@rosthq/cli 0.7.79 → 0.7.81

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAkQ3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAmQ3D,CAAC"}

package/dist/index.js

@@ -39451,6 +39451,113 @@ var agentCreateFromTemplateOutputSchema = agentSetupStateSchema.extend({
   occupancy_created: external_exports.boolean()
 }).strict();
 
+// ../../packages/protocol/src/agent-definition-import.ts
+var boundedTextSchema = external_exports.string().trim().min(1).max(2e3);
+var shortTextSchema = external_exports.string().trim().min(1).max(240);
+var forbiddenImportKeys = /* @__PURE__ */ new Set([
+  "credential",
+  "credentials",
+  "secret",
+  "secrets",
+  "api_key",
+  "apiKey",
+  "token",
+  "vault_ref",
+  "vaultRef",
+  "tenant_id",
+  "tenantId",
+  "seat_id",
+  "seatId",
+  "parent_seat_id",
+  "parentSeatId",
+  "steward_seat_id",
+  "stewardSeatId",
+  "integration_id",
+  "integrationId"
+]);
+function rejectForbiddenImportShape(value, ctx, path8 = []) {
+  if (value === null || value === void 0) {
+    return;
+  }
+  if (typeof value === "string") {
+    if (hasSecretShapedValue(value)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: path8,
+        message: "Definition imports cannot contain secret-shaped values. Provide credentials later through vault-backed connection flows."
+      });
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => rejectForbiddenImportShape(item, ctx, [...path8, index]));
+    return;
+  }
+  if (typeof value !== "object") {
+    return;
+  }
+  for (const [key, nested] of Object.entries(value)) {
+    const nestedPath = [...path8, key];
+    if (forbiddenImportKeys.has(key)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: nestedPath,
+        message: "Definition imports cannot carry credentials or tenant-local placement identifiers."
+      });
+    }
+    rejectForbiddenImportShape(nested, ctx, nestedPath);
+  }
+}
+var agentDefinitionImportToolSchema = external_exports.object({
+  capability_id: external_exports.string().trim().min(1).max(160),
+  access: external_exports.enum(["read", "draft", "write_with_approval"]).default("read"),
+  rationale: external_exports.string().trim().max(360).optional()
+}).strict();
+var agentDefinitionImportFileSchema = external_exports.object({
+  format: external_exports.literal("rost.agent_definition"),
+  version: external_exports.literal(1),
+  agent: external_exports.object({
+    name: shortTextSchema,
+    purpose: boundedTextSchema,
+    responsibilities: external_exports.array(shortTextSchema).min(1).max(12),
+    success_criteria: external_exports.array(shortTextSchema).min(1).max(12),
+    never_do_alone: external_exports.array(shortTextSchema).min(1).max(12),
+    lane: external_exports.enum(["cloud", "runner", "mcp_session"]).default("cloud"),
+    model_tier: external_exports.enum(AGENT_MODEL_TIERS).optional(),
+    requested_tools: external_exports.array(agentDefinitionImportToolSchema).max(50).default([])
+  }).strict()
+}).strict().superRefine((value, ctx) => rejectForbiddenImportShape(value, ctx));
+var definitionJsonSchema = external_exports.string().trim().min(1).max(65536).transform((value, ctx) => {
+  try {
+    return JSON.parse(value);
+  } catch {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Definition import must be valid JSON." });
+    return external_exports.NEVER;
+  }
+}).pipe(agentDefinitionImportFileSchema);
+var agentDefinitionImportInputSchema = external_exports.object({
+  definition_json: definitionJsonSchema,
+  idempotency_key: external_exports.string().trim().min(1).max(120).optional()
+}).strict();
+var agentDefinitionImportMappingSchema = external_exports.object({
+  method: external_exports.literal("import"),
+  source_hash: external_exports.string().length(64),
+  seat_name: external_exports.string(),
+  lane: external_exports.enum(["cloud", "runner", "mcp_session"]),
+  model_tier: external_exports.enum(AGENT_MODEL_TIERS).nullable(),
+  requested_tools: external_exports.array(agentDefinitionImportToolSchema),
+  unsupported: external_exports.array(external_exports.object({
+    field: external_exports.string(),
+    reason: external_exports.string()
+  }).strict()).default([])
+}).strict();
+var agentDefinitionImportOutputSchema = external_exports.object({
+  setup: agentSetupStateSchema,
+  mapping: agentDefinitionImportMappingSchema,
+  created: external_exports.boolean(),
+  idempotency_key: external_exports.string().nullable()
+}).strict();
+
 // ../../packages/protocol/src/provider-costs.ts
 var providerCostKinds = ["managed_llm", "exa", "browser", "sandbox"];
 var providerCostKindSchema = external_exports.enum(providerCostKinds);
@@ -42396,10 +42503,12 @@ var charterDraftInputSchema = external_exports.object({
 var charterDraftOutputSchema = external_exports.object({
   charter_version_id: uuidSchema11,
   seat_id: uuidSchema11,
+  edit_revision: external_exports.number().int().min(1).optional(),
   doc: external_exports.unknown()
 }).strict();
 var charterUpdateDraftInputSchema = external_exports.object({
   charter_version_id: uuidSchema11,
+  expected_edit_revision: external_exports.number().int().min(1).optional(),
   // DER-785 (Part G): the full Charter document contract (was `z.unknown()`).
   // The DB layer already validated this with `charterSchema.parse`; advertising
   // it here gives `command.describe`/`rost command schema` a real shape and a
@@ -42413,7 +42522,8 @@ var charterSetInputSchema = external_exports.object({
 }).strict();
 var charterMutationOutputSchema = external_exports.object({
   charter_version_id: uuidSchema11,
-  seat_id: uuidSchema11
+  seat_id: uuidSchema11,
+  edit_revision: external_exports.number().int().min(1).optional()
 }).strict();
 var charterApproveInputSchema = external_exports.object({
   seat_id: uuidSchema11.optional(),
@@ -42422,6 +42532,7 @@ var charterApproveInputSchema = external_exports.object({
   // These fields are shallow-merged onto the existing draft, then the merged doc
   // is re-validated against the full schema at persist time.
   edits: charterDocEditsSchema.optional(),
+  expected_edit_revision: external_exports.number().int().min(1).optional(),
   apply_seat_type: external_exports.boolean().default(false)
 }).strict().refine((input) => Boolean(input.seat_id) || Boolean(input.charter_version_id), {
   message: "Provide seat_id or charter_version_id.",
@@ -44234,6 +44345,11 @@ var READ_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 var brokerScopeTierSchema = external_exports.enum(["read", "write"]);
 var brokerInjectionModeSchema = external_exports.enum(["header_bearer", "header", "query"]);
 var brokerInjectionNameSchema = external_exports.string().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "injection_name may contain only letters, digits, . _ -");
+var brokerInjectionPrefixSchema = external_exports.string().min(1).max(32).refine((value) => ![...value].some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127), {
+  message: "injection_prefix must not contain control characters"
+}).refine((value) => !hasSecretShapedValue(value), {
+  message: 'injection_prefix must be config (e.g. "Token "), never raw secret material'
+});
 var brokerAllowedMethodsSchema = external_exports.array(brokerHttpMethodSchema).min(1, "at least one allowed method is required").max(7).refine((methods) => new Set(methods).size === methods.length, { message: "allowed_methods must not contain duplicates" });
 var brokerGrantStatusSchema = external_exports.enum(["active", "revoked"]);
 function refineGrantShape(value, ctx) {
@@ -44279,6 +44395,9 @@ var secretGrantGrantInputSchema = external_exports.object({
   scope_tier: brokerScopeTierSchema,
   injection_mode: brokerInjectionModeSchema.default("header_bearer"),
   injection_name: brokerInjectionNameSchema.optional(),
+  // DER-1785: prepended to the secret for header/query grants; invalid for
+  // header_bearer (whose `Bearer ` prefix is implicit — see the refine below).
+  injection_prefix: brokerInjectionPrefixSchema.optional(),
   // ISO-8601; absent = no expiry.
   expires_at: external_exports.string().datetime({ offset: true }).optional()
 }).strict().superRefine((value, ctx) => {
@@ -44291,6 +44410,13 @@ var secretGrantGrantInputSchema = external_exports.object({
       message: "provide exactly one of vault_ref or credential_id"
     });
   }
+  if (value.injection_mode === "header_bearer" && value.injection_prefix !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["injection_prefix"],
+      message: "injection_prefix is not valid for header_bearer mode (its Bearer prefix is implicit)"
+    });
+  }
 });
 var secretGrantGrantOutputSchema = external_exports.object({
   grant_id: uuid10,
@@ -44317,6 +44443,7 @@ var secretGrantSummarySchema = external_exports.object({
   scope_tier: brokerScopeTierSchema,
   injection_mode: brokerInjectionModeSchema,
   injection_name: external_exports.string().nullable(),
+  injection_prefix: external_exports.string().nullable(),
   status: brokerGrantStatusSchema,
   granted_by_user_id: uuid10,
   granted_at: external_exports.string(),
@@ -46609,7 +46736,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-13.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -46684,6 +46811,8 @@ AICOS also has an explicit brain selection. Cloud can use the included managed a
 
 Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from scheduled work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same scheduled-work slot. Scheduled and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. For execute-ready runners, the claim also carries a server-built Seat work contract that names the governed runtime profile, the AICOS context-loader tool, and the Seat's permission manifest; action attempts still route through command guards, tool-call audit, and pending confirmations. The runner treats loaded tenant clock, context, and contract as authoritative instead of substituting its own runtime clock, local files, or self-invented authority. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
 
+Agent seat pages can also expose a direct persistent chat with that seat's active agent. This is different from Seat-scoped AICOS: the target is the agent occupying the seat, the transcript is keyed by tenant, user, purpose, and target agent, and the same user can keep separate active threads for different agents. Owners and admins can read direct-agent transcripts for the tenant, and a human occupying the agent seat's Steward seat can read the transcript; unrelated members cannot. New prompts for a target agent enter an agent-scoped queue with a short turn deadline. A second prompt in the same thread coalesces into the pending turn until that turn is claimed, while prompts for another user or another agent keep their own queue position. Direct agent chat never dispatches through \`work_orders\`; scheduled and Forge runner work still use \`work_orders\`.
+
 Cloud and runner submissions carry a stable request ID. Distinct requests that compete while a turn is active receive HTTP \`409\` with code \`AICOS_TURN_CONFLICT\`; the losing request writes no partial user message and consumes none of its attachments. Runner acquisition commits its user message, execution, attachment links, queued transcript projection, and session snapshot together, so a failed projection leaves none of them half-written. Retrying the same request ID returns the original turn and does not rerun the model, builder, onboarding, or runner-queue side effects, even if the currently selected lane or runner readiness changed after the original submission.
 
 When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The turn row records claim/start/finish timing, terminal reason, model label, and token counts when the runner or cloud path provides them. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If the runner answer includes a validated in-app link, the web panel can surface the same consent-required navigation suggestion once polling sees that the pending turn is terminal. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
@@ -47441,7 +47570,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-13.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47497,6 +47626,8 @@ The native Gmail handlers run inside the same broker boundary as the REST and Sl
 
 Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose/send and Sheets, stores the returned credential in the vault, and records only account, scope, and capability-availability metadata in the integration row. Partial grants are accepted when at least one connector capability is usable; missing or revoked scopes reduce the affected capability instead of granting more authority. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail read/draft/send, bounded Sheets read, and approval-held Sheets write handlers run through the guarded broker when Google is connected; connecting Google still does not bypass the signed Charter manifest, tenant policy ceiling, credential vault, or tool-call audit. Sheet grants should use exact signed argument bindings for approved spreadsheet ids and ranges.
 
+A connected Baserow REST integration (\`integration.connect_rest\`) derives a \`baserow.read\` tenant capability ceiling the same way: a live connection surfaces read, and a disconnected/revoked one collapses to off. The derivation is read-only by design \u2014 \`baserow.write\` is never inferred from the connection and is granted only through an explicit per-seat brokered secret grant, matching the conservative-by-default rule for every connection-backed ceiling.
+
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
 
 \`integration.connect_rest\` creates or rotates the supported Baserow REST integration through the credential flow. It stores the token in the vault, persists only endpoint/account metadata plus a tenant-scoped integration row, marks the adapter as \`rest\`, and returns no vault ref or secret. Because the input includes a raw secret, generated CLI argv refuses the command and it is deliberately not exposed as an agent-callable MCP tool; run it from Settings or the command API credential flow instead of shell arguments.
@@ -47587,7 +47718,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-13.8",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48175,6 +48306,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_user_to_seat\` | \`staffing.assign_user\` | Assign a human user occupancy to a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`user_id\`. |
 | \`rost_assign_dry_run_agent_to_seat\` | \`staffing.assign_agent_dry_run\` | Assign an agent occupancy in dry-run mode. | Seat or tenant-admin | Call only after Steward chain is clear. |
 | \`rost_staff_seat\` | \`staffing.assign\` | Compatibility helper for human, agent, or hybrid staffing. | Seat or tenant-admin | Call with \`seat_id\` and \`occupant\`. |
+| \`rost_import_agent_definition\` | \`agent.import_definition\` | Import a strict, versioned agent definition into a canonical draft Seat/setup without credentials, placement ids, or go-live side effects. | Tenant | Human-gated; call with \`definition_json\` and optional \`idempotency_key\`. Review the resulting draft setup before tools, dry run, or go-live. |
 | \`rost_go_live\` | \`agent.go_live\` | Promote a dry-run agent seat to live. | Seat or tenant-admin | Call after human approval. |
 | \`rost_create_mcp_token\` | \`mcp_token.create\` | Mint a tenant-admin or seat-scoped MCP token. | Tenant | Prefer \`{{cli}} mcp install\` for users. |
 | \`rost_revoke_mcp_token\` | \`mcp_token.revoke\` | Revoke an MCP token immediately. | Tenant | Call with \`token_id\`. |
@@ -48380,11 +48512,11 @@ Preview deployment creation is a governed command. \`software_factory.vercel.dep
 
 #### Secret broker grants (tenant-level)
 
-Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. To grant, pass \`credential_id\` (from \`credential.list\`, DER-1777) instead of a raw \`vault_ref\` \u2014 the command resolves the ref server-side so no product flow ever exposes it. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and stores the full \`Token <key>\` string as its vault secret.
+Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. To grant, pass \`credential_id\` (from \`credential.list\`, DER-1777) instead of a raw \`vault_ref\` \u2014 the command resolves the ref server-side so no product flow ever exposes it. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and \`injection_prefix: "Token "\` (DER-1785) \u2014 the broker prepends the prefix to the raw key at render time, so the credential's vault secret stays the RAW key and granting it by \`credential_id\` renders \`Authorization: Token <key>\` correctly. (\`injection_prefix\` is non-secret config, capped at 32 chars, rejects control characters, and is invalid for \`injection_mode: "header_bearer"\`, whose \`Bearer \` prefix is implicit.) Older grants that instead stored the full \`Token <key>\` string as the vault secret with no prefix still work \u2014 the broker injects that verbatim.
 
 | Tool | Command | What it does | Scope | Notes |
 |---|---|---|---|---|
-| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access. Supply exactly one of credential_id (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side, so a human never handles a ref) or vault_ref directly. Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","credential_id":"<credential-id>"} (or "vault_ref":"infisical://prod/baserow-token" instead of credential_id). |
+| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access. Supply exactly one of credential_id (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side, so a human never handles a ref) or vault_ref directly. Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","injection_prefix":"Token ","credential_id":"<credential-id>"} (or "vault_ref":"infisical://prod/baserow-token" instead of credential_id). injection_prefix is optional; use it (DER-1785) when the credential stores a RAW key so the broker renders "Token <key>". |
 | \`rost_revoke_a_brokered_secret_grant\` | \`secret_grant.revoke\` | Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat egress immediately; the next broker call fails closed). Owner-only and human-gated. | Tenant-admin | Call with {"grant_id":"<grant-id>"}; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_stored_credentials\` | \`credential.list\` | List the tenant's stored credentials as metadata only \u2014 credential id, provider, label, seat, status, and created/rotated/revoked dates. NEVER returns the vault ref or any secret. Use the returned credential_id with secret_grant.grant. | Tenant-admin | Call with {}. |
 
@@ -48733,7 +48865,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-06-27.2",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -48805,21 +48937,22 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 8. add-agents-guide
 9. custom-agents-guide
 10. agent-builder-guide
-11. how-agents-work
-12. tool-access-and-vault
-13. available-tools-guide
-14. mcp-and-cli-guide
-15. skill-builder-guide
-16. agent-skill-authoring-guide
-17. agent-skill-setup-guide
-18. ai-model-data-handling-guide
-19. cascade-guide
-20. signal-guide
-21. friction-guide
-22. confirmations-guide
-23. steward-queue-guide
-24. sync-rhythm-playbook
-25. billing-and-pricing-guide
+11. agent-definition-import-guide
+12. how-agents-work
+13. tool-access-and-vault
+14. available-tools-guide
+15. mcp-and-cli-guide
+16. skill-builder-guide
+17. agent-skill-authoring-guide
+18. agent-skill-setup-guide
+19. ai-model-data-handling-guide
+20. cascade-guide
+21. signal-guide
+22. friction-guide
+23. confirmations-guide
+24. steward-queue-guide
+25. sync-rhythm-playbook
+26. billing-and-pricing-guide
 
 ## Workflow to guide map
 
@@ -48834,6 +48967,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Add an agent through the app (graph or sidebar, visual journey): add-agents-guide.
 - Create an agent from a template: stock-agents-guide, then how-agents-work.
 - Create a custom agent (operational answers, Charter Builder, configure tools, dry run, go live): custom-agents-guide, then agent-staffing-playbook and tool-access-and-vault.
+- Import a versioned agent definition file: agent-definition-import-guide, then agent-staffing-playbook and tool-access-and-vault.
 - Create, import, review, or publish a reusable Skill: skill-builder-guide for human workflow, then agent-skill-authoring-guide for CLI/MCP authoring rules.
 - Assign, dependency-check, enable a catalog Skill, import a GitHub Skill, or sync local Skill files: agent-skill-setup-guide, then mcp-and-cli-guide.
 - Explain AI model data handling, BYOK, local agent provider settings, or what data may enter prompts/tool calls: ai-model-data-handling-guide, then security-model-guide.
@@ -48854,7 +48988,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Company setup: rost-implementation-method, compass-authoring-guide, aicos-chat-guide, settings-guide, settings-members-and-invites-guide
 - Graph design: responsibility-graph-playbook
 - Charter design: charter-design-playbook, charter-authoring-deep-dive
-- Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
+- Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, agent-definition-import-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
 - Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
 - Local agents and runners: mcp-and-cli-guide, runner-guide, agent-reference-map
 - Security and troubleshooting: ai-model-data-handling-guide, security-model-guide, troubleshooting-guide
@@ -49240,7 +49374,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-13.1",
+    version: "2026-07-14.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -49279,6 +49413,8 @@ When an **agent** triggers a gate, {{brand}} also notifies the seat's steward (S
 
 Approval replays are validated again before execution. If the stored confirmation input no longer matches the original command schema, the approval fails without consuming the pending confirmation or running the durable command; reject it and re-issue the gated action from the current product surface.
 
+A held tool call actuates the same way regardless of which command backs it \u2014 a connector write (like \`gmail.send\`) and a durable command (like \`task.create\`) both replay through the same governed command executor on approval: re-checked against the live permission manifest, reserved so a second approval or replay can never double-actuate, and audited with a fresh \`tool_calls\` row. Resolving the escalation that raised the hold \u2014 over the CLI, MCP, or \`/approvals\` \u2014 actuates identically; none of those paths silently drops the held action once a human approves it.
+
 \`\`\`bash
 # Human approves a pending confirmation
 {{cli}} command confirmation.approve --json '{"confirmation_id":"<confirmation-id>"}'
@@ -49288,7 +49424,7 @@ Approval replays are validated again before execution. If the stored confirmatio
 
 ## The approvals queue
 
-The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act.
+The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
 
 ## The rule for agents
 
@@ -49412,7 +49548,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-11.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49435,7 +49571,7 @@ Start with members and invites, then provider and channel connections, then MCP
 
 ## Navigating Settings
 
-Settings is reached from the footer gear in the left sidebar (the nav collapse moved it out of the primary item list). It is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections, Advanced) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
+Settings is reached from the footer gear in the left sidebar (the nav collapse moved it out of the primary item list). It is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections, Advanced) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Any other \`integrations\` row \u2014 e.g. a Baserow REST/custom connection created through \`integration.connect_rest\` \u2014 renders as a generic connection card alongside the stock providers, so a non-stock connector is never invisible on this page. Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
 
 Section state is fully server-side: every in-app link, redirect, and save uses \`?section=<id>\`, never a \`#anchor\` \u2014 there is no client-side hash shim to desync from. Documented shortcut pages redirect straight to the right section instead of a dead end: \`/settings/integrations\` and \`/readiness\` redirect to \`?section=connections\` (connector readiness lives inside the Connections overview, not on a standalone page), \`/settings/members\` redirects to \`?section=members\`, \`/settings/policy\` redirects to \`?section=guardrails\`, and MCP/CLI access tokens live in the Agent access tokens section (not a separate \`/mcp\` page \u2014 \`/mcp\` is the MCP protocol endpoint itself, not a browsable settings screen). The Advanced group links out to \`/migration/ninety\`, the one settings-adjacent page with no home in the grouped rail. Every settings form carries the section it lives in, so saving a change redirects back to that same section with no flash, instead of returning to the top.
 
@@ -49574,7 +49710,7 @@ When a user asks to add a person, clarify whether they mean app access, seat occ
     order: 74,
     title: "Notifications guide",
     summary: "How {{brand}} should notify humans about decisions, escalations, stale work, and agent boundaries.",
-    version: "2026-07-09.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -49605,6 +49741,10 @@ Notifications should move decisions to the right human without turning {{brand}}
 
 \`{{cli}} notification errors --limit 10\` / \`notification.list_errors\` / \`rost_list_notification_errors\` returns recent failed deliveries. When a failed notification links to a product error, it includes \`error_log_id\`, \`source\`, and any linked \`seat_id\` / \`run_id\`; \`source=run\` means the notification is tied to an agent run and can be followed with \`agent.get_run\` for the transcript reference and run errors.
 
+## Telegram channel
+
+Telegram is an opt-in delivery channel that sits alongside email. A workspace admin connects a Telegram bot once (create it with @BotFather, paste the token in Settings \u2192 Notifications; the token is stored in the vault as a credential reference, never in env or logs). Each person then opts in from the same page: {{brand}} shows a one-time deep link, you start the bot, and {{brand}} verifies your chat. Once verified, held approvals, escalations, briefs, and the daily digest are delivered to Telegram, with email as the fallback. Messages are bounded and secret-free and link back to the relevant {{brand}} item. Opt out any time from Settings \u2192 Notifications.
+
 ## Keep notifications useful
 
 Every notification should include the seat, cause, evidence, and requested decision. Avoid status-only messages when no action is needed.`
@@ -50699,6 +50839,72 @@ The Charter you submit for an agent seat is the full Charter document (see the c
 ## Show your human a review
 
 When you have built the setup, render a clean markdown card for your human before go-live: \`{{cli}} agent show --seat-id <id> --markdown\` (or \`{{cli}} charter show --seat-id <id> --markdown\` / \`{{cli}} compass show --markdown\`). The card composes the setup, model, steward, tools, and Charter into one skimmable readout. Then surface the go-live for a human to approve \u2014 go-live is human-gated and a seat token never goes live on its own setup.`
+  },
+  {
+    slug: "agent-definition-import-guide",
+    order: 44,
+    title: "Agent definition import guide",
+    summary: "The strict versioned JSON format for importing an agent as a draft Seat/setup without credentials, placement ids, or go-live side effects.",
+    version: "2026-07-15.1",
+    public: true,
+    audiences: ["human", "cli", "mcp", "in_app_agent"],
+    stages: ["staffing", "charter_design"],
+    relatedCommandIds: ["agent.import_definition", "agent.create_custom", "agent_setup.get", "agent.configure_tools"],
+    legal: {
+      publicRisk: "low",
+      notes: [
+        "Documents a ROST-native import contract only.",
+        "Explicitly excludes credentials and tenant-local identifiers from the import file."
+      ]
+    },
+    sources: [
+      {
+        label: "Agent definition import spec",
+        internalPath: "docs/specs/agent-definition-import.md",
+        note: "Internal source for the versioned import JSON example and safety rules."
+      }
+    ],
+    body: `# Agent definition import guide
+
+Use \`agent.import_definition\` when you already have a bounded agent description and want to turn it into a draft {{brand}} agent setup. Import is a starting point, not go-live.
+
+The command creates a draft agent Seat, starts the canonical setup flow, maps the definition into operational answers, and returns \`agent_setup.get\` state. It does not sign the Charter, grant tools, store credentials, run a dry run, or approve go-live.
+
+## Safety rules
+
+- The file must use \`"format": "rost.agent_definition"\` and \`"version": 1\`.
+- Unknown fields are rejected.
+- Credentials, vault refs, API keys, tokens, tenant ids, Seat ids, parent ids, steward ids, and integration ids are rejected.
+- Secret-shaped string values are rejected even when they appear in otherwise allowed fields.
+- Requested tools are review context only. Grants and credential ingress still happen through setup.
+- Placement is server-side. The import file cannot choose a parent Seat or Steward.
+
+## Example
+
+\`\`\`json
+{
+  "format": "rost.agent_definition",
+  "version": 1,
+  "agent": {
+    "name": "Customer Follow-up Agent",
+    "purpose": "Prepare account follow-ups for steward review.",
+    "responsibilities": ["Summarize recent customer signals", "Draft follow-up tasks"],
+    "success_criteria": ["Stewards receive concise weekly follow-up drafts"],
+    "never_do_alone": ["Send external customer messages", "Change billing or credentials"],
+    "lane": "cloud",
+    "model_tier": "balanced",
+    "requested_tools": [
+      {
+        "capability_id": "google.gmail.read",
+        "access": "read",
+        "rationale": "Read recent customer context"
+      }
+    ]
+  }
+}
+\`\`\`
+
+After import, continue from the draft Seat page. Review the Charter, choose a Steward, configure tools and connections, sign the manifest, run a dry run, and approve go-live only when the human review is complete.`
   }
 ];
 
@@ -51547,6 +51753,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.fleet_digest", "namespace": "agent", "action": "fleet_digest", "title": "Get dogfood fleet health digest", "description": "Return a daily tenant fleet health digest with live/idle state, run counts, spend, failed runs, unresolved product errors, notification errors, and next actions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "window_hours", "flag": "window-hours", "type": "integer", "required": false }, { "name": "error_limit", "flag": "error-limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Capture a daily dogfood fleet health digest with fleet state, run counts, spend, failed runs, unresolved errors, failed notifications, and next actions." },
   { "id": "agent.get_run", "namespace": "agent", "action": "get_run", "title": "Get agent run diagnostics", "description": "Return one seat run's diagnostic record: run status, transcript reference, token/cost usage, outcome, and linked product-visible run errors.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "run_id", "flag": "run-id", "type": "string", "required": true }, { "name": "transcript", "flag": "transcript", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Read one run's diagnostic record, transcript reference, token/cost usage, outcome, and linked product-visible errors." },
   { "id": "agent.go_live", "namespace": "agent", "action": "go_live", "title": "Go live", "description": "Promote a dry-run agent seat to live after the human approval gate.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Move an agent live only after dry-run evidence, signed permissions, and a human Steward chain are clear.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
+  { "id": "agent.import_definition", "namespace": "agent", "action": "import_definition", "title": "Import agent definition", "description": "Import a versioned ROST agent definition into a canonical draft Seat and setup state without credentials, placement identifiers, or go-live side effects.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "definition_json", "flag": "definition-json", "type": "string", "required": true }, { "name": "idempotency_key", "flag": "idempotency-key", "type": "string", "required": false }], "hasComplexInput": false, "help": "Import a strict, versioned ROST agent definition into a canonical draft Seat/setup. The file cannot carry credentials or tenant-local placement ids; tools remain proposal-only until reviewed through setup." },
   { "id": "agent.list_fleet", "namespace": "agent", "action": "list_fleet", "title": "List agent fleet", "description": "Return every agent-occupied seat with lane, live state, last real turn, recent turn counts, top measurable status, open escalations, and 7-day real-run spend.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read every agent-occupied seat at once: lane, live state, last real turn, 24h/7d turns, measurable status, escalations, and spend." },
   { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call and guard-denial counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call and guard-held counts (the Trust Card)." },
   { "id": "agent.list_tool_calls", "namespace": "agent", "action": "list_tool_calls", "title": "List agent tool calls", "description": "Return a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Pass held_only to return only guard-held calls. Never returns argument summaries or secret material.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }, { "name": "held_only", "flag": "held-only", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Audit a seat's tool-call ledger with each call's guard result; held actions are the hero metric." },
@@ -51566,7 +51773,7 @@ var COMMAND_MANIFEST = [
   { "id": "aicos.brain_settings.update", "namespace": "aicos", "action": "brain_settings.update", "title": "Update AICOS brain settings", "description": "Update the AICOS lane and cloud/runner brain preferences. Owner-only and audited.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "runner", "mcp"] }, { "name": "cloud_brain", "flag": "cloud-brain", "type": "enum", "required": false, "enumValues": ["managed", "byok"] }, { "name": "runner_brain", "flag": "runner-brain", "type": "enum", "required": false, "enumValues": ["claude-cli", "codex-cli"] }, { "name": "cloud_model_slug", "flag": "cloud-model-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "Owner-only update for AICOS cloud managed/BYOK and runner Claude/Codex preferences; BYOK requires an active tenant Anthropic key." },
   { "id": "cascade.import", "namespace": "cascade", "action": "import", "title": "Import Rocks from a ninety Rocks export", "description": "Bulk-import a ninety Rocks export into the Cascade as cycle goals under a company objective in the active cycle. Owners are seat names resolved to seats. Requires an active cycle and a target company objective (auto-selected when exactly one exists, else pass parent_objective_id). Idempotent \u2014 re-importing the same export is a no-op, and an existing cycle goal with the same objective + seat + title is skipped.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }, { "name": "parent_objective_id", "flag": "parent-objective-id", "type": "string", "required": false }], "hasComplexInput": true, "help": "Import a ninety Rocks export into the Cascade as cycle goals under a company objective in the active cycle; owners resolve to seats." },
   { "id": "charter.apply_seat_type_recommendation", "namespace": "charter", "action": "apply_seat_type_recommendation", "title": "Apply Charter seat-type recommendation", "description": "Apply the seat-type recommendation from a draft Charter.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Apply seat-type recommendations only after the Charter clarifies work shape, risk, and Steward accountability." },
-  { "id": "charter.approve", "namespace": "charter", "action": "approve", "title": "Approve charter", "description": "Approve a draft Charter as a human owner.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": false }, { "name": "apply_seat_type", "flag": "apply-seat-type", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Charter approval is a human decision that activates the seat's operating contract." },
+  { "id": "charter.approve", "namespace": "charter", "action": "approve", "title": "Approve charter", "description": "Approve a draft Charter as a human owner.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": false }, { "name": "expected_edit_revision", "flag": "expected-edit-revision", "type": "integer", "required": false }, { "name": "apply_seat_type", "flag": "apply-seat-type", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Charter approval is a human decision that activates the seat's operating contract." },
   { "id": "charter.draft", "namespace": "charter", "action": "draft", "title": "Draft charter", "description": "Create or fetch a draft Charter for a seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Draft Charters that define purpose, responsibilities, decision authority, measurables, tools, budget, and escalation; the charter authoring deep-dive shows what good looks like per field." },
   { "id": "charter.draft_all", "namespace": "charter", "action": "draft_all", "title": "Draft all charters", "description": "Draft Charters for every eligible seat in a tenant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Draft Charters in onboarding order after the Responsibility Graph has enough seat clarity.", "example": {} },
   { "id": "charter.get", "namespace": "charter", "action": "get", "title": "Get Charter", "description": "Return a Charter version with its supersession history and latest dry-run status.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read a Charter with its supersession history and dry-run status before approving or signing a manifest." },
@@ -51575,7 +51782,7 @@ var COMMAND_MANIFEST = [
   { "id": "charter.show_markdown", "namespace": "charter", "action": "show_markdown", "title": "Show Charter as markdown", "description": "Compose a seat's active or latest Charter into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Render a seat's active or latest Charter as a clean markdown card to show your human a quick review." },
   { "id": "charter.sign_manifest", "namespace": "charter", "action": "sign_manifest", "title": "Sign charter manifest", "description": "Request human confirmation for a Charter permission manifest.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Sign tool manifests only when the Charter explains why the tool is needed and how it is bounded." },
   { "id": "charter.skip", "namespace": "charter", "action": "skip", "title": "Skip charter draft", "description": "Mark a draft Charter as skipped.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Skip a Charter only when the seat is intentionally out of scope for the current onboarding pass." },
-  { "id": "charter.update_draft", "namespace": "charter", "action": "update_draft", "title": "Update charter draft", "description": "Update a draft Charter document.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Submit the full Charter document directly (purpose, decision_authority, escalation_rules, measurables, budget, permission_manifest); read the charter authoring deep-dive for what good looks like per field. Durable authority changes still need human approval.", "example": { "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc", "doc": { "payload_version": 1, "purpose": "AP intake clerk: draft accounts-payable invoice entries from inbound vendor emails for human review.", "accountabilities": [{ "title": "Draft every inbound invoice", "description": "Convert each inbound vendor invoice into a draft AP entry with the correct vendor, amount, and GL coding within one business day." }, { "title": "Flag discrepancies", "description": "Surface duplicate, mismatched, or out-of-policy invoices as Friction issues instead of drafting them silently." }], "decision_authority": { "autonomous": [{ "action": "Draft AP entries and propose GL coding from inbound invoices", "condition": "Allowed when the vendor is known and the amount is within the standard purchase range.", "rationale": "Drafting is reversible and reviewed by a human before posting.", "unanswered_boundary": false }], "approval": [{ "action": "Post an invoice or send any vendor-facing message", "condition": "Require explicit human approval before posting or sending.", "rationale": "Posting and sending are durable, money-moving actions.", "unanswered_boundary": false }], "escalate": [{ "action": "Unknown vendor, payment over the approval threshold, or a suspected duplicate", "condition": "Always escalate to the Steward before acting.", "rationale": "Conservative default for ambiguous, irreversible, or financial exposure.", "unanswered_boundary": true }] }, "escalation_rules": ["Escalate any invoice over $5,000 or from a vendor not already in the ledger.", "Escalate when an invoice appears to duplicate one already drafted or posted."], "measurables": [{ "name": "Invoices drafted within one business day", "target": "100%", "cadence": "weekly", "source": "agent" }, { "name": "Discrepancies caught before posting", "target": "\u2265 95%", "cadence": "monthly", "source": "human" }], "permission_manifest": [{ "tool": "ap.invoices.read", "scope": "Read inbound invoices and the vendor ledger.", "granted": true, "rationale": "Needed to draft entries from source invoices." }, { "tool": "email.draft", "scope": "Draft vendor replies for human review; never send.", "granted": true, "rationale": "Lets the seat prepare clarifications without taking a send action." }], "budget": { "monthly_usd": null, "approval_required_over_usd": 0, "notes": "No autonomous spend; any spend requires Steward approval until a budget is set." }, "unanswered_boundaries": ["Approval threshold for auto-posting", "Vendor onboarding authority"], "seat_type_recommendation": { "recommendation": "agent", "rationale": "The work is high-volume, rule-bound, and fully reviewable, which suits a draft-and-confirm agent under a human Steward.", "confidence": 0.8 } } } },
+  { "id": "charter.update_draft", "namespace": "charter", "action": "update_draft", "title": "Update charter draft", "description": "Update a draft Charter document.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }, { "name": "expected_edit_revision", "flag": "expected-edit-revision", "type": "integer", "required": false }], "hasComplexInput": true, "help": "Submit the full Charter document directly (purpose, decision_authority, escalation_rules, measurables, budget, permission_manifest); read the charter authoring deep-dive for what good looks like per field. Durable authority changes still need human approval.", "example": { "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc", "doc": { "payload_version": 1, "purpose": "AP intake clerk: draft accounts-payable invoice entries from inbound vendor emails for human review.", "accountabilities": [{ "title": "Draft every inbound invoice", "description": "Convert each inbound vendor invoice into a draft AP entry with the correct vendor, amount, and GL coding within one business day." }, { "title": "Flag discrepancies", "description": "Surface duplicate, mismatched, or out-of-policy invoices as Friction issues instead of drafting them silently." }], "decision_authority": { "autonomous": [{ "action": "Draft AP entries and propose GL coding from inbound invoices", "condition": "Allowed when the vendor is known and the amount is within the standard purchase range.", "rationale": "Drafting is reversible and reviewed by a human before posting.", "unanswered_boundary": false }], "approval": [{ "action": "Post an invoice or send any vendor-facing message", "condition": "Require explicit human approval before posting or sending.", "rationale": "Posting and sending are durable, money-moving actions.", "unanswered_boundary": false }], "escalate": [{ "action": "Unknown vendor, payment over the approval threshold, or a suspected duplicate", "condition": "Always escalate to the Steward before acting.", "rationale": "Conservative default for ambiguous, irreversible, or financial exposure.", "unanswered_boundary": true }] }, "escalation_rules": ["Escalate any invoice over $5,000 or from a vendor not already in the ledger.", "Escalate when an invoice appears to duplicate one already drafted or posted."], "measurables": [{ "name": "Invoices drafted within one business day", "target": "100%", "cadence": "weekly", "source": "agent" }, { "name": "Discrepancies caught before posting", "target": "\u2265 95%", "cadence": "monthly", "source": "human" }], "permission_manifest": [{ "tool": "ap.invoices.read", "scope": "Read inbound invoices and the vendor ledger.", "granted": true, "rationale": "Needed to draft entries from source invoices." }, { "tool": "email.draft", "scope": "Draft vendor replies for human review; never send.", "granted": true, "rationale": "Lets the seat prepare clarifications without taking a send action." }], "budget": { "monthly_usd": null, "approval_required_over_usd": 0, "notes": "No autonomous spend; any spend requires Steward approval until a budget is set." }, "unanswered_boundaries": ["Approval threshold for auto-posting", "Vendor onboarding authority"], "seat_type_recommendation": { "recommendation": "agent", "rationale": "The work is high-volume, rule-bound, and fully reviewable, which suits a draft-and-confirm agent under a human Steward.", "confidence": 0.8 } } } },
   { "id": "coach.draft_guide", "namespace": "coach", "action": "draft_guide", "title": "Draft accountability discussion guide", "description": "Draft a private discussion guide for the accountable human about a seat's commitment pattern. Read-only and human-only \u2014 it is never delivered, sent, or written to the coached person's record.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Draft a private accountability discussion guide for the accountable human from a seat's commitment pattern. Never delivered or written to the coached person's record." },
   { "id": "command.describe", "namespace": "command", "action": "describe", "title": "Describe command", "description": "Return a command's exact input/output JSON Schema, scope, confirmation gate, help pointer, guides, a validated example, and related commands. Run this before calling a mutating command.", "requiredScope": "user", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Run command.describe before calling a mutating command to read its exact input/output schema and a worked example; on a failure, read the error's help field and run the command it names." },
   { "id": "command.list", "namespace": "command", "action": "list", "title": "List commands", "description": "List every callable command id with its title, required scope, confirmation gate, and onboarding stages. Use 'command.describe' for a single command's full contract.", "requiredScope": "user", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List the callable command surface, then use command.describe for the exact contract of the one you need." },
@@ -51671,7 +51878,7 @@ var COMMAND_MANIFEST = [
   { "id": "seat.rename", "namespace": "seat", "action": "rename", "title": "Rename seat", "description": "Rename a Responsibility Graph seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "name", "flag": "name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Seat names should describe the function and accountability clearly." },
   { "id": "seat.reparent", "namespace": "seat", "action": "reparent", "title": "Reparent seat", "description": "Move a Responsibility Graph seat under a new parent.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "new_parent_seat_id", "flag": "new-parent-seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Reparent seats only when it clarifies accountable structure and preserves a clean graph." },
   { "id": "seat.set_type", "namespace": "seat", "action": "set_type", "title": "Set seat type", "description": "Set a Responsibility Graph seat type.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "seat_type", "flag": "seat-type", "type": "enum", "required": true, "enumValues": ["human", "agent", "hybrid"] }], "hasComplexInput": false, "help": "Seat type should follow the work, risk, measurable, and stewardship model." },
-  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by CREDENTIAL ID (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side) or by VAULT REF directly (exactly one). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }, { "name": "credential_id", "flag": "credential-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
+  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by CREDENTIAL ID (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side) or by VAULT REF directly (exactly one). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }, { "name": "credential_id", "flag": "credential-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "injection_prefix", "flag": "injection-prefix", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
   { "id": "secret_grant.list", "namespace": "secret_grant", "action": "list", "title": "List brokered secret grants", "description": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only (host, path prefix, methods, scope, status) \u2014 never the vault ref or any secret. An agent sees only its own seat's grants.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "include_revoked", "flag": "include-revoked", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only \u2014 host, path prefix, methods, scope, status \u2014 never the vault ref or any secret." },
   { "id": "secret_grant.request", "namespace": "secret_grant", "action": "request", "title": "Request a brokered secret grant", "description": "An agent or user REQUESTS a scoped brokered-secret grant by naming the egress it needs (grant key, host, path prefix, methods, scope). No secret and no vault ref are ever accepted (invariant #5) \u2014 this only records a durable ask for a human to grant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "An agent or user requests a brokered-secret egress grant by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret or vault ref is accepted; a human grants it." },
   { "id": "secret_grant.revoke", "namespace": "secret_grant", "action": "revoke", "title": "Revoke a brokered secret grant", "description": "Revoke a brokered secret grant \u2014 a compromised or over-scoped seat's egress access can be cut immediately; the next broker call resolves no grant and fails closed. Owner-only, human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat's egress immediately; the next broker call fails closed). Owner-only and human-gated." },