@skrr-ai/cli 0.1.100 → 0.1.102

package/oclif.manifest.json

@@ -27199,7 +27199,7 @@
           "required": true
         }
       },
-      "description": "Per-commitment analytics (joined checks, outcomes, runs)",
+      "description": "Daily Check/outcome analytics; use --ledger for joined native Runs. Legacy totals.autoRuns is not a native Run count",
       "examples": [
         "<%= config.bin %> commitments analytics detail obj_abc123",
         "<%= config.bin %> commitments analytics detail obj_abc123 --days 30",
@@ -27253,7 +27253,7 @@
           "type": "option"
         },
         "ledger": {
-          "description": "Show the joined ledger projection instead",
+          "description": "Show joined checks, native Runs and deliveries instead of daily Check/outcome metrics",
           "name": "ledger",
           "allowNo": false,
           "type": "boolean"
@@ -28141,6 +28141,295 @@
         "complete.js"
       ]
     },
+    "commitments:control:apply": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Apply the exact scope, version and execution targets from a saved control preview",
+      "examples": [
+        "<%= config.bin %> commitments control apply <id> --from-json control.json --idempotency-key <key>"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "from-json": {
+          "description": "Reviewed control preview file, or - for stdin",
+          "name": "from-json",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "idempotency-key": {
+          "description": "Stable key for retries of this exact control request",
+          "name": "idempotency-key",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "reason": {
+          "description": "Reason for this control (at most 1000 characters)",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the actual control receipt as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:control:apply",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "control",
+        "apply.js"
+      ]
+    },
+    "commitments:control:preview": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        },
+        "scope": {
+          "description": "Control scope",
+          "name": "scope",
+          "options": [
+            "mute_updates",
+            "pause_observation",
+            "cancel_worker",
+            "cancel_episode",
+            "cancel_subtree",
+            "retire"
+          ],
+          "required": true
+        }
+      },
+      "description": "Review a responsibility control and its exact affected execution attempts",
+      "examples": [
+        "<%= config.bin %> commitments control preview <id> cancel_worker --assignment <id> --json > control.json",
+        "<%= config.bin %> commitments control preview <id> pause_observation --json > control.json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "target": {
+          "description": "Exact target ID (repeat for multiple targets)",
+          "name": "target",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "assignment": {
+          "description": "Assignment ID to inspect",
+          "name": "assignment",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workflow-run": {
+          "description": "Workflow episode ID to inspect",
+          "name": "workflow-run",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "node": {
+          "dependsOn": [
+            "workflow-run"
+          ],
+          "description": "Node key in the selected workflow episode",
+          "name": "node",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the complete frozen preview for control apply",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:control:preview",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "control",
+        "preview.js"
+      ]
+    },
+    "commitments:control:show": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        },
+        "controlId": {
+          "description": "Control receipt ID",
+          "name": "controlId",
+          "required": true
+        }
+      },
+      "description": "Read an exact responsibility control receipt and its current acknowledgement state",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output the control receipt as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:control:show",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "control",
+        "show.js"
+      ]
+    },
     "commitments:cost": {
       "aliases": [],
       "args": {
@@ -28455,14 +28744,14 @@
           "type": "option"
         },
         "watch-space": {
-          "description": "Space to watch (repeatable). Accepts a space id, ref, or unique title. Implies --watch space.",
+          "description": "One Space to watch. Accepts a space id, ref, or unique title. Implies --watch space.",
           "name": "watch-space",
           "hasDynamicHelp": false,
           "multiple": true,
           "type": "option"
         },
         "watch-monitor": {
-          "description": "Signal Monitor id to watch (repeatable). Implies --watch monitor.",
+          "description": "One Signal Monitor id to watch. Implies --watch monitor.",
           "name": "watch-monitor",
           "hasDynamicHelp": false,
           "multiple": true,
@@ -31578,20 +31867,185 @@
         "next-tick.js"
       ]
     },
-    "commitments:observations": {
+    "commitments:observation:probe": {
       "aliases": [],
       "args": {
-        "commitmentId": {
-          "description": "Commitment ID",
-          "name": "commitmentId",
-          "required": true
+        "id": {
+          "description": "Saved Commitment ID; omit for an unsaved draft",
+          "name": "id"
         }
       },
-      "description": "Show what the commitment's runs reported observing",
+      "description": "Perform a bounded source-read probe for a saved responsibility or unsaved draft",
       "examples": [
-        "<%= config.bin %> commitments observations obj_abc123",
-        "<%= config.bin %> commitments observations obj_abc123 --declared-only --changed-only",
-        "<%= config.bin %> commitments observations obj_abc123 --since 2026-08-01 --limit 100 --json"
+        "<%= config.bin %> commitments observation probe <id> --expected-version 7 --timeout-ms 5000",
+        "<%= config.bin %> commitments observation probe --from-json draft.json --json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "from-json": {
+          "description": "Unsaved draft JSON file, or - for stdin",
+          "name": "from-json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "expected-version": {
+          "description": "Exact saved Commitment version",
+          "name": "expected-version",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "timeout-ms": {
+          "description": "Saved source-probe timeout (1..15000ms)",
+          "name": "timeout-ms",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output source evidence as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:observation:probe",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "observation",
+        "probe.js"
+      ]
+    },
+    "commitments:observation:summary": {
+      "aliases": [],
+      "args": {},
+      "description": "Read the bounded portfolio observation projection without performing new source checks",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Filter the authenticated portfolio by Agent ID",
+          "name": "agent",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the complete observation projection as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:observation:summary",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "observation",
+        "summary.js"
+      ]
+    },
+    "commitments:observations": {
+      "aliases": [],
+      "args": {
+        "commitmentId": {
+          "description": "Commitment ID",
+          "name": "commitmentId",
+          "required": true
+        }
+      },
+      "description": "Show what the commitment's runs reported observing",
+      "examples": [
+        "<%= config.bin %> commitments observations obj_abc123",
+        "<%= config.bin %> commitments observations obj_abc123 --declared-only --changed-only",
+        "<%= config.bin %> commitments observations obj_abc123 --since 2026-08-01 --limit 100 --json"
       ],
       "flags": {
         "bare": {
@@ -32755,24 +33209,183 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "json": {
-          "description": "Output as JSON",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "file": {
-          "description": "Path to the reviewed proposal JSON payload",
-          "name": "file",
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "file": {
+          "description": "Path to the reviewed proposal JSON payload",
+          "name": "file",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:propose-remediation",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "propose-remediation.js"
+      ]
+    },
+    "commitments:readiness:show": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        },
+        "receiptId": {
+          "description": "Readiness or activation receipt ID",
+          "name": "receiptId",
+          "required": true
+        }
+      },
+      "description": "Read one exact historical admission or activation receipt without refreshing its evidence",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output the exact receipt as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:readiness:show",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "readiness",
+        "show.js"
+      ]
+    },
+    "commitments:readiness:verify": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Verify one exact saved responsibility version and record canonical readiness evidence",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "expected-version": {
+          "description": "Reviewed Commitment version",
+          "name": "expected-version",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "timeout-ms": {
+          "description": "Source-probe timeout (1..15000ms)",
+          "name": "timeout-ms",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the recorded readiness receipt as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:propose-remediation",
+      "id": "commitments:readiness:verify",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -32785,7 +33398,8 @@
         "dist",
         "commands",
         "commitments",
-        "propose-remediation.js"
+        "readiness",
+        "verify.js"
       ]
     },
     "commitments:receipt": {
@@ -34335,14 +34949,14 @@
           "type": "option"
         },
         "watch-space": {
-          "description": "Space to watch (repeatable). Accepts a space id, ref, or unique title. Implies --watch space.",
+          "description": "One Space to watch. Accepts a space id, ref, or unique title. Implies --watch space.",
           "name": "watch-space",
           "hasDynamicHelp": false,
           "multiple": true,
           "type": "option"
         },
         "watch-monitor": {
-          "description": "Signal Monitor id to watch (repeatable). Implies --watch monitor.",
+          "description": "One Signal Monitor id to watch. Implies --watch monitor.",
           "name": "watch-monitor",
           "hasDynamicHelp": false,
           "multiple": true,
@@ -34497,6 +35111,75 @@
         "wake-capabilities.js"
       ]
     },
+    "commitments:work-plan": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Read permission-filtered delegated assignments and workflow episodes for a responsibility",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output the complete public work-plan projection as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:work-plan",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "work-plan.js"
+      ]
+    },
     "compass:archive": {
       "aliases": [],
       "args": {
@@ -34552,31 +35235,215 @@
           "type": "boolean"
         },
         "agent": {
-          "description": "Agent ID that owns the compass",
+          "description": "Agent ID that owns the compass",
+          "name": "agent",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "reason": {
+          "description": "Why — recorded on the revision ledger",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "yes": {
+          "char": "y",
+          "description": "Skip confirmation prompt",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "compass:archive",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "compass",
+        "archive.js"
+      ]
+    },
+    "compass:commitments": {
+      "aliases": [],
+      "args": {
+        "compassId": {
+          "description": "Compass ID",
+          "name": "compassId",
+          "required": true
+        }
+      },
+      "description": "List the commitments governed by a compass",
+      "examples": [
+        "<%= config.bin %> compass commitments agch_abc123 --agent agent_xyz"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Agent ID that owns the compass",
+          "name": "agent",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "compass:commitments",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "compass",
+        "commitments.js"
+      ]
+    },
+    "compass:create": {
+      "aliases": [],
+      "args": {},
+      "description": "Create a compass for an agent",
+      "examples": [
+        "<%= config.bin %> compass create --agent agent_abc --title \"Production reliability\" --domain reliability",
+        "<%= config.bin %> compass create --agent agent_abc --title \"FinOps\" --invariant \"Cloud spend stays under $10k/mo\"",
+        "<%= config.bin %> compass create --agent agent_abc --json-body ./compass.json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Agent ID",
           "name": "agent",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "reason": {
-          "description": "Why — recorded on the revision ledger",
-          "name": "reason",
+        "title": {
+          "description": "Human-readable direction, e.g. \"Production reliability\"",
+          "name": "title",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "yes": {
-          "char": "y",
-          "description": "Skip confirmation prompt",
-          "name": "yes",
-          "allowNo": false,
-          "type": "boolean"
+        "domain": {
+          "description": "Broad subject area, e.g. \"aws\" or \"finops\"",
+          "name": "domain",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "invariant": {
+          "description": "Invariant target description (repeatable). The state the agent keeps true.",
+          "name": "invariant",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "json-body": {
+          "description": "Path to a JSON file with the full body (merged under the flags)",
+          "name": "json-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "compass:archive",
+      "id": "compass:create",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -34589,10 +35456,10 @@
         "dist",
         "commands",
         "compass",
-        "archive.js"
+        "create.js"
       ]
     },
-    "compass:commitments": {
+    "compass:effective-policy": {
       "aliases": [],
       "args": {
         "compassId": {
@@ -34601,10 +35468,7 @@
           "required": true
         }
       },
-      "description": "List the commitments governed by a compass",
-      "examples": [
-        "<%= config.bin %> compass commitments agch_abc123 --agent agent_xyz"
-      ],
+      "description": "Read a Compass policy revision, effective defaults and field provenance",
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -34639,128 +35503,24 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "json": {
-          "description": "Output as JSON",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
         "agent": {
-          "description": "Agent ID that owns the compass",
+          "description": "Agent ID that owns the Compass",
           "name": "agent",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "compass:commitments",
-      "pluginAlias": "@skrr-ai/cli",
-      "pluginName": "@skrr-ai/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "autonomousCredentialPolicy": "delegated",
-      "resolveSpaceFlag": true,
-      "isESM": false,
-      "relativePath": [
-        "dist",
-        "commands",
-        "compass",
-        "commitments.js"
-      ]
-    },
-    "compass:create": {
-      "aliases": [],
-      "args": {},
-      "description": "Create a compass for an agent",
-      "examples": [
-        "<%= config.bin %> compass create --agent agent_abc --title \"Production reliability\" --domain reliability",
-        "<%= config.bin %> compass create --agent agent_abc --title \"FinOps\" --invariant \"Cloud spend stays under $10k/mo\"",
-        "<%= config.bin %> compass create --agent agent_abc --json-body ./compass.json"
-      ],
-      "flags": {
-        "bare": {
-          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
-          "name": "bare",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "token": {
-          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
-          "name": "token",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "workspace": {
-          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
-          "name": "workspace",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
-          "name": "profile",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "raw": {
-          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
-          "name": "raw",
-          "allowNo": false,
-          "type": "boolean"
         },
         "json": {
-          "description": "Output as JSON",
+          "description": "Output the complete policy and provenance as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "agent": {
-          "description": "Agent ID",
-          "name": "agent",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "title": {
-          "description": "Human-readable direction, e.g. \"Production reliability\"",
-          "name": "title",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "domain": {
-          "description": "Broad subject area, e.g. \"aws\" or \"finops\"",
-          "name": "domain",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "invariant": {
-          "description": "Invariant target description (repeatable). The state the agent keeps true.",
-          "name": "invariant",
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "type": "option"
-        },
-        "json-body": {
-          "description": "Path to a JSON file with the full body (merged under the flags)",
-          "name": "json-body",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "compass:create",
+      "id": "compass:effective-policy",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -34773,7 +35533,7 @@
         "dist",
         "commands",
         "compass",
-        "create.js"
+        "effective-policy.js"
       ]
     },
     "compass:list": {
@@ -35337,7 +36097,8 @@
       "examples": [
         "<%= config.bin %> compass update agch_abc --agent agent_xyz --title \"Reliability & cost\"",
         "<%= config.bin %> compass update agch_abc --agent agent_xyz --invariant \"p99 under 300ms\" --reason \"new SLO\"",
-        "<%= config.bin %> compass update agch_abc --agent agent_xyz --json-body ./compass.json"
+        "<%= config.bin %> compass update agch_abc --agent agent_xyz --json-body ./compass.json",
+        "<%= config.bin %> compass update agch_abc --agent agent_xyz --title \"New\" --expected-version 4"
       ],
       "flags": {
         "bare": {
@@ -35426,6 +36187,13 @@
           "multiple": false,
           "type": "option"
         },
+        "expected-version": {
+          "description": "Compass version this change is based on; the update is refused if it moved. Defaults to the version read at the start of this command.",
+          "name": "expected-version",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "json-body": {
           "description": "Path to a JSON file with the full body",
           "name": "json-body",
@@ -55691,7 +56459,7 @@
           "type": "option"
         },
         "request-id": {
-          "description": "Idempotency key for this command. Repeating the invocation with the same id returns the run it already started (and its output, for 5 minutes after it ends) instead of running it again. Letters, digits and . _ : / - only.",
+          "description": "Idempotency key for this command. Repeating the invocation with the same id returns the run it already started instead of running it again. Output is kept for at most 5 minutes after it ends and at most 60 seconds after the first terminal read, whichever expires sooner. Letters, digits and . _ : / - only.",
           "name": "request-id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -78431,7 +79199,7 @@
     "signals:monitors:validate": {
       "aliases": [],
       "args": {},
-      "description": "Compile-only check of a Monitor definition; nothing is persisted",
+      "description": "Compile-only check of a Monitor definition; nothing is persisted. Requires active Signal Sources owned by you in the selected workspace. Inspect each source with signals sources show before validating.",
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -94152,11 +94920,22 @@
           "type": "boolean"
         },
         "json": {
-          "description": "Output the cancelled run as JSON",
+          "description": "Output the cancelled run as JSON (cancellation.scope and the waitingFor.workflowRunId of the cancelled nodes show which child runs were left running)",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
         },
+        "scope": {
+          "description": "What happens to child workflow runs this run started: preserve_children (default) leaves them running, subtree stops every descendant run too",
+          "name": "scope",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "preserve_children",
+            "subtree"
+          ],
+          "type": "option"
+        },
         "yes": {
           "char": "y",
           "description": "Skip confirmation prompt",
@@ -94184,6 +94963,105 @@
         "cancel.js"
       ]
     },
+    "spaces:workflows:cancel-node": {
+      "aliases": [],
+      "args": {
+        "spaceId": {
+          "description": "Owning Space ID",
+          "name": "spaceId",
+          "required": true
+        },
+        "runId": {
+          "description": "Workflow run ID",
+          "name": "runId",
+          "required": true
+        },
+        "nodeKey": {
+          "description": "Node key to stop",
+          "name": "nodeKey",
+          "required": true
+        }
+      },
+      "description": "Request cancellation of one exact workflow node attempt and show the returned execution state",
+      "examples": [
+        "<%= config.bin %> spaces workflows run <space> <run> --json > reviewed-run.json",
+        "<%= config.bin %> spaces workflows cancel-node <space> <run> <node> --from-json reviewed-run.json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "from-json": {
+          "description": "Saved canonical workflow run snapshot, or - for stdin",
+          "name": "from-json",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "reason": {
+          "description": "Cancellation reason (at most 500 characters)",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the updated workflow run as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "spaces:workflows:cancel-node",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "spaces",
+        "workflows",
+        "cancel-node.js"
+      ]
+    },
     "spaces:workflows:create": {
       "aliases": [],
       "args": {
@@ -96987,7 +97865,7 @@
           "type": "option"
         },
         "max-duration": {
-          "description": "Run duration limit, e.g. 90m, 4h or 2d. A run still open past it is cancelled with WORKFLOW_RUN_DEADLINE. Applies from the next publish; runs already started keep their deadline",
+          "description": "Run duration limit from 5m to 90d inclusive, e.g. 90m, 4h or 2d. A run still open past it is cancelled with WORKFLOW_RUN_DEADLINE. Applies from the next publish; runs already started keep their deadline",
           "name": "max-duration",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -117234,7 +118112,7 @@
           "dependsOn": [
             "cron"
           ],
-          "description": "Cap total fires (recurring only)",
+          "description": "Cap total occurrences (recurring only): each scheduled fire counts, and so does an occurrence you complete by hand before the scheduler touches it",
           "name": "max-runs",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -124262,7 +125140,7 @@
           "type": "option"
         },
         "scope": {
-          "description": "Trigger scope kind",
+          "description": "Trigger scope kind. A scope can have prerequisites (a space_oracle Space needs a Leader agent): `triggers capabilities <scope>` lists them under \"Needs\"",
           "name": "scope",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -131362,5 +132240,5 @@
       ]
     }
   },
-  "version": "0.1.100"
+  "version": "0.1.102"
 }