key and operator are allowlisted (they form the query-parameter name) and the comparison value is percent-encoded, so nothing the operator types can inject into the URL. The human still supplies the real table, field, operator, value, and host \u2014 presets and the builder are starter recipes, not secret stores. Google Sheets Signal pulls are not live yet: Google uses OAuth JSON credentials and remains withheld from REST presets until the pull executor extracts and refreshes the Google access token instead of treating the stored credential blob as a bearer token. A preset includes a label, cadence, required metadata, a draft \`rest_for_signals\` recipe, and the host allowlist to preview with. The human still fills in the real Baserow table/row/field or exact REST URL and value path before running \`signal.preview\`; presets are starter recipes, not secret stores.
 
 Recipes are validated data, never code: a read-only GET, a closed set of non-secret headers, and a restricted scalar path to the value. Every fetch passes one SSRF guard (HTTPS only, a steward-confirmed host allowlist set at bind, and a runtime check that the host does not resolve to a private address). The preset output never contains \`nango://\` handles, vault refs, tokens, or static credential headers. Deterministic pulls write \`integration\`-sourced readings on the measurable's cadence.
 
@@ -50321,7 +50402,7 @@ var COMMAND_MANIFEST = [
   { "id": "friction.list", "namespace": "friction", "action": "list", "title": "List Friction issues", "description": "List Friction issues ranked by status, impact, and severity. Defaults to active (open + diagnosing).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["open", "diagnosing", "resolved", "dropped", "active", "all"] }], "hasComplexInput": false, "help": "List Friction issues ranked by impact and severity to find the issue id before updating or resolving it." },
   { "id": "friction.resolve", "namespace": "friction", "action": "resolve", "title": "Resolve Friction issue", "description": 'Resolve an issue with a root cause. In the default "ids" resolution_mode this also creates a remediation follow-up task; "already_fixed" records only the root cause (no follow-up task). Always records a human decision (decided_by) in the same transaction.', "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "resolution_mode", "flag": "resolution-mode", "type": "enum", "required": false, "enumValues": ["ids", "already_fixed"] }, { "name": "root_cause", "flag": "root-cause", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "task_title", "flag": "task-title", "type": "string", "required": false }, { "name": "task_description", "flag": "task-description", "type": "string", "required": false }, { "name": "done_by", "flag": "done-by", "type": "string", "required": false }, { "name": "resolving_seat_id", "flag": "resolving-seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an issue with a root cause and remediation task; resolution is a human decision." },
   { "id": "friction.update_status", "namespace": "friction", "action": "update_status", "title": "Update Friction issue status", "description": "Move a non-terminal issue between open and diagnosing. Terminal issues (resolved/dropped) cannot be reopened here.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": true, "enumValues": ["open", "diagnosing"] }], "hasComplexInput": false, "help": "Move a non-terminal issue between open and diagnosing while it is being worked." },
-  { "id": "goal.bind_measurable", "namespace": "goal", "action": "bind_measurable", "title": "Bind a Signal to a Cascade goal", "description": "Bind a measurable to a goal. Role defaults to 'informs' \u2014 a conservative informative indicator allowed at any goal level (many per goal) that never changes goal status. Role 'drives_status' makes it the goal's status driver: allowed only on a childless seat goal or milestone, at most one per goal, and auto-status starts OFF until a steward opts in with goal.set_auto_status. Binding is human-gated.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": false, "enumValues": ["drives_status", "informs"] }], "hasComplexInput": false, "help": "Bind a Signal to a goal. Defaults to role informs (a conservative indicator at any level that never changes status); pass role drives_status to make it a childless leaf goal's status driver (auto-status starts OFF until a steward opts in)." },
+  { "id": "goal.bind_measurable", "namespace": "goal", "action": "bind_measurable", "title": "Bind a Signal to a Cascade goal", "description": "Bind a measurable to a goal. Role defaults to 'informs' \u2014 a conservative informative indicator allowed at any goal level (many per goal) that never changes goal status. Role 'drives_status' makes it the goal's status driver: allowed only on a childless seat goal or milestone, at most one per goal, requires a second_anchor (a prior closed period + expected value confirming the Signal matched the books), and auto-status starts OFF until a steward opts in with goal.set_auto_status. Binding a driver over an existing informs binding of the same Signal promotes it. Binding is human-gated.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": false, "enumValues": ["drives_status", "informs"] }], "hasComplexInput": true, "help": "Bind a Signal to a goal. Defaults to role informs (a conservative indicator at any level that never changes status); pass role drives_status with a second_anchor (a prior closed period + expected value confirming the Signal matched the books) to make it a childless leaf goal's status driver \u2014 this promotes an existing informs binding (auto-status starts OFF until a steward opts in)." },
   { "id": "goal.create", "namespace": "goal", "action": "create", "title": "Create Cascade goal", "description": "Create a cycle goal under an existing objective. The parent chain must terminate at a Compass objective in the same cycle (enforced server-side).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "cycle_id", "flag": "cycle-id", "type": "string", "required": true }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_goal_id", "flag": "parent-goal-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "definition_of_done", "flag": "definition-of-done", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["on", "off"] }], "hasComplexInput": false, "help": "Create cycle goals under an existing objective; the parent chain must terminate at a Compass objective." },
   { "id": "goal.drop", "namespace": "goal", "action": "drop", "title": "Drop Cascade goal", "description": "Drop (retire) a goal by setting status to dropped. Dropping retires the commitment, so it is human-gated. The row is retained for audit (never deleted).", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Drop a goal to retire a commitment; the goal is retained for audit and dropping is human-gated." },
   { "id": "goal.get", "namespace": "goal", "action": "get", "title": "Get Cascade goal", "description": "Get one goal's core detail and status by id. Seat-scoped callers may only read their own seat's goals.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Get one goal's core detail and status by id; seat tokens may only read their own goals." },