@rosthq/cli 0.7.80 → 0.7.82

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAkQ3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAqQ3D,CAAC"}

package/dist/index.js

@@ -39451,6 +39451,113 @@ var agentCreateFromTemplateOutputSchema = agentSetupStateSchema.extend({
   occupancy_created: external_exports.boolean()
 }).strict();
 
+// ../../packages/protocol/src/agent-definition-import.ts
+var boundedTextSchema = external_exports.string().trim().min(1).max(2e3);
+var shortTextSchema = external_exports.string().trim().min(1).max(240);
+var forbiddenImportKeys = /* @__PURE__ */ new Set([
+  "credential",
+  "credentials",
+  "secret",
+  "secrets",
+  "api_key",
+  "apiKey",
+  "token",
+  "vault_ref",
+  "vaultRef",
+  "tenant_id",
+  "tenantId",
+  "seat_id",
+  "seatId",
+  "parent_seat_id",
+  "parentSeatId",
+  "steward_seat_id",
+  "stewardSeatId",
+  "integration_id",
+  "integrationId"
+]);
+function rejectForbiddenImportShape(value, ctx, path8 = []) {
+  if (value === null || value === void 0) {
+    return;
+  }
+  if (typeof value === "string") {
+    if (hasSecretShapedValue(value)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: path8,
+        message: "Definition imports cannot contain secret-shaped values. Provide credentials later through vault-backed connection flows."
+      });
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => rejectForbiddenImportShape(item, ctx, [...path8, index]));
+    return;
+  }
+  if (typeof value !== "object") {
+    return;
+  }
+  for (const [key, nested] of Object.entries(value)) {
+    const nestedPath = [...path8, key];
+    if (forbiddenImportKeys.has(key)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: nestedPath,
+        message: "Definition imports cannot carry credentials or tenant-local placement identifiers."
+      });
+    }
+    rejectForbiddenImportShape(nested, ctx, nestedPath);
+  }
+}
+var agentDefinitionImportToolSchema = external_exports.object({
+  capability_id: external_exports.string().trim().min(1).max(160),
+  access: external_exports.enum(["read", "draft", "write_with_approval"]).default("read"),
+  rationale: external_exports.string().trim().max(360).optional()
+}).strict();
+var agentDefinitionImportFileSchema = external_exports.object({
+  format: external_exports.literal("rost.agent_definition"),
+  version: external_exports.literal(1),
+  agent: external_exports.object({
+    name: shortTextSchema,
+    purpose: boundedTextSchema,
+    responsibilities: external_exports.array(shortTextSchema).min(1).max(12),
+    success_criteria: external_exports.array(shortTextSchema).min(1).max(12),
+    never_do_alone: external_exports.array(shortTextSchema).min(1).max(12),
+    lane: external_exports.enum(["cloud", "runner", "mcp_session"]).default("cloud"),
+    model_tier: external_exports.enum(AGENT_MODEL_TIERS).optional(),
+    requested_tools: external_exports.array(agentDefinitionImportToolSchema).max(50).default([])
+  }).strict()
+}).strict().superRefine((value, ctx) => rejectForbiddenImportShape(value, ctx));
+var definitionJsonSchema = external_exports.string().trim().min(1).max(65536).transform((value, ctx) => {
+  try {
+    return JSON.parse(value);
+  } catch {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Definition import must be valid JSON." });
+    return external_exports.NEVER;
+  }
+}).pipe(agentDefinitionImportFileSchema);
+var agentDefinitionImportInputSchema = external_exports.object({
+  definition_json: definitionJsonSchema,
+  idempotency_key: external_exports.string().trim().min(1).max(120).optional()
+}).strict();
+var agentDefinitionImportMappingSchema = external_exports.object({
+  method: external_exports.literal("import"),
+  source_hash: external_exports.string().length(64),
+  seat_name: external_exports.string(),
+  lane: external_exports.enum(["cloud", "runner", "mcp_session"]),
+  model_tier: external_exports.enum(AGENT_MODEL_TIERS).nullable(),
+  requested_tools: external_exports.array(agentDefinitionImportToolSchema),
+  unsupported: external_exports.array(external_exports.object({
+    field: external_exports.string(),
+    reason: external_exports.string()
+  }).strict()).default([])
+}).strict();
+var agentDefinitionImportOutputSchema = external_exports.object({
+  setup: agentSetupStateSchema,
+  mapping: agentDefinitionImportMappingSchema,
+  created: external_exports.boolean(),
+  idempotency_key: external_exports.string().nullable()
+}).strict();
+
 // ../../packages/protocol/src/provider-costs.ts
 var providerCostKinds = ["managed_llm", "exa", "browser", "sandbox"];
 var providerCostKindSchema = external_exports.enum(providerCostKinds);
@@ -42396,10 +42503,12 @@ var charterDraftInputSchema = external_exports.object({
 var charterDraftOutputSchema = external_exports.object({
   charter_version_id: uuidSchema11,
   seat_id: uuidSchema11,
+  edit_revision: external_exports.number().int().min(1).optional(),
   doc: external_exports.unknown()
 }).strict();
 var charterUpdateDraftInputSchema = external_exports.object({
   charter_version_id: uuidSchema11,
+  expected_edit_revision: external_exports.number().int().min(1).optional(),
   // DER-785 (Part G): the full Charter document contract (was `z.unknown()`).
   // The DB layer already validated this with `charterSchema.parse`; advertising
   // it here gives `command.describe`/`rost command schema` a real shape and a
@@ -42413,7 +42522,8 @@ var charterSetInputSchema = external_exports.object({
 }).strict();
 var charterMutationOutputSchema = external_exports.object({
   charter_version_id: uuidSchema11,
-  seat_id: uuidSchema11
+  seat_id: uuidSchema11,
+  edit_revision: external_exports.number().int().min(1).optional()
 }).strict();
 var charterApproveInputSchema = external_exports.object({
   seat_id: uuidSchema11.optional(),
@@ -42422,6 +42532,7 @@ var charterApproveInputSchema = external_exports.object({
   // These fields are shallow-merged onto the existing draft, then the merged doc
   // is re-validated against the full schema at persist time.
   edits: charterDocEditsSchema.optional(),
+  expected_edit_revision: external_exports.number().int().min(1).optional(),
   apply_seat_type: external_exports.boolean().default(false)
 }).strict().refine((input) => Boolean(input.seat_id) || Boolean(input.charter_version_id), {
   message: "Provide seat_id or charter_version_id.",
@@ -45874,6 +45985,9 @@ var taskListOutputSchema = external_exports.object({
 var taskAcceptInputSchema = external_exports.object({
   id: uuidSchema19
 }).strict();
+var taskConfirmProposalInputSchema = external_exports.object({
+  id: uuidSchema19
+}).strict();
 var taskMutationOutputSchema = external_exports.object({
   task: external_exports.object({
     id: uuidSchema19,
@@ -46625,7 +46739,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-13.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -46700,6 +46814,8 @@ AICOS also has an explicit brain selection. Cloud can use the included managed a
 
 Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from scheduled work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same scheduled-work slot. Scheduled and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. For execute-ready runners, the claim also carries a server-built Seat work contract that names the governed runtime profile, the AICOS context-loader tool, and the Seat's permission manifest; action attempts still route through command guards, tool-call audit, and pending confirmations. The runner treats loaded tenant clock, context, and contract as authoritative instead of substituting its own runtime clock, local files, or self-invented authority. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
 
+Agent seat pages can also expose a direct persistent chat with that seat's active agent. This is different from Seat-scoped AICOS: the target is the agent occupying the seat, the transcript is keyed by tenant, user, purpose, and target agent, and the same user can keep separate active threads for different agents. Owners and admins can read direct-agent transcripts for the tenant, and a human occupying the agent seat's Steward seat can read the transcript; unrelated members cannot. New prompts for a target agent enter an agent-scoped queue with a short turn deadline. A second prompt in the same thread coalesces into the pending turn until that turn is claimed, while prompts for another user or another agent keep their own queue position. Direct agent chat never dispatches through \`work_orders\`; scheduled and Forge runner work still use \`work_orders\`.
+
 Cloud and runner submissions carry a stable request ID. Distinct requests that compete while a turn is active receive HTTP \`409\` with code \`AICOS_TURN_CONFLICT\`; the losing request writes no partial user message and consumes none of its attachments. Runner acquisition commits its user message, execution, attachment links, queued transcript projection, and session snapshot together, so a failed projection leaves none of them half-written. Retrying the same request ID returns the original turn and does not rerun the model, builder, onboarding, or runner-queue side effects, even if the currently selected lane or runner readiness changed after the original submission.
 
 When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The turn row records claim/start/finish timing, terminal reason, model label, and token counts when the runner or cloud path provides them. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If the runner answer includes a validated in-app link, the web panel can surface the same consent-required navigation suggestion once polling sees that the pending turn is terminal. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
@@ -47271,7 +47387,7 @@ The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provide
     order: 80,
     title: "Sync rhythm playbook",
     summary: "How Signal, Friction, Cascade, and Sync Briefs turn weekly meetings into decision time.",
-    version: "2026-07-04.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -47605,7 +47721,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-14.1",
+    version: "2026-07-15.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48061,7 +48177,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 
 | Command | Command ids | Purpose | Scope | Safe example |
 |---|---|---|---|---|
-| \`{{cli}} task list|accept|decline|complete|create\` | \`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`, \`task.create\` | Operate a seat's task queue. | Seat | \`{{cli}} task list --json\` |
+| \`{{cli}} task list|accept|decline|complete|create\` | \`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`, \`task.create\`, \`task.confirm_proposal\`, \`task.decline_proposal\` | Operate a seat's task queue and target-side proposal decisions. | Seat / tenant | \`{{cli}} task list --json\`; \`{{cli}} command task.confirm_proposal --json '{"id":"<task-id>"}'\` |
 | \`{{cli}} status record\` | \`status.record\` | Record measurable readings and goal status as a status event. | Seat | \`{{cli}} status record --measurable-id <id> --value 42\` |
 | \`{{cli}} signal list|get|confirm|correct\` | \`signal.list\`, \`signal.get\`, \`signal.confirm_reading\`, \`signal.correct_reading\` | Read and confirm Signal measurables. | Seat | \`{{cli}} signal list --json\` |
 | \`{{cli}} goal list|create|update|status|reparent|drop\` | \`goal.list\`, \`goal.create\`, \`goal.update\`, \`goal.set_status\`, \`goal.reparent\`, \`goal.drop\` | Manage Cascade goals. Scope varies by verb: \`status\` is seat-scoped, \`list\`/\`create\` need a tenant token, and \`update\`/\`reparent\`/\`drop\` require tenant-admin. | Seat to tenant-admin | \`{{cli}} goal list --json\` |
@@ -48193,6 +48309,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_user_to_seat\` | \`staffing.assign_user\` | Assign a human user occupancy to a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`user_id\`. |
 | \`rost_assign_dry_run_agent_to_seat\` | \`staffing.assign_agent_dry_run\` | Assign an agent occupancy in dry-run mode. | Seat or tenant-admin | Call only after Steward chain is clear. |
 | \`rost_staff_seat\` | \`staffing.assign\` | Compatibility helper for human, agent, or hybrid staffing. | Seat or tenant-admin | Call with \`seat_id\` and \`occupant\`. |
+| \`rost_import_agent_definition\` | \`agent.import_definition\` | Import a strict, versioned agent definition into a canonical draft Seat/setup without credentials, placement ids, or go-live side effects. | Tenant | Human-gated; call with \`definition_json\` and optional \`idempotency_key\`. Review the resulting draft setup before tools, dry run, or go-live. |
 | \`rost_go_live\` | \`agent.go_live\` | Promote a dry-run agent seat to live. | Seat or tenant-admin | Call after human approval. |
 | \`rost_create_mcp_token\` | \`mcp_token.create\` | Mint a tenant-admin or seat-scoped MCP token. | Tenant | Prefer \`{{cli}} mcp install\` for users. |
 | \`rost_revoke_mcp_token\` | \`mcp_token.revoke\` | Revoke an MCP token immediately. | Tenant | Call with \`token_id\`. |
@@ -48304,7 +48421,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_update_friction_issue_status\` | \`friction.update_status\` | Move a non-terminal issue between open and diagnosing. | Seat or tenant-admin | Call with \`issue_id\` and \`status\`. |
 | \`rost_resolve_friction_issue\` | \`friction.resolve\` | Resolve an issue with a root cause and remediation task. | Tenant | Human decision; expect confirmation. |
 | \`rost_link_task_to_friction_issue\` | \`friction.link_task\` | Attach an existing task as an issue's action task. | Seat or tenant-admin | Call with \`issue_id\` and \`task_id\`. |
-| \`rost_create_task\` | \`task.create\` | Create a task (a commitment between seats). | Seat or tenant-admin | \`none\` \u2014 created directly; the owning seat accepts or declines. |
+| \`rost_create_task\` | \`task.create\` | Create a task (a commitment between seats). | Seat or tenant-admin | \`none\` \u2014 human-created tasks go live directly; ordinary agent-created tasks become draft proposals; bounded Trusted proposals become offered or, for same-Steward live agent seats, in progress. |
 | \`rost_update_task\` | \`task.update\` | Reschedule, reassign, or edit a non-terminal task. | Owner (tenant-admin) | Pass \`task_id\` plus at least one of \`due_on\`/\`owner_seat_id\`/\`title\`/\`description\`; terminal tasks reject. |
 | \`rost_compile_sync_brief\` | \`sync.brief.compile\` | Compile the weekly Sync Brief (idempotent per period). | Tenant | Call with \`{}\`. |
 | \`rost_get_sync_brief\` | \`sync.brief.get\` | Read the latest or a specific Sync Brief and agenda. | Seat or tenant-admin | Call with \`{}\` or \`{"sync_brief_id":"<id>"}\`. |
@@ -48751,7 +48868,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-06-27.2",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -48823,21 +48940,22 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 8. add-agents-guide
 9. custom-agents-guide
 10. agent-builder-guide
-11. how-agents-work
-12. tool-access-and-vault
-13. available-tools-guide
-14. mcp-and-cli-guide
-15. skill-builder-guide
-16. agent-skill-authoring-guide
-17. agent-skill-setup-guide
-18. ai-model-data-handling-guide
-19. cascade-guide
-20. signal-guide
-21. friction-guide
-22. confirmations-guide
-23. steward-queue-guide
-24. sync-rhythm-playbook
-25. billing-and-pricing-guide
+11. agent-definition-import-guide
+12. how-agents-work
+13. tool-access-and-vault
+14. available-tools-guide
+15. mcp-and-cli-guide
+16. skill-builder-guide
+17. agent-skill-authoring-guide
+18. agent-skill-setup-guide
+19. ai-model-data-handling-guide
+20. cascade-guide
+21. signal-guide
+22. friction-guide
+23. confirmations-guide
+24. steward-queue-guide
+25. sync-rhythm-playbook
+26. billing-and-pricing-guide
 
 ## Workflow to guide map
 
@@ -48852,6 +48970,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Add an agent through the app (graph or sidebar, visual journey): add-agents-guide.
 - Create an agent from a template: stock-agents-guide, then how-agents-work.
 - Create a custom agent (operational answers, Charter Builder, configure tools, dry run, go live): custom-agents-guide, then agent-staffing-playbook and tool-access-and-vault.
+- Import a versioned agent definition file: agent-definition-import-guide, then agent-staffing-playbook and tool-access-and-vault.
 - Create, import, review, or publish a reusable Skill: skill-builder-guide for human workflow, then agent-skill-authoring-guide for CLI/MCP authoring rules.
 - Assign, dependency-check, enable a catalog Skill, import a GitHub Skill, or sync local Skill files: agent-skill-setup-guide, then mcp-and-cli-guide.
 - Explain AI model data handling, BYOK, local agent provider settings, or what data may enter prompts/tool calls: ai-model-data-handling-guide, then security-model-guide.
@@ -48872,7 +48991,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Company setup: rost-implementation-method, compass-authoring-guide, aicos-chat-guide, settings-guide, settings-members-and-invites-guide
 - Graph design: responsibility-graph-playbook
 - Charter design: charter-design-playbook, charter-authoring-deep-dive
-- Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
+- Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, agent-definition-import-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
 - Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
 - Local agents and runners: mcp-and-cli-guide, runner-guide, agent-reference-map
 - Security and troubleshooting: ai-model-data-handling-guide, security-model-guide, troubleshooting-guide
@@ -49106,7 +49225,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
     order: 62,
     title: "Friction guide",
     summary: "How to capture issues with evidence, rank them, and resolve them without losing ownership.",
-    version: "2026-07-04.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -49121,6 +49240,8 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
       "friction.resolve",
       "friction.link_task",
       "task.create",
+      "task.confirm_proposal",
+      "task.decline_proposal",
       "task.list",
       "task.accept",
       "task.decline",
@@ -49166,7 +49287,7 @@ The Friction page opens with one computed line \u2014 how many issues are open,
 Friction, tasks, and escalations are the issue-to-action loop. A seat files, a task carries the work, and an escalation routes a decision a seat cannot make alone.
 
 - File and triage: \`{{cli}} friction file ...\` / \`friction.file_issue\` (seat) / \`rost_file_issue\`; list with \`{{cli}} friction list --status open --json\` / \`friction.list\` / \`rost_list_friction_issues\`; move between open and diagnosing with \`friction.update_status\` / \`rost_update_friction_issue_status\`.
-- Carry the work as a task: \`task.create\` / \`rost_create_task\` (a commitment between seats). \`task.create\` is \`none\` (no confirmation gate), so an agent can file one directly; an agent's task lands as a **draft** proposal (\`origin: agent_proposal\`) for a human to review and hand off \u2014 not a live offer in the owning seat's accept/decline queue. A seat runs its queue with \`{{cli}} task list|accept|decline|complete\` (\`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`). Link a task to an issue with \`friction.link_task\` / \`rost_link_task_to_friction_issue\`.
+- Carry the work as a task: \`task.create\` / \`rost_create_task\` (a commitment between seats). \`task.create\` is \`none\` (no confirmation gate), so an agent can file one directly; an ordinary agent task lands as a **draft** proposal (\`origin: agent_proposal\`) for a target-side human to confirm or decline through \`task.confirm_proposal\` / \`task.decline_proposal\` in \`/approvals\` or the CLI \u2014 not MCP, and not a live offer in the owning seat's accept/decline queue. A bounded Trusted task-create grant may skip that draft card: it creates an **offered** handoff by default, and only creates **in_progress** when both proposing and target seats are live agent seats resolving to the same current accountable human Steward. A seat runs its live queue with \`{{cli}} task list|accept|decline|complete\` (\`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`). Link a task to an issue with \`friction.link_task\` / \`rost_link_task_to_friction_issue\`.
 - Route a decision: \`escalation.raise\` (seat) / \`rost_escalate\` sends approval-scope or must-escalate work to the Steward queue. Reads are \`escalation.list\` / \`escalation.get\`. See the steward queue guide for resolution.
 
 In the app, the Tasks surface exposes the same queue operations for a seat's visible work. Offered handoffs show Accept and Decline actions; Decline opens a reason field and records the reason through \`task.decline\`. Edit opens a separate task form for title, owner, due date, and description changes on non-terminal tasks. These controls are standard focusable disclosures so keyboard and pointer users can operate the queue without dropping to CLI.
@@ -49177,7 +49298,7 @@ In the app, the Tasks surface exposes the same queue operations for a seat's vis
 
 ## When to stop for confirmation
 
-\`friction.resolve\` is \`human_required\`; resolving an issue is a human decision. \`friction.link_task\`, \`task.create\`, \`task.accept\`, \`task.decline\`, and \`task.complete\` are \`none\`, so a seat files issues, creates commitments, and runs its own task queue directly. \`friction.update_status\`, \`escalation.raise\`, \`friction.file_issue\`, and \`friction.list\` are also not gated. An agent files Friction, proposes the task, and escalates; a human resolves.
+\`friction.resolve\` is \`human_required\`; resolving an issue is a human decision. \`friction.link_task\`, \`task.create\`, \`task.accept\`, \`task.decline\`, \`task.confirm_proposal\`, \`task.decline_proposal\`, and \`task.complete\` are \`none\`, so they do not mint pending confirmations. The proposal decision commands still require a human actor with target-side authority and are app/CLI-only, not MCP-exposed; they are not agent-callable approval shortcuts. \`friction.update_status\`, \`escalation.raise\`, \`friction.file_issue\`, and \`friction.list\` are also not gated. An agent files Friction, proposes the task, and escalates; a human resolves or decides the proposed commitment.
 
 ## Resolution rule
 
@@ -49258,11 +49379,11 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-14.1",
+    version: "2026-07-15.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
-    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve"],
+    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve", "task.confirm_proposal", "task.decline_proposal"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native human-gate guidance."] },
     sources: [
       {
@@ -49297,6 +49418,8 @@ When an **agent** triggers a gate, {{brand}} also notifies the seat's steward (S
 
 Approval replays are validated again before execution. If the stored confirmation input no longer matches the original command schema, the approval fails without consuming the pending confirmation or running the durable command; reject it and re-issue the gated action from the current product surface.
 
+A held tool call actuates the same way regardless of which command backs it \u2014 a connector write (like \`gmail.send\`) and a durable command (like \`task.create\`) both replay through the same governed command executor on approval: re-checked against the live permission manifest, reserved so a second approval or replay can never double-actuate, and audited with a fresh \`tool_calls\` row. Resolving the escalation that raised the hold \u2014 over the CLI, MCP, or \`/approvals\` \u2014 actuates identically; none of those paths silently drops the held action once a human approves it.
+
 \`\`\`bash
 # Human approves a pending confirmation
 {{cli}} command confirmation.approve --json '{"confirmation_id":"<confirmation-id>"}'
@@ -49306,11 +49429,11 @@ Approval replays are validated again before execution. If the stored confirmatio
 
 ## The approvals queue
 
-The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
+The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations, open steward escalations, and agent-proposed draft tasks into a single queue, each item shown with its risk or proposal type, the source or proposing seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy, escalations routed to their steward chain, and task proposals where they occupy or steward the target seat. Confirming a task proposal runs \`task.confirm_proposal\` and moves the draft to Offered; declining runs \`task.decline_proposal\` and records a human reason. Neither action accepts the task, schedules a run, or executes agent work. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
 
 ## The rule for agents
 
-An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) are not even exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human.
+An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) and proposal decision commands (\`task.confirm_proposal\`, \`task.decline_proposal\`) are not exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human. Draft task proposals follow the same rule: the agent can propose the commitment, but a target-side human confirms or declines it unless a bounded Trusted grant applies.
 
 ## When to stop
 
@@ -49430,7 +49553,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-14.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49530,7 +49653,7 @@ The company autonomy ceiling is a single tenant-wide dial that caps how much ANY
 The CLI confirmation mode is a separate tenant-wide dial. It does not change what an agent may do (that is the company autonomy ceiling above); it changes whether the {{cli}} CLI tool itself may stand in for a human at an already-gated confirmation.
 
 - \`careful\` is the strict default for every company, including internal ones. The server refuses the CLI's silent auto-replay of a pending confirmation \u2014 a human must review it before it is approved.
-- \`trusted_operator\` is a deliberate tenant_admin opt-in (an ADR-0018 \xA76 standing authorization) that lets the CLI silently auto-approve a non-\`dangerous\` confirmation. A \`dangerous\`-risk confirmation always requires interactive human review, in either mode.
+- \`trusted_operator\` is a deliberate tenant_admin opt-in (an ADR-0018 \xA76 standing authorization) that lets the CLI silently auto-approve only confirmations whose command is explicitly classified Trusted-eligible. Always-human, not-applicable, missing, unknown, and \`dangerous\`-risk confirmations still require interactive human review in either mode.
 - Read it with \`settings.confirmation_policy.get\` (CLI: \`{{cli}} settings confirmation-mode get\`). Set it with \`settings.confirmation_policy.update\` (CLI: \`{{cli}} settings confirmation-mode set --mode trusted_operator\`). Owner-only and human-gated.
 - Stored at \`tenants.settings.confirmation_policy\`; enforced server-side in \`confirmation.approve\`, so a stale or modified local CLI cannot bypass it.
 
@@ -50721,6 +50844,72 @@ The Charter you submit for an agent seat is the full Charter document (see the c
 ## Show your human a review
 
 When you have built the setup, render a clean markdown card for your human before go-live: \`{{cli}} agent show --seat-id <id> --markdown\` (or \`{{cli}} charter show --seat-id <id> --markdown\` / \`{{cli}} compass show --markdown\`). The card composes the setup, model, steward, tools, and Charter into one skimmable readout. Then surface the go-live for a human to approve \u2014 go-live is human-gated and a seat token never goes live on its own setup.`
+  },
+  {
+    slug: "agent-definition-import-guide",
+    order: 44,
+    title: "Agent definition import guide",
+    summary: "The strict versioned JSON format for importing an agent as a draft Seat/setup without credentials, placement ids, or go-live side effects.",
+    version: "2026-07-15.1",
+    public: true,
+    audiences: ["human", "cli", "mcp", "in_app_agent"],
+    stages: ["staffing", "charter_design"],
+    relatedCommandIds: ["agent.import_definition", "agent.create_custom", "agent_setup.get", "agent.configure_tools"],
+    legal: {
+      publicRisk: "low",
+      notes: [
+        "Documents a ROST-native import contract only.",
+        "Explicitly excludes credentials and tenant-local identifiers from the import file."
+      ]
+    },
+    sources: [
+      {
+        label: "Agent definition import spec",
+        internalPath: "docs/specs/agent-definition-import.md",
+        note: "Internal source for the versioned import JSON example and safety rules."
+      }
+    ],
+    body: `# Agent definition import guide
+
+Use \`agent.import_definition\` when you already have a bounded agent description and want to turn it into a draft {{brand}} agent setup. Import is a starting point, not go-live.
+
+The command creates a draft agent Seat, starts the canonical setup flow, maps the definition into operational answers, and returns \`agent_setup.get\` state. It does not sign the Charter, grant tools, store credentials, run a dry run, or approve go-live.
+
+## Safety rules
+
+- The file must use \`"format": "rost.agent_definition"\` and \`"version": 1\`.
+- Unknown fields are rejected.
+- Credentials, vault refs, API keys, tokens, tenant ids, Seat ids, parent ids, steward ids, and integration ids are rejected.
+- Secret-shaped string values are rejected even when they appear in otherwise allowed fields.
+- Requested tools are review context only. Grants and credential ingress still happen through setup.
+- Placement is server-side. The import file cannot choose a parent Seat or Steward.
+
+## Example
+
+\`\`\`json
+{
+  "format": "rost.agent_definition",
+  "version": 1,
+  "agent": {
+    "name": "Customer Follow-up Agent",
+    "purpose": "Prepare account follow-ups for steward review.",
+    "responsibilities": ["Summarize recent customer signals", "Draft follow-up tasks"],
+    "success_criteria": ["Stewards receive concise weekly follow-up drafts"],
+    "never_do_alone": ["Send external customer messages", "Change billing or credentials"],
+    "lane": "cloud",
+    "model_tier": "balanced",
+    "requested_tools": [
+      {
+        "capability_id": "google.gmail.read",
+        "access": "read",
+        "rationale": "Read recent customer context"
+      }
+    ]
+  }
+}
+\`\`\`
+
+After import, continue from the draft Seat page. Review the Charter, choose a Steward, configure tools and connections, sign the manifest, run a dry run, and approve go-live only when the human review is complete.`
   }
 ];
 
@@ -51569,6 +51758,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.fleet_digest", "namespace": "agent", "action": "fleet_digest", "title": "Get dogfood fleet health digest", "description": "Return a daily tenant fleet health digest with live/idle state, run counts, spend, failed runs, unresolved product errors, notification errors, and next actions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "window_hours", "flag": "window-hours", "type": "integer", "required": false }, { "name": "error_limit", "flag": "error-limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Capture a daily dogfood fleet health digest with fleet state, run counts, spend, failed runs, unresolved errors, failed notifications, and next actions." },
   { "id": "agent.get_run", "namespace": "agent", "action": "get_run", "title": "Get agent run diagnostics", "description": "Return one seat run's diagnostic record: run status, transcript reference, token/cost usage, outcome, and linked product-visible run errors.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "run_id", "flag": "run-id", "type": "string", "required": true }, { "name": "transcript", "flag": "transcript", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Read one run's diagnostic record, transcript reference, token/cost usage, outcome, and linked product-visible errors." },
   { "id": "agent.go_live", "namespace": "agent", "action": "go_live", "title": "Go live", "description": "Promote a dry-run agent seat to live after the human approval gate.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Move an agent live only after dry-run evidence, signed permissions, and a human Steward chain are clear.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
+  { "id": "agent.import_definition", "namespace": "agent", "action": "import_definition", "title": "Import agent definition", "description": "Import a versioned ROST agent definition into a canonical draft Seat and setup state without credentials, placement identifiers, or go-live side effects.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "definition_json", "flag": "definition-json", "type": "string", "required": true }, { "name": "idempotency_key", "flag": "idempotency-key", "type": "string", "required": false }], "hasComplexInput": false, "help": "Import a strict, versioned ROST agent definition into a canonical draft Seat/setup. The file cannot carry credentials or tenant-local placement ids; tools remain proposal-only until reviewed through setup." },
   { "id": "agent.list_fleet", "namespace": "agent", "action": "list_fleet", "title": "List agent fleet", "description": "Return every agent-occupied seat with lane, live state, last real turn, recent turn counts, top measurable status, open escalations, and 7-day real-run spend.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read every agent-occupied seat at once: lane, live state, last real turn, 24h/7d turns, measurable status, escalations, and spend." },
   { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call and guard-denial counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call and guard-held counts (the Trust Card)." },
   { "id": "agent.list_tool_calls", "namespace": "agent", "action": "list_tool_calls", "title": "List agent tool calls", "description": "Return a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Pass held_only to return only guard-held calls. Never returns argument summaries or secret material.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }, { "name": "held_only", "flag": "held-only", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Audit a seat's tool-call ledger with each call's guard result; held actions are the hero metric." },
@@ -51588,7 +51778,7 @@ var COMMAND_MANIFEST = [
   { "id": "aicos.brain_settings.update", "namespace": "aicos", "action": "brain_settings.update", "title": "Update AICOS brain settings", "description": "Update the AICOS lane and cloud/runner brain preferences. Owner-only and audited.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "runner", "mcp"] }, { "name": "cloud_brain", "flag": "cloud-brain", "type": "enum", "required": false, "enumValues": ["managed", "byok"] }, { "name": "runner_brain", "flag": "runner-brain", "type": "enum", "required": false, "enumValues": ["claude-cli", "codex-cli"] }, { "name": "cloud_model_slug", "flag": "cloud-model-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "Owner-only update for AICOS cloud managed/BYOK and runner Claude/Codex preferences; BYOK requires an active tenant Anthropic key." },
   { "id": "cascade.import", "namespace": "cascade", "action": "import", "title": "Import Rocks from a ninety Rocks export", "description": "Bulk-import a ninety Rocks export into the Cascade as cycle goals under a company objective in the active cycle. Owners are seat names resolved to seats. Requires an active cycle and a target company objective (auto-selected when exactly one exists, else pass parent_objective_id). Idempotent \u2014 re-importing the same export is a no-op, and an existing cycle goal with the same objective + seat + title is skipped.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }, { "name": "parent_objective_id", "flag": "parent-objective-id", "type": "string", "required": false }], "hasComplexInput": true, "help": "Import a ninety Rocks export into the Cascade as cycle goals under a company objective in the active cycle; owners resolve to seats." },
   { "id": "charter.apply_seat_type_recommendation", "namespace": "charter", "action": "apply_seat_type_recommendation", "title": "Apply Charter seat-type recommendation", "description": "Apply the seat-type recommendation from a draft Charter.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Apply seat-type recommendations only after the Charter clarifies work shape, risk, and Steward accountability." },
-  { "id": "charter.approve", "namespace": "charter", "action": "approve", "title": "Approve charter", "description": "Approve a draft Charter as a human owner.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": false }, { "name": "apply_seat_type", "flag": "apply-seat-type", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Charter approval is a human decision that activates the seat's operating contract." },
+  { "id": "charter.approve", "namespace": "charter", "action": "approve", "title": "Approve charter", "description": "Approve a draft Charter as a human owner.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": false }, { "name": "expected_edit_revision", "flag": "expected-edit-revision", "type": "integer", "required": false }, { "name": "apply_seat_type", "flag": "apply-seat-type", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Charter approval is a human decision that activates the seat's operating contract." },
   { "id": "charter.draft", "namespace": "charter", "action": "draft", "title": "Draft charter", "description": "Create or fetch a draft Charter for a seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Draft Charters that define purpose, responsibilities, decision authority, measurables, tools, budget, and escalation; the charter authoring deep-dive shows what good looks like per field." },
   { "id": "charter.draft_all", "namespace": "charter", "action": "draft_all", "title": "Draft all charters", "description": "Draft Charters for every eligible seat in a tenant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Draft Charters in onboarding order after the Responsibility Graph has enough seat clarity.", "example": {} },
   { "id": "charter.get", "namespace": "charter", "action": "get", "title": "Get Charter", "description": "Return a Charter version with its supersession history and latest dry-run status.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read a Charter with its supersession history and dry-run status before approving or signing a manifest." },
@@ -51597,7 +51787,7 @@ var COMMAND_MANIFEST = [
   { "id": "charter.show_markdown", "namespace": "charter", "action": "show_markdown", "title": "Show Charter as markdown", "description": "Compose a seat's active or latest Charter into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Render a seat's active or latest Charter as a clean markdown card to show your human a quick review." },
   { "id": "charter.sign_manifest", "namespace": "charter", "action": "sign_manifest", "title": "Sign charter manifest", "description": "Request human confirmation for a Charter permission manifest.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Sign tool manifests only when the Charter explains why the tool is needed and how it is bounded." },
   { "id": "charter.skip", "namespace": "charter", "action": "skip", "title": "Skip charter draft", "description": "Mark a draft Charter as skipped.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Skip a Charter only when the seat is intentionally out of scope for the current onboarding pass." },
-  { "id": "charter.update_draft", "namespace": "charter", "action": "update_draft", "title": "Update charter draft", "description": "Update a draft Charter document.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Submit the full Charter document directly (purpose, decision_authority, escalation_rules, measurables, budget, permission_manifest); read the charter authoring deep-dive for what good looks like per field. Durable authority changes still need human approval.", "example": { "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc", "doc": { "payload_version": 1, "purpose": "AP intake clerk: draft accounts-payable invoice entries from inbound vendor emails for human review.", "accountabilities": [{ "title": "Draft every inbound invoice", "description": "Convert each inbound vendor invoice into a draft AP entry with the correct vendor, amount, and GL coding within one business day." }, { "title": "Flag discrepancies", "description": "Surface duplicate, mismatched, or out-of-policy invoices as Friction issues instead of drafting them silently." }], "decision_authority": { "autonomous": [{ "action": "Draft AP entries and propose GL coding from inbound invoices", "condition": "Allowed when the vendor is known and the amount is within the standard purchase range.", "rationale": "Drafting is reversible and reviewed by a human before posting.", "unanswered_boundary": false }], "approval": [{ "action": "Post an invoice or send any vendor-facing message", "condition": "Require explicit human approval before posting or sending.", "rationale": "Posting and sending are durable, money-moving actions.", "unanswered_boundary": false }], "escalate": [{ "action": "Unknown vendor, payment over the approval threshold, or a suspected duplicate", "condition": "Always escalate to the Steward before acting.", "rationale": "Conservative default for ambiguous, irreversible, or financial exposure.", "unanswered_boundary": true }] }, "escalation_rules": ["Escalate any invoice over $5,000 or from a vendor not already in the ledger.", "Escalate when an invoice appears to duplicate one already drafted or posted."], "measurables": [{ "name": "Invoices drafted within one business day", "target": "100%", "cadence": "weekly", "source": "agent" }, { "name": "Discrepancies caught before posting", "target": "\u2265 95%", "cadence": "monthly", "source": "human" }], "permission_manifest": [{ "tool": "ap.invoices.read", "scope": "Read inbound invoices and the vendor ledger.", "granted": true, "rationale": "Needed to draft entries from source invoices." }, { "tool": "email.draft", "scope": "Draft vendor replies for human review; never send.", "granted": true, "rationale": "Lets the seat prepare clarifications without taking a send action." }], "budget": { "monthly_usd": null, "approval_required_over_usd": 0, "notes": "No autonomous spend; any spend requires Steward approval until a budget is set." }, "unanswered_boundaries": ["Approval threshold for auto-posting", "Vendor onboarding authority"], "seat_type_recommendation": { "recommendation": "agent", "rationale": "The work is high-volume, rule-bound, and fully reviewable, which suits a draft-and-confirm agent under a human Steward.", "confidence": 0.8 } } } },
+  { "id": "charter.update_draft", "namespace": "charter", "action": "update_draft", "title": "Update charter draft", "description": "Update a draft Charter document.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }, { "name": "expected_edit_revision", "flag": "expected-edit-revision", "type": "integer", "required": false }], "hasComplexInput": true, "help": "Submit the full Charter document directly (purpose, decision_authority, escalation_rules, measurables, budget, permission_manifest); read the charter authoring deep-dive for what good looks like per field. Durable authority changes still need human approval.", "example": { "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc", "doc": { "payload_version": 1, "purpose": "AP intake clerk: draft accounts-payable invoice entries from inbound vendor emails for human review.", "accountabilities": [{ "title": "Draft every inbound invoice", "description": "Convert each inbound vendor invoice into a draft AP entry with the correct vendor, amount, and GL coding within one business day." }, { "title": "Flag discrepancies", "description": "Surface duplicate, mismatched, or out-of-policy invoices as Friction issues instead of drafting them silently." }], "decision_authority": { "autonomous": [{ "action": "Draft AP entries and propose GL coding from inbound invoices", "condition": "Allowed when the vendor is known and the amount is within the standard purchase range.", "rationale": "Drafting is reversible and reviewed by a human before posting.", "unanswered_boundary": false }], "approval": [{ "action": "Post an invoice or send any vendor-facing message", "condition": "Require explicit human approval before posting or sending.", "rationale": "Posting and sending are durable, money-moving actions.", "unanswered_boundary": false }], "escalate": [{ "action": "Unknown vendor, payment over the approval threshold, or a suspected duplicate", "condition": "Always escalate to the Steward before acting.", "rationale": "Conservative default for ambiguous, irreversible, or financial exposure.", "unanswered_boundary": true }] }, "escalation_rules": ["Escalate any invoice over $5,000 or from a vendor not already in the ledger.", "Escalate when an invoice appears to duplicate one already drafted or posted."], "measurables": [{ "name": "Invoices drafted within one business day", "target": "100%", "cadence": "weekly", "source": "agent" }, { "name": "Discrepancies caught before posting", "target": "\u2265 95%", "cadence": "monthly", "source": "human" }], "permission_manifest": [{ "tool": "ap.invoices.read", "scope": "Read inbound invoices and the vendor ledger.", "granted": true, "rationale": "Needed to draft entries from source invoices." }, { "tool": "email.draft", "scope": "Draft vendor replies for human review; never send.", "granted": true, "rationale": "Lets the seat prepare clarifications without taking a send action." }], "budget": { "monthly_usd": null, "approval_required_over_usd": 0, "notes": "No autonomous spend; any spend requires Steward approval until a budget is set." }, "unanswered_boundaries": ["Approval threshold for auto-posting", "Vendor onboarding authority"], "seat_type_recommendation": { "recommendation": "agent", "rationale": "The work is high-volume, rule-bound, and fully reviewable, which suits a draft-and-confirm agent under a human Steward.", "confidence": 0.8 } } } },
   { "id": "coach.draft_guide", "namespace": "coach", "action": "draft_guide", "title": "Draft accountability discussion guide", "description": "Draft a private discussion guide for the accountable human about a seat's commitment pattern. Read-only and human-only \u2014 it is never delivered, sent, or written to the coached person's record.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Draft a private accountability discussion guide for the accountable human from a seat's commitment pattern. Never delivered or written to the coached person's record." },
   { "id": "command.describe", "namespace": "command", "action": "describe", "title": "Describe command", "description": "Return a command's exact input/output JSON Schema, scope, confirmation gate, help pointer, guides, a validated example, and related commands. Run this before calling a mutating command.", "requiredScope": "user", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Run command.describe before calling a mutating command to read its exact input/output schema and a worked example; on a failure, read the error's help field and run the command it names." },
   { "id": "command.list", "namespace": "command", "action": "list", "title": "List commands", "description": "List every callable command id with its title, required scope, confirmation gate, and onboarding stages. Use 'command.describe' for a single command's full contract.", "requiredScope": "user", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List the callable command surface, then use command.describe for the exact contract of the one you need." },
@@ -51786,8 +51976,10 @@ var COMMAND_MANIFEST = [
   { "id": "system.health", "namespace": "system", "action": "health", "title": "System health", "description": "Return a scoped health snapshot for agent runs, errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Read a scoped system health snapshot across agent runs, errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness." },
   { "id": "task.accept", "namespace": "task", "action": "accept", "title": "Accept task", "description": "Accept an offered handoff task owned by the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Accept an offered task only when the seat can deliver it within its Charter." },
   { "id": "task.complete", "namespace": "task", "action": "complete", "title": "Complete task", "description": "Complete an accepted handoff task and emit a handoff event back to the requesting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": true }], "hasComplexInput": true, "help": "Complete an accepted task with a summary so the requesting seat receives the handoff." },
-  { "id": "task.create", "namespace": "task", "action": "create", "title": "Create task", "description": "Create a task (a commitment between seats). Agent-created tasks land in draft for human confirmation; human-created tasks are offered (handoff) or in progress.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": true }, { "name": "from_seat_id", "flag": "from-seat-id", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "description", "flag": "description", "type": "string", "required": true }, { "name": "goal_id", "flag": "goal-id", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a task as a commitment between seats; agent proposals land in draft for human confirmation.", "example": { "owner_seat_id": "0190dddd-dddd-7ddd-8ddd-dddddddddddd", "from_seat_id": "0190eeee-eeee-7eee-8eee-eeeeeeeeeeee", "title": "Reconcile the March vendor statements", "description": "Match every March vendor statement line to a recorded invoice and flag discrepancies.", "goal_id": "0190ffff-ffff-7fff-8fff-ffffffffffff", "acceptance_criteria": ["All March statements reconciled", "Discrepancies filed as Friction issues"], "due_on": "2026-04-15" } },
+  { "id": "task.confirm_proposal", "namespace": "task", "action": "confirm_proposal", "title": "Confirm proposed task", "description": "Confirm an agent-proposed draft task when the current human has target-side authority.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Confirm an agent-proposed draft task when the current human has authority for the target seat." },
+  { "id": "task.create", "namespace": "task", "action": "create", "title": "Create task", "description": "Create a task (a commitment between seats). Agent-created tasks land in draft for human confirmation; human-created tasks are offered (handoff) or in progress.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": true }, { "name": "from_seat_id", "flag": "from-seat-id", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "description", "flag": "description", "type": "string", "required": true }, { "name": "goal_id", "flag": "goal-id", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a task as a commitment between seats; ordinary agent proposals land in draft for target-side human confirmation, while bounded Trusted proposals may become offered or in progress.", "example": { "owner_seat_id": "0190dddd-dddd-7ddd-8ddd-dddddddddddd", "from_seat_id": "0190eeee-eeee-7eee-8eee-eeeeeeeeeeee", "title": "Reconcile the March vendor statements", "description": "Match every March vendor statement line to a recorded invoice and flag discrepancies.", "goal_id": "0190ffff-ffff-7fff-8fff-ffffffffffff", "acceptance_criteria": ["All March statements reconciled", "Discrepancies filed as Friction issues"], "due_on": "2026-04-15" } },
   { "id": "task.decline", "namespace": "task", "action": "decline", "title": "Decline task", "description": "Decline an offered handoff task owned by the acting seat with a reason.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Decline an offered task with a clear reason when it is out of scope for the seat." },
+  { "id": "task.decline_proposal", "namespace": "task", "action": "decline_proposal", "title": "Decline proposed task", "description": "Decline an agent-proposed draft task with a target-side human reason.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Decline an agent-proposed draft task with a target-side human reason." },
   { "id": "task.import", "namespace": "task", "action": "import", "title": "Import Tasks from a ninety To-Dos export", "description": "Bulk-import a ninety To-Dos export into Tasks. Owners are seat names resolved to seats; each to-do becomes a seat-owned task with provenance origin_kind:manual. Idempotent \u2014 re-importing the same export is a no-op, and an existing non-terminal task with the same seat + title is skipped.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Import a ninety To-Dos export into Tasks (origin_kind:manual); owners resolve to seats, idempotent by file + seat/title." },
   { "id": "task.list", "namespace": "task", "action": "list", "title": "List seat tasks", "description": "List open handoff tasks owned by the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List the seat's open handoff tasks before accepting, declining, or completing work." },
   { "id": "task.update", "namespace": "task", "action": "update", "title": "Update task", "description": "Reschedule (due date), reassign (owner seat), or edit a non-terminal task's title, description, or acceptance criteria. Terminal tasks cannot be edited \u2014 a correction is a new task.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "task_id", "flag": "task-id", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "description", "flag": "description", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Reschedule, reassign, or edit a non-terminal task; terminal tasks are immutable (a correction is a new task)." },