@rosthq/cli 0.7.81 → 0.7.83

package/dist/index.js

@@ -39891,6 +39891,86 @@ var toolGrantsAgentUpdateOutputSchema = external_exports.object({
 }).strict();
 var scopeDigestSchema = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/);
 var classifierVersionSchema = external_exports.string().regex(/^[a-z][a-z0-9_.-]{0,79}$/);
+var toolGrantsTenantUpdateGrantInputSchema = external_exports.object({
+  tool_grant_id: uuidSchema5,
+  max_access_level: capabilityGrantAccessLevelSchema,
+  default_agent_access_level: capabilityGrantAccessLevelSchema.optional()
+}).strict();
+var toolGrantsTenantUpdateInputSchema = external_exports.object({
+  expected_policy_version: external_exports.number().int().nonnegative().optional(),
+  expected_policy_digest: scopeDigestSchema.optional(),
+  mode: external_exports.enum(["managed", "open"]),
+  grants: external_exports.array(toolGrantsTenantUpdateGrantInputSchema).max(50).default([])
+}).strict().superRefine((value, ctx) => {
+  if (value.expected_policy_version === void 0 && value.expected_policy_digest === void 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Provide expected_policy_version or expected_policy_digest.",
+      path: ["expected_policy_version"]
+    });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, grant] of value.grants.entries()) {
+    if (seen.has(grant.tool_grant_id)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Duplicate tool_grant_id values are not allowed.",
+        path: ["grants", index, "tool_grant_id"]
+      });
+      continue;
+    }
+    seen.add(grant.tool_grant_id);
+    if (grant.default_agent_access_level !== void 0) {
+      const levels = capabilityGrantAccessLevelSchema.options;
+      const maxRank = levels.indexOf(grant.max_access_level);
+      const defaultRank = levels.indexOf(grant.default_agent_access_level);
+      if (defaultRank > maxRank) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "default_agent_access_level cannot exceed max_access_level.",
+          path: ["grants", index, "default_agent_access_level"]
+        });
+      }
+    }
+  }
+});
+var toolGrantsTenantUpdateGrantResultSchema = external_exports.object({
+  tool_grant_id: uuidSchema5,
+  capability_id: external_exports.string().min(1),
+  max_access_level: capabilityGrantAccessLevelSchema,
+  default_agent_access_level: capabilityGrantAccessLevelSchema
+}).strict();
+var toolGrantsTenantUpdateAgentImpactSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  seat_id: uuidSchema5,
+  capability_ids: external_exports.array(external_exports.string().min(1)).min(1)
+}).strict();
+var toolGrantsTenantUpdateOutputSchema = external_exports.object({
+  policy: external_exports.object({
+    mode: external_exports.enum(["managed", "open"]),
+    version: external_exports.number().int().nonnegative(),
+    digest: scopeDigestSchema
+  }).strict(),
+  changed_grants: external_exports.array(toolGrantsTenantUpdateGrantResultSchema),
+  clamped_defaults: external_exports.array(toolGrantsTenantUpdateGrantResultSchema),
+  affected_live_agents: external_exports.array(toolGrantsTenantUpdateAgentImpactSchema)
+}).strict();
+var executableHandlerCoverageItemSchema = external_exports.object({
+  tool_name: external_exports.string().min(1),
+  implemented: external_exports.boolean()
+}).strict();
+var executableHandlerCoverageInputSchema = external_exports.object({
+  registry_tool_names: external_exports.array(external_exports.string().min(1)).default([]),
+  catalog_tool_names: external_exports.array(external_exports.string().min(1)).default([]),
+  required_tool_names: external_exports.array(external_exports.string().min(1)).default([])
+}).strict();
+var executableHandlerCoverageOutputSchema = external_exports.object({
+  coverage_digest: scopeDigestSchema,
+  covered_tool_names: external_exports.array(external_exports.string().min(1)),
+  missing_registry_tool_names: external_exports.array(external_exports.string().min(1)),
+  missing_catalog_tool_names: external_exports.array(external_exports.string().min(1)),
+  items: external_exports.array(executableHandlerCoverageItemSchema)
+}).strict();
 var agentActivationReceiptInputSchema = external_exports.object({
   agent_id: uuidSchema5,
   proposed_budget_cents: external_exports.number().int().nonnegative().max(1e7).optional()
@@ -42457,6 +42537,14 @@ var tenantAnthropicKeySaveInputSchema = external_exports.object({
 var tenantAnthropicKeySaveOutputSchema = external_exports.object({
   stored: external_exports.literal(true)
 }).strict();
+var tenantAnthropicKeyDisableInputSchema = external_exports.object({}).strict();
+var tenantAnthropicKeyDisableOutputSchema = external_exports.object({
+  tenant_id: uuidSchema11,
+  credential_id: uuidSchema11.nullable(),
+  disabled: external_exports.boolean(),
+  already_disabled: external_exports.boolean(),
+  managed_fallback_ready: external_exports.boolean()
+}).strict();
 var seatCreateInputSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(120),
   parent_seat_id: uuidSchema11.nullable().optional(),
@@ -42781,6 +42869,7 @@ var markNotificationsReadRequestSchema = external_exports.object({
 
 // ../../packages/protocol/src/product-analytics.ts
 var uuidSchema12 = external_exports.string().uuid();
+var opaqueRequestIdSchema = external_exports.string().trim().min(1).max(240);
 var safeNameSchema = external_exports.string().trim().min(1).max(120).regex(/^[a-z][a-z0-9._:-]*$/);
 var safeSurfaceSchema = external_exports.string().trim().min(1).max(80).regex(/^[a-z][a-z0-9_-]*$/);
 var routeSegmentSchema = /^(?:[a-z][a-z0-9-]{0,31}|:[a-z][a-z0-9_]{0,31}|\*)$/;
@@ -42866,15 +42955,21 @@ var commandInvocationInputSchema = external_exports.object({
   tenant_id: uuidSchema12,
   user_id: uuidSchema12.optional(),
   seat_id: uuidSchema12.optional(),
+  run_id: uuidSchema12.optional(),
+  agent_turn_execution_id: uuidSchema12.optional(),
+  session_id: uuidSchema12.optional(),
   command_id: safeNameSchema,
   source: analyticsSourceSchema,
   actor_kind: external_exports.enum(["user", "agent", "system"]),
+  execution_lane: external_exports.enum(["chat", "run", "mcp_session", "runner", "system"]).optional(),
+  initiator_kind: external_exports.enum(["user", "agent", "system"]).optional(),
+  initiator_user_id: uuidSchema12.nullable().optional(),
   scope_kind: external_exports.enum(["tenant_admin", "tenant", "seat"]),
   status: commandInvocationStatusSchema,
   guard_result: external_exports.enum(["allowed", "denied_manifest", "denied_budget", "escalated", "denied_tenant_policy"]).optional(),
   duration_ms: durationMsSchema,
   confirmation_required: external_exports.boolean().optional(),
-  request_id: uuidSchema12.optional(),
+  request_id: opaqueRequestIdSchema.optional(),
   properties: analyticsPropertiesSchema.optional(),
   occurred_at: external_exports.string().datetime({ offset: true }).optional()
 }).strict().superRefine((value, ctx) => {
@@ -43343,8 +43438,8 @@ var seatTrustSummarySchema = external_exports.object({
   run_count: external_exports.number().int().nonnegative(),
   failed_run_count: external_exports.number().int().nonnegative(),
   tool_call_count: external_exports.number().int().nonnegative(),
-  // The hero metric: actions held this period because they exceeded the charter.
   denied_tool_call_count: external_exports.number().int().nonnegative(),
+  held_tool_call_count: external_exports.number().int().nonnegative(),
   last_activity_at: isoDateTime4.nullable()
 }).strict();
 var agentListRunsInputSchema = external_exports.object({
@@ -43372,6 +43467,7 @@ var seatRunSchema = external_exports.object({
   cost_usd: external_exports.string(),
   tool_call_count: external_exports.number().int().nonnegative(),
   denied_tool_call_count: external_exports.number().int().nonnegative(),
+  held_tool_call_count: external_exports.number().int().nonnegative(),
   skill_activation_count: external_exports.number().int().nonnegative()
 }).strict();
 var seatRunErrorLogSchema = runErrorLogSchema.extend({
@@ -43677,6 +43773,34 @@ var runnerExecutionReadinessSchema = external_exports.object({
   recent_completed_at: isoDateTime6.nullable(),
   recent_failed_at: isoDateTime6.nullable()
 }).strict();
+var runnerClaimabilityCheckSchema = external_exports.object({
+  key: external_exports.string(),
+  actual: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]),
+  required: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]),
+  passed: external_exports.boolean(),
+  remediation: external_exports.string()
+}).strict();
+var runnerClaimabilityExplainSchema = external_exports.object({
+  claimable: external_exports.boolean(),
+  build_claimable: external_exports.boolean(),
+  merge_claimable: external_exports.boolean(),
+  checks: external_exports.array(runnerClaimabilityCheckSchema),
+  hold_reasons: external_exports.array(external_exports.enum([
+    "dependency",
+    "serial",
+    "evidence",
+    "human",
+    "runner_capability",
+    "runner_version",
+    "runner_sandbox",
+    "capacity",
+    "schedule",
+    "paused",
+    "policy",
+    "unknown"
+  ])),
+  remediation: external_exports.string()
+}).strict();
 var runnerSandboxPostureSchema = external_exports.enum(["guard", "strict", "off", "none", "unknown"]);
 var runnerPostureSchema = external_exports.object({
   sandbox: runnerSandboxPostureSchema,
@@ -43777,6 +43901,7 @@ var runnerDiagnoseOutputSchema = external_exports.object({
   last_heartbeat_at: isoDateTime6.nullable(),
   paired_at: isoDateTime6.nullable(),
   revocation_state: external_exports.enum(["active", "revoked", "unpaired"]),
+  claimability: runnerClaimabilityExplainSchema,
   repair_guidance: external_exports.array(external_exports.object({
     action: external_exports.string(),
     command: external_exports.string(),
@@ -44626,6 +44751,62 @@ var softwarePhaseSchedulerStateSchema = external_exports.object({
   remediation_href: external_exports.string().nullable(),
   work_order_id: uuid11.nullable()
 });
+var softwareDispatchHoldReasonSchema = external_exports.enum([
+  "dependency",
+  "serial",
+  "evidence",
+  "human",
+  "runner_capability",
+  "runner_version",
+  "runner_sandbox",
+  "capacity",
+  "schedule",
+  "paused",
+  "policy",
+  "unknown"
+]);
+var softwareDispatchPreviewRunnerRequirementSchema = external_exports.object({
+  profile: external_exports.enum(["forge_build", "forge_merge", "grooming"]),
+  min_cli_version: external_exports.string().nullable(),
+  min_merge_version: external_exports.string().nullable(),
+  sandbox_postures: external_exports.array(external_exports.enum(["guard", "strict"]))
+}).strict();
+var softwareDispatchPreviewItemSchema = external_exports.object({
+  kind: external_exports.enum(["changeset", "task"]),
+  id: uuid11,
+  ordinal: external_exports.number().int().positive(),
+  title: external_exports.string(),
+  changeset_ordinal: external_exports.number().int().positive().nullable(),
+  task_key: external_exports.string().nullable(),
+  depends_on: external_exports.array(external_exports.string()),
+  parallelizable: external_exports.boolean(),
+  est_turns: external_exports.number().int().nullable(),
+  hold_reason: softwareDispatchHoldReasonSchema.nullable(),
+  hold_detail: external_exports.string().nullable()
+}).strict();
+var softwareDispatchPreviewSchema = external_exports.object({
+  status: external_exports.enum(["ready", "grooming", "held"]),
+  digest: external_exports.string().min(1),
+  expires_at: external_exports.string(),
+  included_order: external_exports.array(softwareDispatchPreviewItemSchema),
+  held_items: external_exports.array(softwareDispatchPreviewItemSchema),
+  dependencies: external_exports.array(external_exports.object({
+    from_task_key: external_exports.string(),
+    to_task_key: external_exports.string()
+  }).strict()).default([]),
+  serial_lanes: external_exports.array(external_exports.string()).default([]),
+  estimated_turns: external_exports.number().int().nullable(),
+  runner_requirements: softwareDispatchPreviewRunnerRequirementSchema,
+  authority_budget_envelope: external_exports.object({
+    automation_mode: softwareAutomationModeSchema,
+    inferred_risk: softwareRiskLevelSchema,
+    max_iterations: external_exports.number().int().nullable(),
+    max_wall_clock_seconds: external_exports.number().int().nullable(),
+    cost_budget_usd: external_exports.string().nullable()
+  }).strict(),
+  grooming_required: external_exports.boolean(),
+  grooming_reason: external_exports.string().nullable()
+}).strict();
 var softwareBuildRequestSummarySchema = external_exports.object({
   id: uuid11,
   software_project_id: uuid11,
@@ -44821,7 +45002,8 @@ var softwareRequestShowOutputSchema = external_exports.object({
   gates: external_exports.array(softwareGateSummarySchema),
   plan_versions: external_exports.array(softwarePlanVersionSummarySchema),
   changesets: external_exports.array(softwareChangesetSummarySchema),
-  tasks: external_exports.array(softwareTaskSummarySchema)
+  tasks: external_exports.array(softwareTaskSummarySchema),
+  dispatch_preview: softwareDispatchPreviewSchema.nullable()
 });
 var softwareRequestLifecycleReason = external_exports.string().trim().min(1).max(2e3);
 var softwareRequestPauseInputSchema = external_exports.object({
@@ -45786,6 +45968,7 @@ var syncBriefAgentActivitySchema = external_exports.object({
   failed_run_count: external_exports.number().int().nonnegative(),
   tool_call_count: external_exports.number().int().nonnegative(),
   denied_tool_call_count: external_exports.number().int().nonnegative(),
+  held_tool_call_count: external_exports.number().int().nonnegative().optional(),
   cost_usd: external_exports.number().nonnegative(),
   note: external_exports.string().min(1)
 }).strict();
@@ -45985,6 +46168,9 @@ var taskListOutputSchema = external_exports.object({
 var taskAcceptInputSchema = external_exports.object({
   id: uuidSchema19
 }).strict();
+var taskConfirmProposalInputSchema = external_exports.object({
+  id: uuidSchema19
+}).strict();
 var taskMutationOutputSchema = external_exports.object({
   task: external_exports.object({
     id: uuidSchema19,
@@ -47131,7 +47317,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-07-14.1",
+    version: "2026-07-14.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47190,7 +47376,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
 - Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
-- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
+- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call, guard-denied, and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include \`denied_tool_call_count\` and \`held_tool_call_count\` rollups: hard guard denials stay separate from actions escalated for review. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
 
 ## Review readiness before go-live
 
@@ -47384,7 +47570,7 @@ The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provide
     order: 80,
     title: "Sync rhythm playbook",
     summary: "How Signal, Friction, Cascade, and Sync Briefs turn weekly meetings into decision time.",
-    version: "2026-07-04.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -47718,7 +47904,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-15.1",
+    version: "2026-07-15.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -47791,7 +47977,9 @@ External connectors are being rolled out provider by provider, conservatively (r
       "error_log.resolve",
       "error_log.supersede",
       "runner.diagnose",
-      "runner.repair"
+      "runner.repair",
+      "tenant.anthropic_key.disable",
+      "tool_grants.tenant.update"
     ],
     legal: {
       publicRisk: "low",
@@ -47832,7 +48020,7 @@ A headless agent cannot complete setup unattended. Two things always require a h
 
 Treat these as blocking prerequisites: the agent prepares the request and waits for the human approver.
 
-- **Secrets never travel through the CLI.** Raw-secret sinks (\`credential.ingress\`, \`tenant.anthropic_key.save\`) are refused on every CLI path \u2014 an ergonomic verb, \`--input\`, and \`{{cli}} command <id> --json\` all stop with guidance instead of accepting the secret, because a value in argv lands in shell history and process arguments before any redaction. Provide the secret through the vault-backed flow (web Settings or the integration connect flow); the CLI only ever carries the non-secret credential *name*, scope, and provider.
+- **Secrets never travel through the CLI.** Raw-secret sinks (\`credential.ingress\`, \`tenant.anthropic_key.save\`) are refused on every CLI path \u2014 an ergonomic verb, \`--input\`, and \`{{cli}} command <id> --json\` all stop with guidance instead of accepting the secret, because a value in argv lands in shell history and process arguments before any redaction. Provide the secret through the vault-backed flow (web Settings or the integration connect flow); the CLI only ever carries the non-secret credential *name*, scope, and provider. Disabling tenant BYOK (\`tenant.anthropic_key.disable\`) never returns the old key; it revokes the active vault-backed credential only after managed Anthropic fallback is available.
 
 ## Placeholder legend
 
@@ -48083,7 +48271,7 @@ A leaked tenant-admin token can administer the whole tenant, not just one seat.
 
 ### Storing the Anthropic key and other credentials
 
-Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key; other secrets go through the Settings vault-ingress flow (\`credential.ingress\`), a human-only interactive flow that is deliberately not an agent-callable MCP tool and refuses raw secrets over CLI argv. \`rost_configure_agent_tools\` stages credential *requests* (provider, scope, and label only) but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
+Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key; other secrets go through the Settings vault-ingress flow (\`credential.ingress\`), a human-only interactive flow that is deliberately not an agent-callable MCP tool and refuses raw secrets over CLI argv. Disabling the tenant Anthropic key uses \`tenant.anthropic_key.disable\`: it is owner/admin-only, always human-gated, revokes the active credential row without reading or returning secret material, and first checks that managed Anthropic fallback is configured. \`rost_configure_agent_tools\` stages credential *requests* (provider, scope, and label only) but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
 
 ## When to use MCP or CLI
 
@@ -48174,7 +48362,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 
 | Command | Command ids | Purpose | Scope | Safe example |
 |---|---|---|---|---|
-| \`{{cli}} task list|accept|decline|complete|create\` | \`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`, \`task.create\` | Operate a seat's task queue. | Seat | \`{{cli}} task list --json\` |
+| \`{{cli}} task list|accept|decline|complete|create\` | \`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`, \`task.create\`, \`task.confirm_proposal\`, \`task.decline_proposal\` | Operate a seat's task queue and target-side proposal decisions. | Seat / tenant | \`{{cli}} task list --json\`; \`{{cli}} command task.confirm_proposal --json '{"id":"<task-id>"}'\` |
 | \`{{cli}} status record\` | \`status.record\` | Record measurable readings and goal status as a status event. | Seat | \`{{cli}} status record --measurable-id <id> --value 42\` |
 | \`{{cli}} signal list|get|confirm|correct\` | \`signal.list\`, \`signal.get\`, \`signal.confirm_reading\`, \`signal.correct_reading\` | Read and confirm Signal measurables. | Seat | \`{{cli}} signal list --json\` |
 | \`{{cli}} goal list|create|update|status|reparent|drop\` | \`goal.list\`, \`goal.create\`, \`goal.update\`, \`goal.set_status\`, \`goal.reparent\`, \`goal.drop\` | Manage Cascade goals. Scope varies by verb: \`status\` is seat-scoped, \`list\`/\`create\` need a tenant token, and \`update\`/\`reparent\`/\`drop\` require tenant-admin. | Seat to tenant-admin | \`{{cli}} goal list --json\` |
@@ -48182,7 +48370,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} escalation list|get|resolve|reject\` | \`escalation.list\`, \`escalation.get\`, \`escalation.resolve\`, \`escalation.reject\` | Work the steward escalation queue. | Steward | \`{{cli}} escalation list --json\` |
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
-| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
+| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, explain claimability gates, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
 | \`{{cli}} runner install-service|start|stop|restart|status|logs|uninstall --name <name> [--user-code <code>]\` | launchd/service manager (macOS today) + \`{{cli}} runner serve\` | Install and manage an always-on local runner service that keeps the runner online across reboots. The service runs the runner under the absolute Node binary with an explicit PATH (so it works under nvm/Homebrew) and bootstraps into whichever launchd domain the session supports. Pass \`--user-code\` to pair the service at install; otherwise install prints the exact command to pair it. No secret is stored in the service definition, its arguments, or logs. Non-macOS emits an explicit unsupported message. | Tenant (local machine) | \`{{cli}} runner install-service --name mac-mini --execute --user-code ABCD-EFGH\`; \`{{cli}} runner logs --name mac-mini\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` / credential flow for Baserow REST connect | \`integration.connect_rest\`, \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | Create a vault-backed Baserow REST integration through the credential flow, list connector metadata, read setup-readiness, read one connector's health, and run provider-specific tests without exposing credentials. | Tenant-admin for connect; tenant for reads/tests | \`{{cli}} integration readiness --provider google --json\` |
@@ -48203,7 +48391,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
 | \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
 | \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
-| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Request create/list/show return \`scheduler_state\`: \`queued\` when a runner work order exists, \`parked\` when the Forge team is staffed but no paired online runner can claim it, and \`not_configured\` when the runner-lane Forge Seat is missing. Parked and not-configured states link to \`/settings/runners/setup\`; runner pairing or the repair sweep re-enqueues the same pending intake idempotently. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
+| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Request create/list/show return \`scheduler_state\`: \`queued\` when a runner work order exists, \`parked\` when the Forge team is staffed but no paired online runner can claim it, and \`not_configured\` when the runner-lane Forge Seat is missing. Request detail also surfaces the signed, expiring dispatch preview with included order, held items, dependencies, estimated turns, runner requirements, and authority budget envelope. Parked and not-configured states link to \`/settings/runners/setup\`; runner pairing or the repair sweep re-enqueues the same pending intake idempotently. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
 
 Skills wrapper help:
 
@@ -48282,6 +48470,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_upload_org_context\` | \`onboarding.upload_context\` | Back-compat alias of \`onboarding.attach_reference\`. | Tenant | Prefer \`rost_attach_reference_document\`; same widened schema. |
 | \`rost_create_onboarding_invite\` | \`onboarding.create_invite\` | Invite a team member during onboarding. | Tenant | Call with a business email and role. |
 | \`rost_save_tenant_anthropic_key\` | \`tenant.anthropic_key.save\` | Store a tenant model key through the vault. | Tenant | Use only with a real human-provided secret. |
+| \`rost_disable_tenant_anthropic_key\` | \`tenant.anthropic_key.disable\` | Revoke the active tenant Anthropic BYOK credential after managed fallback is available. | Tenant-admin | Human-gated; call with \`{}\`. The old key value is never returned. |
 | \`rost_create_seat\` | \`seat.create\` | Create a Responsibility Graph seat. | Tenant | Call with \`{"name":"Finance","seat_type":"human"}\`. |
 | \`rost_rename_seat\` | \`seat.rename\` | Rename a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`name\`. |
 | \`rost_reparent_seat\` | \`seat.reparent\` | Move a seat under a new parent. | Seat or tenant-admin | Call with \`seat_id\` and \`parent_seat_id\`. |
@@ -48321,7 +48510,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_get_dogfood_fleet_health_digest\` | \`agent.fleet_digest\` | Capture the daily dogfood fleet-health digest: live/idle state, 24h/7d turns, spend, recent failed runs, unresolved errors, failed notifications, and next actions. | Tenant | Call with \`{}\`; optional \`window_hours\` bounds recent failed-run evidence, while \`error_limit\` caps linked evidence per seat. |
 | \`rost_system_health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | Call with \`{}\`; optional \`seat_id\` narrows inside the caller's server-derived scope. |
 | \`rost_run_agent_now\` | \`agent.run_now\` | Queue an immediate run for a live staffed agent without changing its saved schedule; cloud lane dispatches to the executor and runner lane queues for the paired runner. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
-| \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run Skill activation, tool-call, and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
+| \`rost_list_agent_runs\` | \`agent.list_runs\` | Read a seat's agent run history (status, lane, model, cost, per-run Skill activation, tool-call, guard-denied, and guard-held counts) plus the seat's run/tool-call rollup including held-action count. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`limit\` for a deeper window. |
 | \`rost_get_agent_run_diagnostics\` | \`agent.get_run\` | Read one run's diagnostic record: transcript reference, token/cost usage, outcome, linked product-visible run errors, and loaded Skill activation file metadata. File hashes/sizes identify the immutable source package, while model prompt text may be bounded or truncated. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","run_id":"<run-id>"}\`. |
 | \`rost_list_agent_tool_calls\` | \`agent.list_tool_calls\` | Read a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Never returns argument summaries or secret material. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; pass \`held_only: true\` for only guard-held calls. |
 | \`rost_list_agent_deliverables\` | \`deliverable.list\` | List durable agent deliverables for a seat, including explicit outputs and successful-run summaries. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
@@ -48345,7 +48534,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_mcp_tokens\` | \`mcp_token.list\` | List MCP token metadata (never token material). | Tenant | Call with \`{}\` or \`{"include_revoked":true}\`. |
 | \`rost_list_runners\` | \`runner.list\` | List local runners with heartbeat health, execution readiness, queue counts, and recent result evidence. | Tenant | Call with \`{}\`. |
 | \`rost_runner_status\` | \`runner.status\` | Read a single runner's capability, heartbeat health, and execute-readiness state. | Tenant | Call with \`runner_id\`. |
-| \`rost_diagnose_runner\` | \`runner.diagnose\` | Return runner health, capabilities, and repair guidance without secrets. | Tenant | Call with \`runner_id\`; actionable repair guidance exposes restart, re-pair, or missing CLI steps. |
+| \`rost_diagnose_runner\` | \`runner.diagnose\` | Return runner health, claimability checks, capabilities, and repair guidance without secrets. | Tenant | Call with \`runner_id\`; claimability exposes safe predicates, required vs actual values, pass/fail state, and remediation for claimable work. |
 | \`rost_runner_repair_guidance\` | \`runner.repair\` | Return focused repair steps for a runner: restart, re-pair, revoke stale, or install missing CLI runtime. | Tenant | Call with \`runner_id\` and optional \`issue\` (restart, re_pair, revoke_stale, missing_cli_runtime). |
 | \`rost_start_runner_pairing\` | \`runner.pairing.start\` | Open a runner pairing session and return the human pairing code. | Tenant-admin | Call with \`name\` and \`platform\`; owner/admin only. |
 | \`rost_revoke_runner\` | \`runner.revoke\` | Revoke a runner so it can no longer authenticate. | Tenant | Call with \`runner_id\`; expect human confirmation. |
@@ -48418,7 +48607,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_update_friction_issue_status\` | \`friction.update_status\` | Move a non-terminal issue between open and diagnosing. | Seat or tenant-admin | Call with \`issue_id\` and \`status\`. |
 | \`rost_resolve_friction_issue\` | \`friction.resolve\` | Resolve an issue with a root cause and remediation task. | Tenant | Human decision; expect confirmation. |
 | \`rost_link_task_to_friction_issue\` | \`friction.link_task\` | Attach an existing task as an issue's action task. | Seat or tenant-admin | Call with \`issue_id\` and \`task_id\`. |
-| \`rost_create_task\` | \`task.create\` | Create a task (a commitment between seats). | Seat or tenant-admin | \`none\` \u2014 created directly; the owning seat accepts or declines. |
+| \`rost_create_task\` | \`task.create\` | Create a task (a commitment between seats). | Seat or tenant-admin | \`none\` \u2014 human-created tasks go live directly; ordinary agent-created tasks become draft proposals; bounded Trusted proposals become offered or, for same-Steward live agent seats, in progress. |
 | \`rost_update_task\` | \`task.update\` | Reschedule, reassign, or edit a non-terminal task. | Owner (tenant-admin) | Pass \`task_id\` plus at least one of \`due_on\`/\`owner_seat_id\`/\`title\`/\`description\`; terminal tasks reject. |
 | \`rost_compile_sync_brief\` | \`sync.brief.compile\` | Compile the weekly Sync Brief (idempotent per period). | Tenant | Call with \`{}\`. |
 | \`rost_get_sync_brief\` | \`sync.brief.get\` | Read the latest or a specific Sync Brief and agenda. | Seat or tenant-admin | Call with \`{}\` or \`{"sync_brief_id":"<id>"}\`. |
@@ -48434,6 +48623,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_list_tool_catalog\` | \`tool.catalog\` | List the discoverable tool catalog the agent builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`. |
 | \`rost_list_tenant_capability_grants\` | \`tool_grants.tenant.list\` | List tenant capability ceilings/defaults with connection, availability, source, and compile status. | Tenant | Call with \`{}\`; no secrets or vault refs. |
+| \`rost_update_tenant_capability_policy\` | \`tool_grants.tenant.update\` | Change tenant-wide capability ceilings/defaults with optimistic policy version or digest protection. | Tenant-admin | Human-gated; call with \`expected_policy_version\` or \`expected_policy_digest\`, \`mode\`, and grant ceiling changes. Returns changed grants, clamped defaults, and affected live agents. |
 | \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_update_agent_capability_grants\` | \`tool_grants.agent.update\` | Compile a Charter supersession proposal for agent capability grant reductions or expansions. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","grants":[{"tool_grant_id":"<grant-id>","access_level":"read"}]}\`; active authority changes only after the signed Charter is superseded. |
 | \`rost_build_agent_activation_receipt\` | \`agent.activation_receipt\` | Build the current activation receipt for an agent: capabilities, connection metadata, digest, budget, and always-human boundary. | Seat or tenant-admin | Call with \`{"agent_id":"<agent-id>"}\`; rebuild after Charter, connection, lane, schedule, or grant changes. |
@@ -48468,7 +48658,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_resume_a_forge_build_request\` | \`software_factory.request.resume\` | Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Budget raised"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_projects\` | \`software_factory.project.list\` | List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. | Tenant | Call with \`{}\`; use the returned \`id\` as \`software_project_id\`. |
 | \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, risk, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
-| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, phase-run history, gates, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
+| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, signed dispatch preview, phase-run history, gates, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
 | \`rost_advance_a_forge_build_request_phase\` | \`software_factory.phase.advance\` | Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition. | Tenant | Call with \`{"build_request_id":"<request-id>","to_phase":"discovery_scoping"}\`. |
 | \`rost_decide_a_forge_gate\` | \`software_factory.gate.decide\` | A human approves or rejects a Forge gate; an agent caller routes to \`/approvals\` and can never self-approve. Sensitive gates record a linked human decision. | Tenant | Call with \`{"gate_id":"<gate-id>","decision":"approve"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_answer_forge_plan_clarifications\` | \`software_factory.request.answer_clarification\` | Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review; answers append to the versioned planning artifact and never widen authority or automation mode. | Tenant | Call with \`{"build_request_id":"<request-id>","answers":[{"question":"Which database?","answer":"Postgres"}],"mark_ready_for_plan_review":true}\`. |
@@ -49222,7 +49412,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
     order: 62,
     title: "Friction guide",
     summary: "How to capture issues with evidence, rank them, and resolve them without losing ownership.",
-    version: "2026-07-04.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -49237,6 +49427,8 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
       "friction.resolve",
       "friction.link_task",
       "task.create",
+      "task.confirm_proposal",
+      "task.decline_proposal",
       "task.list",
       "task.accept",
       "task.decline",
@@ -49282,7 +49474,7 @@ The Friction page opens with one computed line \u2014 how many issues are open,
 Friction, tasks, and escalations are the issue-to-action loop. A seat files, a task carries the work, and an escalation routes a decision a seat cannot make alone.
 
 - File and triage: \`{{cli}} friction file ...\` / \`friction.file_issue\` (seat) / \`rost_file_issue\`; list with \`{{cli}} friction list --status open --json\` / \`friction.list\` / \`rost_list_friction_issues\`; move between open and diagnosing with \`friction.update_status\` / \`rost_update_friction_issue_status\`.
-- Carry the work as a task: \`task.create\` / \`rost_create_task\` (a commitment between seats). \`task.create\` is \`none\` (no confirmation gate), so an agent can file one directly; an agent's task lands as a **draft** proposal (\`origin: agent_proposal\`) for a human to review and hand off \u2014 not a live offer in the owning seat's accept/decline queue. A seat runs its queue with \`{{cli}} task list|accept|decline|complete\` (\`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`). Link a task to an issue with \`friction.link_task\` / \`rost_link_task_to_friction_issue\`.
+- Carry the work as a task: \`task.create\` / \`rost_create_task\` (a commitment between seats). \`task.create\` is \`none\` (no confirmation gate), so an agent can file one directly; an ordinary agent task lands as a **draft** proposal (\`origin: agent_proposal\`) for a target-side human to confirm or decline through \`task.confirm_proposal\` / \`task.decline_proposal\` in \`/approvals\` or the CLI \u2014 not MCP, and not a live offer in the owning seat's accept/decline queue. A bounded Trusted task-create grant may skip that draft card: it creates an **offered** handoff by default, and only creates **in_progress** when both proposing and target seats are live agent seats resolving to the same current accountable human Steward. A seat runs its live queue with \`{{cli}} task list|accept|decline|complete\` (\`task.list\`, \`task.accept\`, \`task.decline\`, \`task.complete\`). Link a task to an issue with \`friction.link_task\` / \`rost_link_task_to_friction_issue\`.
 - Route a decision: \`escalation.raise\` (seat) / \`rost_escalate\` sends approval-scope or must-escalate work to the Steward queue. Reads are \`escalation.list\` / \`escalation.get\`. See the steward queue guide for resolution.
 
 In the app, the Tasks surface exposes the same queue operations for a seat's visible work. Offered handoffs show Accept and Decline actions; Decline opens a reason field and records the reason through \`task.decline\`. Edit opens a separate task form for title, owner, due date, and description changes on non-terminal tasks. These controls are standard focusable disclosures so keyboard and pointer users can operate the queue without dropping to CLI.
@@ -49293,7 +49485,7 @@ In the app, the Tasks surface exposes the same queue operations for a seat's vis
 
 ## When to stop for confirmation
 
-\`friction.resolve\` is \`human_required\`; resolving an issue is a human decision. \`friction.link_task\`, \`task.create\`, \`task.accept\`, \`task.decline\`, and \`task.complete\` are \`none\`, so a seat files issues, creates commitments, and runs its own task queue directly. \`friction.update_status\`, \`escalation.raise\`, \`friction.file_issue\`, and \`friction.list\` are also not gated. An agent files Friction, proposes the task, and escalates; a human resolves.
+\`friction.resolve\` is \`human_required\`; resolving an issue is a human decision. \`friction.link_task\`, \`task.create\`, \`task.accept\`, \`task.decline\`, \`task.confirm_proposal\`, \`task.decline_proposal\`, and \`task.complete\` are \`none\`, so they do not mint pending confirmations. The proposal decision commands still require a human actor with target-side authority and are app/CLI-only, not MCP-exposed; they are not agent-callable approval shortcuts. \`friction.update_status\`, \`escalation.raise\`, \`friction.file_issue\`, and \`friction.list\` are also not gated. An agent files Friction, proposes the task, and escalates; a human resolves or decides the proposed commitment.
 
 ## Resolution rule
 
@@ -49374,11 +49566,11 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-14.2",
+    version: "2026-07-15.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
-    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve"],
+    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve", "task.confirm_proposal", "task.decline_proposal"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native human-gate guidance."] },
     sources: [
       {
@@ -49424,11 +49616,11 @@ A held tool call actuates the same way regardless of which command backs it \u20
 
 ## The approvals queue
 
-The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
+The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations, open steward escalations, and agent-proposed draft tasks into a single queue, each item shown with its risk or proposal type, the source or proposing seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy, escalations routed to their steward chain, and task proposals where they occupy or steward the target seat. Confirming a task proposal runs \`task.confirm_proposal\` and moves the draft to Offered; declining runs \`task.decline_proposal\` and records a human reason. Neither action accepts the task, schedules a run, or executes agent work. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
 
 ## The rule for agents
 
-An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) are not even exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human.
+An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) and proposal decision commands (\`task.confirm_proposal\`, \`task.decline_proposal\`) are not exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human. Draft task proposals follow the same rule: the agent can propose the commitment, but a target-side human confirms or declines it unless a bounded Trusted grant applies.
 
 ## When to stop
 
@@ -49548,7 +49740,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-14.1",
+    version: "2026-07-15.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49648,7 +49840,7 @@ The company autonomy ceiling is a single tenant-wide dial that caps how much ANY
 The CLI confirmation mode is a separate tenant-wide dial. It does not change what an agent may do (that is the company autonomy ceiling above); it changes whether the {{cli}} CLI tool itself may stand in for a human at an already-gated confirmation.
 
 - \`careful\` is the strict default for every company, including internal ones. The server refuses the CLI's silent auto-replay of a pending confirmation \u2014 a human must review it before it is approved.
-- \`trusted_operator\` is a deliberate tenant_admin opt-in (an ADR-0018 \xA76 standing authorization) that lets the CLI silently auto-approve a non-\`dangerous\` confirmation. A \`dangerous\`-risk confirmation always requires interactive human review, in either mode.
+- \`trusted_operator\` is a deliberate tenant_admin opt-in (an ADR-0018 \xA76 standing authorization) that lets the CLI silently auto-approve only confirmations whose command is explicitly classified Trusted-eligible. Always-human, not-applicable, missing, unknown, and \`dangerous\`-risk confirmations still require interactive human review in either mode.
 - Read it with \`settings.confirmation_policy.get\` (CLI: \`{{cli}} settings confirmation-mode get\`). Set it with \`settings.confirmation_policy.update\` (CLI: \`{{cli}} settings confirmation-mode set --mode trusted_operator\`). Owner-only and human-gated.
 - Stored at \`tenants.settings.confirmation_policy\`; enforced server-side in \`confirmation.approve\`, so a stale or modified local CLI cannot bypass it.
 
@@ -50058,12 +50250,13 @@ Name the failing surface, collect evidence, recommend the smallest correction, a
     order: 78,
     title: "AI model data handling guide",
     summary: "How {{brand}} cloud agents, local MCP sessions, runners, BYOK, and connected tools handle model-bound data.",
-    version: "2026-07-01.3",
+    version: "2026-07-01.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
     relatedCommandIds: [
       "tenant.anthropic_key.save",
+      "tenant.anthropic_key.disable",
       "credential.ingress",
       "agent.configure_tools",
       "mcp_token.create",
@@ -50149,7 +50342,7 @@ Tenant BYOK changes which provider account is used for eligible \`cloud\` model
 
 {{brand}} also includes a capped, app-provided Claude allowance for agent-assisted setup so a new company can complete onboarding before saving its own key. That allowance is shown in the onboarding provider card and in Settings as an approximate number of included setup tokens \u2014 never a dollar amount \u2014 and is enforced server-side on every platform-key call: an agent turn or an org-intake step reserves the allowance before the provider request and settles actual usage after. When the included tokens are used, agent-assisted steps stop before calling the provider and prompt you to add your own Anthropic API key, while non-AI setup steps stay available. Saving a tenant Anthropic key (BYOK) switches those calls to your provider account and does not draw down the included allowance.
 
-Store a tenant Anthropic key only through \`tenant.anthropic_key.save\` / \`rost_save_tenant_anthropic_key\` or the generic credential ingress path. The key is handled as a vault-backed credential: {{brand}} stores a vault reference and safe metadata, not the raw key in prompts, config, logs, or command output. A human approves the credential flow.
+Store a tenant Anthropic key only through \`tenant.anthropic_key.save\` / \`rost_save_tenant_anthropic_key\` or the generic credential ingress path. Disable it through \`tenant.anthropic_key.disable\` or Settings, which revokes the active credential only after managed Anthropic fallback is configured and never reads or returns the old secret. The key is handled as a vault-backed credential: {{brand}} stores a vault reference and safe metadata, not the raw key in prompts, config, logs, or command output. A human approves the credential flow and the disable flow.
 
 After BYOK is saved, provider-side retention, training, regional, HIPAA, or zero-data-retention posture depends on that Anthropic organization, workspace, model, feature, and contract. Do not tell a customer "BYOK means zero retention" or "BYOK means no training" unless their provider arrangement actually says that.
 
@@ -50244,6 +50437,7 @@ When asked about AI data handling:
       "charter.sign_manifest",
       "credential.ingress",
       "tenant.anthropic_key.save",
+      "tenant.anthropic_key.disable",
       "runner.pairing.start",
       "agent.configure_tools",
       "agent.list_tool_calls",
@@ -51755,7 +51949,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.go_live", "namespace": "agent", "action": "go_live", "title": "Go live", "description": "Promote a dry-run agent seat to live after the human approval gate.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Move an agent live only after dry-run evidence, signed permissions, and a human Steward chain are clear.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
   { "id": "agent.import_definition", "namespace": "agent", "action": "import_definition", "title": "Import agent definition", "description": "Import a versioned ROST agent definition into a canonical draft Seat and setup state without credentials, placement identifiers, or go-live side effects.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "definition_json", "flag": "definition-json", "type": "string", "required": true }, { "name": "idempotency_key", "flag": "idempotency-key", "type": "string", "required": false }], "hasComplexInput": false, "help": "Import a strict, versioned ROST agent definition into a canonical draft Seat/setup. The file cannot carry credentials or tenant-local placement ids; tools remain proposal-only until reviewed through setup." },
   { "id": "agent.list_fleet", "namespace": "agent", "action": "list_fleet", "title": "List agent fleet", "description": "Return every agent-occupied seat with lane, live state, last real turn, recent turn counts, top measurable status, open escalations, and 7-day real-run spend.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read every agent-occupied seat at once: lane, live state, last real turn, 24h/7d turns, measurable status, escalations, and spend." },
-  { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call and guard-denial counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call and guard-held counts (the Trust Card)." },
+  { "id": "agent.list_runs", "namespace": "agent", "action": "list_runs", "title": "List agent runs", "description": "Return a seat's agent run history (status, lane, model, cost, per-run tool-call, guard-denied, and guard-held counts) plus the seat's run/tool-call rollup with held-action count.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Audit a seat's agent run history with per-run tool-call, guard-denied, and guard-held counts (the Trust Card)." },
   { "id": "agent.list_tool_calls", "namespace": "agent", "action": "list_tool_calls", "title": "List agent tool calls", "description": "Return a seat's tool-call ledger (tool name, guard result, manifest clause, outcome) with the held-action count as the hero metric. Pass held_only to return only guard-held calls. Never returns argument summaries or secret material.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }, { "name": "held_only", "flag": "held-only", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Audit a seat's tool-call ledger with each call's guard result; held actions are the hero metric." },
   { "id": "agent.pause", "namespace": "agent", "action": "pause", "title": "Pause agent", "description": "Pause a live agent so it stops scheduled and on-demand runs. Reversible with agent.resume.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause a live agent so it stops scheduled and on-demand runs; queued work orders are expired and a paused agent refuses to run until resumed. Reversible, unlike agent.decommission." },
   { "id": "agent.resume", "namespace": "agent", "action": "resume", "title": "Resume agent", "description": "Resume a paused agent back to live. Blocks if the steward chain no longer resolves to a human.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resume a paused agent back to live; the no-orphan guard blocks a resume whose steward chain no longer resolves to a human." },
@@ -51864,7 +52058,7 @@ var COMMAND_MANIFEST = [
   { "id": "onboarding.finish", "namespace": "onboarding", "action": "finish", "title": "Finish onboarding", "description": "Mark onboarding complete after the existing onboarding requirements pass.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Finish onboarding when the graph, at least one Charter, and the first operating rhythm are clear." },
   { "id": "onboarding.status", "namespace": "onboarding", "action": "status", "title": "Onboard status", "description": "Return current onboarding progress, graph summary, and the next recommended actions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Start by checking onboarding status, then use the implementation method guide to choose the next setup step." },
   { "id": "onboarding.upload_context", "namespace": "onboarding", "action": "upload_context", "title": "Upload org context", "description": "Compatibility alias for onboarding.attach_reference: attach a company reference document (text/markdown) that Compass and Charters can cite. Reference-only \u2014 it does not build a Compass.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "text", "flag": "text", "type": "string", "required": true }, { "name": "filename", "flag": "filename", "type": "string", "required": false }, { "name": "mime_type", "flag": "mime-type", "type": "enum", "required": false, "enumValues": ["text/plain", "text/markdown", "text/csv"] }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["plan", "financial", "org_chart", "process"] }, { "name": "source", "flag": "source", "type": "string", "required": false }], "hasComplexInput": false, "help": "Compatibility alias for onboarding.attach_reference: attach a company reference document so Compass and Charters can cite it. It does not build a Compass.", "example": { "text": "# Company handbook\n\nWe build precision components for the aerospace supply chain.", "filename": "handbook.md", "mime_type": "text/markdown", "title": "Company handbook", "kind": "plan", "source": "handbook/overview.md" } },
-  { "id": "runner.diagnose", "namespace": "runner", "action": "diagnose", "title": "Diagnose runner", "description": "Returns a runner's health, capabilities, and repair guidance without exposing secrets.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Inspect a runner's health, capabilities, and get repair guidance without exposing secrets." },
+  { "id": "runner.diagnose", "namespace": "runner", "action": "diagnose", "title": "Diagnose runner", "description": "Returns a runner's health, capabilities, and repair guidance without exposing secrets.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Inspect a runner's health, claimability checks, and repair guidance without exposing secrets." },
   { "id": "runner.list", "namespace": "runner", "action": "list", "title": "List runners", "description": "List local runners registered to the tenant with online/offline/revoked state.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "include_revoked", "flag": "include-revoked", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List local runners and their online/offline/revoked state before queueing runner work." },
   { "id": "runner.pairing.start", "namespace": "runner", "action": "pairing.start", "title": "Start runner pairing", "description": "Open a runner pairing session and return the human pairing code and URL. The runner bearer secret is never returned here.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "name", "flag": "name", "type": "string", "required": true }, { "name": "platform", "flag": "platform", "type": "string", "required": true }], "hasComplexInput": false, "help": "Open a runner pairing session and share the user code; the runner bearer secret is never surfaced here." },
   { "id": "runner.repair", "namespace": "runner", "action": "repair", "title": "Runner repair guidance", "description": "Returns actionable repair steps for a runner: restart, re-pair, revoke stale, or install missing CLI runtime. No secrets exposed.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "runner_id", "flag": "runner-id", "type": "string", "required": true }, { "name": "issue", "flag": "issue", "type": "enum", "required": false, "enumValues": ["restart", "re_pair", "revoke_stale", "missing_cli_runtime"] }], "hasComplexInput": false, "help": "Get focused repair steps for a runner: restart, re-pair, revoke a stale runner, or install missing CLI runtime." },
@@ -51949,7 +52143,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.pause", "namespace": "software_factory", "action": "request.pause", "title": "Pause a Forge build request", "description": "Pause an in-flight Forge build request. New runner claims stop immediately; any running task halts at the next task checkpoint before resume. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause an in-flight Forge build request so no new runner work starts; running work stops at the next task checkpoint. Tenant-admin and human-gated." },
   { "id": "software_factory.request.resume", "namespace": "software_factory", "action": "request.resume", "title": "Resume a Forge build request", "description": "Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": true, "help": "Resume a paused or blocked Forge build request from its last completed task checkpoint after human review. Tenant-admin and human-gated." },
-  { "id": "software_factory.request.show", "namespace": "software_factory", "action": "request.show", "title": "Show a Forge build request", "description": "The Forge request detail: the build request, its current phase, phase-run history, and gates. Read-only, entitlement-gated, tenant-scoped.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Show a Forge build request's detail: current phase, phase-run history, and gates. Read-only; requires the Forge add-on." },
+  { "id": "software_factory.request.show", "namespace": "software_factory", "action": "request.show", "title": "Show a Forge build request", "description": "The Forge request detail: the build request, its current phase, phase-run history, and gates. Read-only, entitlement-gated, tenant-scoped.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Show a Forge build request's detail: current phase, dispatch preview, phase-run history, and gates. Read-only; requires the Forge add-on." },
   { "id": "software_factory.secret_request.list", "namespace": "software_factory", "action": "secret_request.list", "title": "List Forge secret requests", "description": "List durable Forge missing-secret/config requests. Metadata only; no secret values or vault refs are returned.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["pending", "fulfilled", "rejected", "canceled"] }], "hasComplexInput": false, "help": "List durable Forge missing-secret requests and their approval-task status. Metadata only; no secret values or vault refs." },
   { "id": "software_factory.secret.grant", "namespace": "software_factory", "action": "secret.grant", "title": "Grant a Forge secret", "description": "A human grants a seat scoped access to a project secret by VAULT REF (project \xD7 env \xD7 seat \xD7 action \xD7 key). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": true }], "hasComplexInput": false, "help": "A human grants a seat scoped access to a project secret by vault ref (Postgres stores only the pointer, never secret material). Owner-only and human-gated." },
   { "id": "software_factory.secret.request", "namespace": "software_factory", "action": "secret.request", "title": "Request a Forge secret grant", "description": "An agent or user REQUESTS access to a project secret by key (draft-and-confirm \u2014 no value, no grant). Records the ask as a durable event for a human to grant. Never accepts a secret value (invariant #5). Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Request access to a project secret by key; persists the request and creates a human approval task. Never accepts a secret value." },
@@ -51971,12 +52165,15 @@ var COMMAND_MANIFEST = [
   { "id": "system.health", "namespace": "system", "action": "health", "title": "System health", "description": "Return a scoped health snapshot for agent runs, errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Read a scoped system health snapshot across agent runs, errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness." },
   { "id": "task.accept", "namespace": "task", "action": "accept", "title": "Accept task", "description": "Accept an offered handoff task owned by the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Accept an offered task only when the seat can deliver it within its Charter." },
   { "id": "task.complete", "namespace": "task", "action": "complete", "title": "Complete task", "description": "Complete an accepted handoff task and emit a handoff event back to the requesting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": true }], "hasComplexInput": true, "help": "Complete an accepted task with a summary so the requesting seat receives the handoff." },
-  { "id": "task.create", "namespace": "task", "action": "create", "title": "Create task", "description": "Create a task (a commitment between seats). Agent-created tasks land in draft for human confirmation; human-created tasks are offered (handoff) or in progress.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": true }, { "name": "from_seat_id", "flag": "from-seat-id", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "description", "flag": "description", "type": "string", "required": true }, { "name": "goal_id", "flag": "goal-id", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a task as a commitment between seats; agent proposals land in draft for human confirmation.", "example": { "owner_seat_id": "0190dddd-dddd-7ddd-8ddd-dddddddddddd", "from_seat_id": "0190eeee-eeee-7eee-8eee-eeeeeeeeeeee", "title": "Reconcile the March vendor statements", "description": "Match every March vendor statement line to a recorded invoice and flag discrepancies.", "goal_id": "0190ffff-ffff-7fff-8fff-ffffffffffff", "acceptance_criteria": ["All March statements reconciled", "Discrepancies filed as Friction issues"], "due_on": "2026-04-15" } },
+  { "id": "task.confirm_proposal", "namespace": "task", "action": "confirm_proposal", "title": "Confirm proposed task", "description": "Confirm an agent-proposed draft task when the current human has target-side authority.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Confirm an agent-proposed draft task when the current human has authority for the target seat." },
+  { "id": "task.create", "namespace": "task", "action": "create", "title": "Create task", "description": "Create a task (a commitment between seats). Agent-created tasks land in draft for human confirmation; human-created tasks are offered (handoff) or in progress.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": true }, { "name": "from_seat_id", "flag": "from-seat-id", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "description", "flag": "description", "type": "string", "required": true }, { "name": "goal_id", "flag": "goal-id", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a task as a commitment between seats; ordinary agent proposals land in draft for target-side human confirmation, while bounded Trusted proposals may become offered or in progress.", "example": { "owner_seat_id": "0190dddd-dddd-7ddd-8ddd-dddddddddddd", "from_seat_id": "0190eeee-eeee-7eee-8eee-eeeeeeeeeeee", "title": "Reconcile the March vendor statements", "description": "Match every March vendor statement line to a recorded invoice and flag discrepancies.", "goal_id": "0190ffff-ffff-7fff-8fff-ffffffffffff", "acceptance_criteria": ["All March statements reconciled", "Discrepancies filed as Friction issues"], "due_on": "2026-04-15" } },
   { "id": "task.decline", "namespace": "task", "action": "decline", "title": "Decline task", "description": "Decline an offered handoff task owned by the acting seat with a reason.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Decline an offered task with a clear reason when it is out of scope for the seat." },
+  { "id": "task.decline_proposal", "namespace": "task", "action": "decline_proposal", "title": "Decline proposed task", "description": "Decline an agent-proposed draft task with a target-side human reason.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Decline an agent-proposed draft task with a target-side human reason." },
   { "id": "task.import", "namespace": "task", "action": "import", "title": "Import Tasks from a ninety To-Dos export", "description": "Bulk-import a ninety To-Dos export into Tasks. Owners are seat names resolved to seats; each to-do becomes a seat-owned task with provenance origin_kind:manual. Idempotent \u2014 re-importing the same export is a no-op, and an existing non-terminal task with the same seat + title is skipped.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Import a ninety To-Dos export into Tasks (origin_kind:manual); owners resolve to seats, idempotent by file + seat/title." },
   { "id": "task.list", "namespace": "task", "action": "list", "title": "List seat tasks", "description": "List open handoff tasks owned by the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List the seat's open handoff tasks before accepting, declining, or completing work." },
   { "id": "task.update", "namespace": "task", "action": "update", "title": "Update task", "description": "Reschedule (due date), reassign (owner seat), or edit a non-terminal task's title, description, or acceptance criteria. Terminal tasks cannot be edited \u2014 a correction is a new task.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "task_id", "flag": "task-id", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "due_on", "flag": "due-on", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "description", "flag": "description", "type": "string", "required": false }, { "name": "acceptance_criteria", "flag": "acceptance-criteria", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Reschedule, reassign, or edit a non-terminal task; terminal tasks are immutable (a correction is a new task)." },
   { "id": "team.health_score", "namespace": "team", "action": "health_score", "title": "Team health score", "description": "Return the single rolled-up 0\u2013100 team-health score (latest month) with its band (green/yellow/red) and label. Honest insufficient-data state when no metrics exist yet.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read the single rolled-up 0-100 team-health score (latest month) with its band and label." },
+  { "id": "tenant.anthropic_key.disable", "namespace": "tenant", "action": "anthropic_key.disable", "title": "Disable tenant Anthropic key", "description": "Revoke the active tenant Anthropic BYOK credential while preserving audit history, after validating managed inference fallback is available.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Disable tenant BYOK only after managed Anthropic fallback is available; this revokes metadata without reading or returning the old key." },
   { "id": "tenant.anthropic_key.save", "namespace": "tenant", "action": "anthropic_key.save", "title": "Save tenant Anthropic key", "description": "Store a tenant-scoped Anthropic key in the configured vault.", "requiredScope": "tenant", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "secretBlocked": true, "help": "Save model-provider credentials only through vault-backed flows and keep raw keys out of prompts, logs, and command metadata." },
   { "id": "tenant.create", "namespace": "tenant", "action": "create", "title": "Create additional company", "description": "Create a new clean company for an already-provisioned account after checking tenant.create.additional entitlement.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "company_name", "flag": "company-name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Create an additional clean company from an existing company session. Requires tenant.create.additional entitlement; first-company bootstrap stays signup.provision_tenant." },
   { "id": "tenant.model_gateway_policy.update", "namespace": "tenant", "action": "model_gateway_policy.update", "title": "Update model gateway policy", "description": "Unlock or relock managed models that do not offer a zero-retention (ZDR) tier (ADR-0019). Locked (the conservative default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated: unlocking is a deliberate ADR-0018 \xA76 standing authorization that lets managed brains without a zero-retention tier run. This provider retains data up to 30 days for abuse monitoring.", "requiredScope": "tenant_admin", "confirmation": "dangerous", "exposeOverMcp": true, "fields": [{ "name": "allow_non_zdr_models", "flag": "allow-non-zdr-models", "type": "boolean", "required": true }], "hasComplexInput": false, "help": "Unlock or relock managed models that do not offer a zero-retention (ZDR) tier (ADR-0019). Locked (default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated; unlocking establishes an ADR-0018 \xA76 standing authorization and surfaces the per-model retention disclosure." },
@@ -51984,6 +52181,7 @@ var COMMAND_MANIFEST = [
   { "id": "tool_grants.agent.effective", "namespace": "tool_grants", "action": "agent.effective", "title": "List agent effective capability grants", "description": "Read the effective capability grants for one agent, including the lower-of-ceiling-and-selection access level and compile status. Returns metadata only.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied." },
   { "id": "tool_grants.agent.update", "namespace": "tool_grants", "action": "agent.update", "title": "Update agent capability grants", "description": "Compile a Charter supersession proposal for per-agent capability grant reductions or expansions. Human steward/admin only.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": true, "help": "Compile a Charter supersession proposal for an agent capability grant reduction or expansion. Human steward/admin only." },
   { "id": "tool_grants.tenant.list", "namespace": "tool_grants", "action": "tenant.list", "title": "List tenant capability grants", "description": "Read the tenant capability ceiling/default matrix with connection, availability, source, ceiling, and compile status. Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List tenant capability ceilings/defaults with connection, availability, source, and compile status. Read-only." },
+  { "id": "tool_grants.tenant.update", "namespace": "tool_grants", "action": "tenant.update", "title": "Update tenant capability policy", "description": "Atomically update tenant capability mode, company maximums, and new-agent defaults with stale-write protection and affected-agent impact.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "expected_policy_version", "flag": "expected-policy-version", "type": "integer", "required": false }, { "name": "expected_policy_digest", "flag": "expected-policy-digest", "type": "string", "required": false }, { "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["managed", "open"] }], "hasComplexInput": true, "help": "Update tenant capability ceilings/defaults with stale-write protection; owner/admin only, human-gated, and event-audited." },
   { "id": "tool.catalog", "namespace": "tool", "action": "catalog", "title": "List tool catalog", "description": "List the discoverable tool catalog the agent builder reads \u2014 tool id, title, provider, prescriptive description, default scope tiers, credential requirement, access policy, and execution-boundary guidance.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "provider", "flag": "provider", "type": "string", "required": false }], "hasComplexInput": false, "help": "List the tool catalog the builder reads \u2014 id, prescriptive description, scope tiers, credential requirement, access policy, and execution-boundary guidance." },
   { "id": "usage.report", "namespace": "usage", "action": "report", "title": "AI-workforce ROI report", "description": "Return the tenant's immutable per-period usage snapshots \u2014 agents ran, outputs, token/run cost, human-accepted value, exceptions, and approvals \u2014 for the AI-workforce ROI report.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Read the AI-workforce ROI report \u2014 per-period agents/outputs/token+run cost, human-accepted value, exceptions, and approvals \u2014 from immutable usage snapshots." },
   { "id": "usage.snapshot", "namespace": "usage", "action": "snapshot", "title": "Capture usage period snapshot", "description": "Freeze the current (or a given) period's usage and accepted-value totals into an immutable snapshot for the ROI report. Insert-only and idempotent \u2014 re-running a captured period changes nothing.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": true, "help": "Freeze the current period's usage and accepted-value totals into an immutable snapshot for the ROI report; insert-only and idempotent, so re-running a captured period changes nothing." },