@skrr-ai/cli 0.1.101 → 0.1.103

package/oclif.manifest.json

@@ -16838,7 +16838,7 @@
           "type": "option"
         },
         "max-fires-per-day": {
-          "description": "Daily fire cap (schedule/stochastic)",
+          "description": "Daily fire cap (schedule, stochastic and self_scheduled triggers only)",
           "name": "max-fires-per-day",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -18253,7 +18253,7 @@
           "type": "option"
         },
         "max-fires-per-day": {
-          "description": "Daily fire cap",
+          "description": "Daily fire cap (schedule, stochastic and self_scheduled triggers only)",
           "name": "max-fires-per-day",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -28141,6 +28141,295 @@
         "complete.js"
       ]
     },
+    "commitments:control:apply": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Apply the exact scope, version and execution targets from a saved control preview",
+      "examples": [
+        "<%= config.bin %> commitments control apply <id> --from-json control.json --idempotency-key <key>"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "from-json": {
+          "description": "Reviewed control preview file, or - for stdin",
+          "name": "from-json",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "idempotency-key": {
+          "description": "Stable key for retries of this exact control request",
+          "name": "idempotency-key",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "reason": {
+          "description": "Reason for this control (at most 1000 characters)",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the actual control receipt as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:control:apply",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "control",
+        "apply.js"
+      ]
+    },
+    "commitments:control:preview": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        },
+        "scope": {
+          "description": "Control scope",
+          "name": "scope",
+          "options": [
+            "mute_updates",
+            "pause_observation",
+            "cancel_worker",
+            "cancel_episode",
+            "cancel_subtree",
+            "retire"
+          ],
+          "required": true
+        }
+      },
+      "description": "Review a responsibility control and its exact affected execution attempts",
+      "examples": [
+        "<%= config.bin %> commitments control preview <id> cancel_worker --assignment <id> --json > control.json",
+        "<%= config.bin %> commitments control preview <id> pause_observation --json > control.json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "target": {
+          "description": "Exact target ID (repeat for multiple targets)",
+          "name": "target",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "assignment": {
+          "description": "Assignment ID to inspect",
+          "name": "assignment",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workflow-run": {
+          "description": "Workflow episode ID to inspect",
+          "name": "workflow-run",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "node": {
+          "dependsOn": [
+            "workflow-run"
+          ],
+          "description": "Node key in the selected workflow episode",
+          "name": "node",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the complete frozen preview for control apply",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:control:preview",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "control",
+        "preview.js"
+      ]
+    },
+    "commitments:control:show": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        },
+        "controlId": {
+          "description": "Control receipt ID",
+          "name": "controlId",
+          "required": true
+        }
+      },
+      "description": "Read an exact responsibility control receipt and its current acknowledgement state",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output the control receipt as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:control:show",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "control",
+        "show.js"
+      ]
+    },
     "commitments:cost": {
       "aliases": [],
       "args": {
@@ -28455,14 +28744,14 @@
           "type": "option"
         },
         "watch-space": {
-          "description": "Space to watch (repeatable). Accepts a space id, ref, or unique title. Implies --watch space.",
+          "description": "One Space to watch. Accepts a space id, ref, or unique title. Implies --watch space.",
           "name": "watch-space",
           "hasDynamicHelp": false,
           "multiple": true,
           "type": "option"
         },
         "watch-monitor": {
-          "description": "Signal Monitor id to watch (repeatable). Implies --watch monitor.",
+          "description": "One Signal Monitor id to watch. Implies --watch monitor.",
           "name": "watch-monitor",
           "hasDynamicHelp": false,
           "multiple": true,
@@ -31578,20 +31867,185 @@
         "next-tick.js"
       ]
     },
-    "commitments:observations": {
+    "commitments:observation:probe": {
       "aliases": [],
       "args": {
-        "commitmentId": {
-          "description": "Commitment ID",
-          "name": "commitmentId",
-          "required": true
+        "id": {
+          "description": "Saved Commitment ID; omit for an unsaved draft",
+          "name": "id"
         }
       },
-      "description": "Show what the commitment's runs reported observing",
+      "description": "Perform a bounded source-read probe for a saved responsibility or unsaved draft",
       "examples": [
-        "<%= config.bin %> commitments observations obj_abc123",
-        "<%= config.bin %> commitments observations obj_abc123 --declared-only --changed-only",
-        "<%= config.bin %> commitments observations obj_abc123 --since 2026-08-01 --limit 100 --json"
+        "<%= config.bin %> commitments observation probe <id> --expected-version 7 --timeout-ms 5000",
+        "<%= config.bin %> commitments observation probe --from-json draft.json --json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "from-json": {
+          "description": "Unsaved draft JSON file, or - for stdin",
+          "name": "from-json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "expected-version": {
+          "description": "Exact saved Commitment version",
+          "name": "expected-version",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "timeout-ms": {
+          "description": "Saved source-probe timeout (1..15000ms)",
+          "name": "timeout-ms",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output source evidence as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:observation:probe",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "observation",
+        "probe.js"
+      ]
+    },
+    "commitments:observation:summary": {
+      "aliases": [],
+      "args": {},
+      "description": "Read the bounded portfolio observation projection without performing new source checks",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Filter the authenticated portfolio by Agent ID",
+          "name": "agent",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the complete observation projection as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:observation:summary",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "observation",
+        "summary.js"
+      ]
+    },
+    "commitments:observations": {
+      "aliases": [],
+      "args": {
+        "commitmentId": {
+          "description": "Commitment ID",
+          "name": "commitmentId",
+          "required": true
+        }
+      },
+      "description": "Show what the commitment's runs reported observing",
+      "examples": [
+        "<%= config.bin %> commitments observations obj_abc123",
+        "<%= config.bin %> commitments observations obj_abc123 --declared-only --changed-only",
+        "<%= config.bin %> commitments observations obj_abc123 --since 2026-08-01 --limit 100 --json"
       ],
       "flags": {
         "bare": {
@@ -32788,128 +33242,21 @@
         "propose-remediation.js"
       ]
     },
-    "commitments:receipt": {
+    "commitments:readiness:show": {
       "aliases": [],
       "args": {
         "id": {
+          "description": "Commitment ID",
           "name": "id",
           "required": true
-        }
-      },
-      "description": "Explain what happened from the event through work, delivery, and verification",
-      "examples": [
-        "<%= config.bin %> commitments receipt <id> --latest",
-        "<%= config.bin %> commitments receipt <id> --check objchk_abc",
-        "<%= config.bin %> commitments receipt <id> --run arun_abc"
-      ],
-      "flags": {
-        "bare": {
-          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
-          "name": "bare",
-          "allowNo": false,
-          "type": "boolean"
         },
-        "token": {
-          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
-          "name": "token",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "workspace": {
-          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
-          "name": "workspace",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
-          "name": "profile",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "raw": {
-          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
-          "name": "raw",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "latest": {
-          "description": "Show the latest wake (default)",
-          "name": "latest",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "limit": {
-          "description": "Number of receipts to show",
-          "name": "limit",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "check": {
-          "description": "Explain one specific check — its exact receipt, not the latest-N window",
-          "name": "check",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "run": {
-          "description": "Explain the run — resolves to the receipt of the check that minted it",
-          "name": "run",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "json": {
-          "description": "Output projected receipts as JSON",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "verbose": {
-          "description": "Include source IDs and diagnostic traces",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "commitments:receipt",
-      "pluginAlias": "@skrr-ai/cli",
-      "pluginName": "@skrr-ai/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "autonomousCredentialPolicy": "delegated",
-      "resolveSpaceFlag": true,
-      "isESM": false,
-      "relativePath": [
-        "dist",
-        "commands",
-        "commitments",
-        "receipt.js"
-      ]
-    },
-    "commitments:receipt-metrics": {
-      "aliases": [],
-      "args": {
-        "id": {
-          "description": "Commitment ID",
-          "name": "id",
+        "receiptId": {
+          "description": "Readiness or activation receipt ID",
+          "name": "receiptId",
           "required": true
         }
       },
-      "description": "Show a closed quarter's execution receipt metrics for a commitment",
-      "examples": [
-        "<%= config.bin %> commitments receipt-metrics obj_abc123",
-        "<%= config.bin %> commitments receipt-metrics obj_abc123 --year 2026 --quarter 2",
-        "<%= config.bin %> commitments receipt-metrics obj_abc123 --verbose",
-        "<%= config.bin %> commitments receipt-metrics obj_abc123 --json"
-      ],
+      "description": "Read one exact historical admission or activation receipt without refreshing its evidence",
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -32944,36 +33291,16 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "year": {
-          "description": "Calendar year (defaults to the last closed quarter)",
-          "name": "year",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "quarter": {
-          "description": "Quarter 1-4 (defaults to the last closed quarter)",
-          "name": "quarter",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
         "json": {
-          "description": "Output as JSON",
+          "description": "Output the exact receipt as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "verbose": {
-          "description": "Include the measurement basis behind the rates",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:receipt-metrics",
+      "id": "commitments:readiness:show",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -32986,22 +33313,20 @@
         "dist",
         "commands",
         "commitments",
-        "receipt-metrics.js"
+        "readiness",
+        "show.js"
       ]
     },
-    "commitments:reflect": {
+    "commitments:readiness:verify": {
       "aliases": [],
       "args": {
-        "commitmentId": {
+        "id": {
           "description": "Commitment ID",
-          "name": "commitmentId",
+          "name": "id",
           "required": true
         }
       },
-      "description": "Run a commitment's reflection pass now (retunes cadence)",
-      "examples": [
-        "<%= config.bin %> commitments reflect obj_abc123"
-      ],
+      "description": "Verify one exact saved responsibility version and record canonical readiness evidence",
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -33036,8 +33361,23 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "expected-version": {
+          "description": "Reviewed Commitment version",
+          "name": "expected-version",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "timeout-ms": {
+          "description": "Source-probe timeout (1..15000ms)",
+          "name": "timeout-ms",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "json": {
-          "description": "Output as JSON",
+          "description": "Output the recorded readiness receipt as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
@@ -33045,7 +33385,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:reflect",
+      "id": "commitments:readiness:verify",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33058,19 +33398,24 @@
         "dist",
         "commands",
         "commitments",
-        "reflect.js"
+        "readiness",
+        "verify.js"
       ]
     },
-    "commitments:reflection": {
+    "commitments:receipt": {
       "aliases": [],
       "args": {
-        "commitmentId": {
-          "description": "Commitment ID",
-          "name": "commitmentId",
+        "id": {
+          "name": "id",
           "required": true
         }
       },
-      "description": "Read pending and decided reflection proposals for a commitment",
+      "description": "Explain what happened from the event through work, delivery, and verification",
+      "examples": [
+        "<%= config.bin %> commitments receipt <id> --latest",
+        "<%= config.bin %> commitments receipt <id> --check objchk_abc",
+        "<%= config.bin %> commitments receipt <id> --run arun_abc"
+      ],
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -33105,16 +33450,49 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "latest": {
+          "description": "Show the latest wake (default)",
+          "name": "latest",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Number of receipts to show",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "check": {
+          "description": "Explain one specific check — its exact receipt, not the latest-N window",
+          "name": "check",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "run": {
+          "description": "Explain the run — resolves to the receipt of the check that minted it",
+          "name": "run",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "json": {
-          "description": "Output as JSON",
+          "description": "Output projected receipts as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
+        },
+        "verbose": {
+          "description": "Include source IDs and diagnostic traces",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:reflection",
+      "id": "commitments:receipt",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33127,24 +33505,25 @@
         "dist",
         "commands",
         "commitments",
-        "reflection.js"
+        "receipt.js"
       ]
     },
-    "commitments:reflection-decision": {
+    "commitments:receipt-metrics": {
       "aliases": [],
       "args": {
-        "commitmentId": {
+        "id": {
           "description": "Commitment ID",
-          "name": "commitmentId",
-          "required": true
-        },
-        "proposalKey": {
-          "description": "Reflection proposal key",
-          "name": "proposalKey",
+          "name": "id",
           "required": true
         }
       },
-      "description": "Approve or reject a commitment reflection proposal",
+      "description": "Show a closed quarter's execution receipt metrics for a commitment",
+      "examples": [
+        "<%= config.bin %> commitments receipt-metrics obj_abc123",
+        "<%= config.bin %> commitments receipt-metrics obj_abc123 --year 2026 --quarter 2",
+        "<%= config.bin %> commitments receipt-metrics obj_abc123 --verbose",
+        "<%= config.bin %> commitments receipt-metrics obj_abc123 --json"
+      ],
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -33179,28 +33558,36 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "year": {
+          "description": "Calendar year (defaults to the last closed quarter)",
+          "name": "year",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "quarter": {
+          "description": "Quarter 1-4 (defaults to the last closed quarter)",
+          "name": "quarter",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "json": {
           "description": "Output as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
         },
-        "decision": {
-          "description": "Decision to record",
-          "name": "decision",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "approve",
-            "reject"
-          ],
-          "type": "option"
+        "verbose": {
+          "description": "Include the measurement basis behind the rates",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:reflection-decision",
+      "id": "commitments:receipt-metrics",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33213,10 +33600,10 @@
         "dist",
         "commands",
         "commitments",
-        "reflection-decision.js"
+        "receipt-metrics.js"
       ]
     },
-    "commitments:remediate": {
+    "commitments:reflect": {
       "aliases": [],
       "args": {
         "commitmentId": {
@@ -33225,10 +33612,9 @@
           "required": true
         }
       },
-      "description": "Apply a bounded remediation to a misbehaving commitment",
+      "description": "Run a commitment's reflection pass now (retunes cadence)",
       "examples": [
-        "<%= config.bin %> commitments remediate obj_abc123 --action mute_user_nudges",
-        "<%= config.bin %> commitments remediate obj_abc123 --action reduce_nudge_frequency --reason \"too chatty during launch\""
+        "<%= config.bin %> commitments reflect obj_abc123"
       ],
       "flags": {
         "bare": {
@@ -33269,39 +33655,11 @@
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "action": {
-          "description": "Adjust lifecycle or reporting. Agent permissions and Workspace administration have their own controls.",
-          "name": "action",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "options": [
-            "pause_commitment",
-            "mute_user_nudges",
-            "reduce_nudge_frequency",
-            "mark_noop"
-          ],
-          "type": "option"
-        },
-        "reason": {
-          "description": "Why (recorded on the boundary-change ledger)",
-          "name": "reason",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "recommendation-type": {
-          "description": "Recommendation this remediation answers, when it came from one",
-          "name": "recommendation-type",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:remediate",
+      "id": "commitments:reflect",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33314,24 +33672,19 @@
         "dist",
         "commands",
         "commitments",
-        "remediate.js"
+        "reflect.js"
       ]
     },
-    "commitments:remediation-proposal": {
+    "commitments:reflection": {
       "aliases": [],
       "args": {
         "commitmentId": {
           "description": "Commitment ID",
           "name": "commitmentId",
           "required": true
-        },
-        "proposalId": {
-          "description": "Proposal ID",
-          "name": "proposalId",
-          "required": true
         }
       },
-      "description": "Show a frozen remediation proposal",
+      "description": "Read pending and decided reflection proposals for a commitment",
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -33375,7 +33728,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:remediation-proposal",
+      "id": "commitments:reflection",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33388,19 +33741,24 @@
         "dist",
         "commands",
         "commitments",
-        "remediation-proposal.js"
+        "reflection.js"
       ]
     },
-    "commitments:remediation-proposals": {
+    "commitments:reflection-decision": {
       "aliases": [],
       "args": {
         "commitmentId": {
           "description": "Commitment ID",
           "name": "commitmentId",
           "required": true
+        },
+        "proposalKey": {
+          "description": "Reflection proposal key",
+          "name": "proposalKey",
+          "required": true
         }
       },
-      "description": "List case-scoped remediation proposals for a commitment",
+      "description": "Approve or reject a commitment reflection proposal",
       "flags": {
         "bare": {
           "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
@@ -33441,31 +33799,22 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "case-id": {
-          "description": "Only proposals for this case",
-          "name": "case-id",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "status": {
-          "description": "Proposal lifecycle status to include",
-          "name": "status",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "limit": {
-          "description": "Proposals to return (1..200)",
-          "name": "limit",
+        "decision": {
+          "description": "Decision to record",
+          "name": "decision",
+          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "approve",
+            "reject"
+          ],
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:remediation-proposals",
+      "id": "commitments:reflection-decision",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33478,25 +33827,290 @@
         "dist",
         "commands",
         "commitments",
-        "remediation-proposals.js"
+        "reflection-decision.js"
       ]
     },
-    "commitments:reports": {
+    "commitments:remediate": {
       "aliases": [],
       "args": {
-        "id": {
+        "commitmentId": {
           "description": "Commitment ID",
-          "name": "id",
+          "name": "commitmentId",
           "required": true
         }
       },
-      "description": "Manage a commitment's report targets",
+      "description": "Apply a bounded remediation to a misbehaving commitment",
       "examples": [
-        "<%= config.bin %> commitments reports <commitment-id>",
-        "<%= config.bin %> commitments reports <commitment-id> --add slack_channel --target C0123456 --on material_change",
-        "<%= config.bin %> commitments reports <commitment-id> --add main --on completion",
-        "<%= config.bin %> commitments reports <commitment-id> --add user_notify --target <user-id> --review owner",
-        "<%= config.bin %> commitments reports <commitment-id> --remove slack_channel:C0123456"
+        "<%= config.bin %> commitments remediate obj_abc123 --action mute_user_nudges",
+        "<%= config.bin %> commitments remediate obj_abc123 --action reduce_nudge_frequency --reason \"too chatty during launch\""
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "action": {
+          "description": "Adjust lifecycle or reporting. Agent permissions and Workspace administration have their own controls.",
+          "name": "action",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "pause_commitment",
+            "mute_user_nudges",
+            "reduce_nudge_frequency",
+            "mark_noop"
+          ],
+          "type": "option"
+        },
+        "reason": {
+          "description": "Why (recorded on the boundary-change ledger)",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "recommendation-type": {
+          "description": "Recommendation this remediation answers, when it came from one",
+          "name": "recommendation-type",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:remediate",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "remediate.js"
+      ]
+    },
+    "commitments:remediation-proposal": {
+      "aliases": [],
+      "args": {
+        "commitmentId": {
+          "description": "Commitment ID",
+          "name": "commitmentId",
+          "required": true
+        },
+        "proposalId": {
+          "description": "Proposal ID",
+          "name": "proposalId",
+          "required": true
+        }
+      },
+      "description": "Show a frozen remediation proposal",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:remediation-proposal",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "remediation-proposal.js"
+      ]
+    },
+    "commitments:remediation-proposals": {
+      "aliases": [],
+      "args": {
+        "commitmentId": {
+          "description": "Commitment ID",
+          "name": "commitmentId",
+          "required": true
+        }
+      },
+      "description": "List case-scoped remediation proposals for a commitment",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "case-id": {
+          "description": "Only proposals for this case",
+          "name": "case-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "status": {
+          "description": "Proposal lifecycle status to include",
+          "name": "status",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "limit": {
+          "description": "Proposals to return (1..200)",
+          "name": "limit",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:remediation-proposals",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "remediation-proposals.js"
+      ]
+    },
+    "commitments:reports": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Manage a commitment's report targets",
+      "examples": [
+        "<%= config.bin %> commitments reports <commitment-id>",
+        "<%= config.bin %> commitments reports <commitment-id> --add slack_channel --target C0123456 --on material_change",
+        "<%= config.bin %> commitments reports <commitment-id> --add main --on completion",
+        "<%= config.bin %> commitments reports <commitment-id> --add user_notify --target <user-id> --review owner",
+        "<%= config.bin %> commitments reports <commitment-id> --remove slack_channel:C0123456"
       ],
       "flags": {
         "bare": {
@@ -33750,7 +34364,161 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:resume",
+      "id": "commitments:resume",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "resume.js"
+      ]
+    },
+    "commitments:roster": {
+      "aliases": [],
+      "args": {},
+      "description": "List an agent's commitments with each one's loop state (healthy, blocked, paused, unarmed, degraded, inactive, unknown)",
+      "examples": [
+        "<%= config.bin %> commitments roster --agent agent_abc123",
+        "<%= config.bin %> commitments roster --agent agent_abc123 --json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Agent ID",
+          "name": "agent",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:roster",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "roster.js"
+      ]
+    },
+    "commitments:show": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Show a commitment's contract, loop state, and latest check",
+      "examples": [
+        "<%= config.bin %> commitments show <commitment-id>",
+        "<%= config.bin %> commitments show <commitment-id> --json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "description": "Include raw compatibility policy and check diagnostics",
+          "name": "verbose",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:show",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33763,22 +34531,22 @@
         "dist",
         "commands",
         "commitments",
-        "resume.js"
+        "show.js"
       ]
     },
-    "commitments:show": {
+    "commitments:status": {
       "aliases": [],
       "args": {
-        "id": {
+        "commitmentId": {
           "description": "Commitment ID",
-          "name": "id",
+          "name": "commitmentId",
           "required": true
         }
       },
-      "description": "Show a commitment's contract, loop state, and latest check",
+      "description": "Show whether a commitment's loop is installed and working: state, next wakes, source access, last stop, cost",
       "examples": [
-        "<%= config.bin %> commitments show <commitment-id>",
-        "<%= config.bin %> commitments show <commitment-id> --json"
+        "<%= config.bin %> commitments status obj_abc123",
+        "<%= config.bin %> commitments status obj_abc123 --json"
       ],
       "flags": {
         "bare": {
@@ -33819,17 +34587,11 @@
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "verbose": {
-          "description": "Include raw compatibility policy and check diagnostics",
-          "name": "verbose",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "commitments:show",
+      "id": "commitments:status",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -33842,7 +34604,7 @@
         "dist",
         "commands",
         "commitments",
-        "show.js"
+        "status.js"
       ]
     },
     "commitments:subject": {
@@ -34335,14 +35097,14 @@
           "type": "option"
         },
         "watch-space": {
-          "description": "Space to watch (repeatable). Accepts a space id, ref, or unique title. Implies --watch space.",
+          "description": "One Space to watch. Accepts a space id, ref, or unique title. Implies --watch space.",
           "name": "watch-space",
           "hasDynamicHelp": false,
           "multiple": true,
           "type": "option"
         },
         "watch-monitor": {
-          "description": "Signal Monitor id to watch (repeatable). Implies --watch monitor.",
+          "description": "One Signal Monitor id to watch. Implies --watch monitor.",
           "name": "watch-monitor",
           "hasDynamicHelp": false,
           "multiple": true,
@@ -34497,6 +35259,75 @@
         "wake-capabilities.js"
       ]
     },
+    "commitments:work-plan": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Commitment ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Read permission-filtered delegated assignments and workflow episodes for a responsibility",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output the complete public work-plan projection as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "commitments:work-plan",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "commitments",
+        "work-plan.js"
+      ]
+    },
     "compass:archive": {
       "aliases": [],
       "args": {
@@ -34639,128 +35470,205 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "json": {
-          "description": "Output as JSON",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Agent ID that owns the compass",
+          "name": "agent",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "compass:commitments",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "compass",
+        "commitments.js"
+      ]
+    },
+    "compass:create": {
+      "aliases": [],
+      "args": {},
+      "description": "Create a compass for an agent",
+      "examples": [
+        "<%= config.bin %> compass create --agent agent_abc --title \"Production reliability\" --domain reliability",
+        "<%= config.bin %> compass create --agent agent_abc --title \"FinOps\" --invariant \"Cloud spend stays under $10k/mo\"",
+        "<%= config.bin %> compass create --agent agent_abc --json-body ./compass.json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "agent": {
+          "description": "Agent ID",
+          "name": "agent",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "title": {
+          "description": "Human-readable direction, e.g. \"Production reliability\"",
+          "name": "title",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "domain": {
+          "description": "Broad subject area, e.g. \"aws\" or \"finops\"",
+          "name": "domain",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "invariant": {
+          "description": "Invariant target description (repeatable). The state the agent keeps true.",
+          "name": "invariant",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "json-body": {
+          "description": "Path to a JSON file with the full body (merged under the flags)",
+          "name": "json-body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "compass:create",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "compass",
+        "create.js"
+      ]
+    },
+    "compass:effective-policy": {
+      "aliases": [],
+      "args": {
+        "compassId": {
+          "description": "Compass ID",
+          "name": "compassId",
+          "required": true
+        }
+      },
+      "description": "Read a Compass policy revision, effective defaults and field provenance",
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "agent": {
-          "description": "Agent ID that owns the compass",
+          "description": "Agent ID that owns the Compass",
           "name": "agent",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "compass:commitments",
-      "pluginAlias": "@skrr-ai/cli",
-      "pluginName": "@skrr-ai/cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "autonomousCredentialPolicy": "delegated",
-      "resolveSpaceFlag": true,
-      "isESM": false,
-      "relativePath": [
-        "dist",
-        "commands",
-        "compass",
-        "commitments.js"
-      ]
-    },
-    "compass:create": {
-      "aliases": [],
-      "args": {},
-      "description": "Create a compass for an agent",
-      "examples": [
-        "<%= config.bin %> compass create --agent agent_abc --title \"Production reliability\" --domain reliability",
-        "<%= config.bin %> compass create --agent agent_abc --title \"FinOps\" --invariant \"Cloud spend stays under $10k/mo\"",
-        "<%= config.bin %> compass create --agent agent_abc --json-body ./compass.json"
-      ],
-      "flags": {
-        "bare": {
-          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
-          "name": "bare",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "token": {
-          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
-          "name": "token",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "workspace": {
-          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
-          "name": "workspace",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
-          "name": "profile",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "raw": {
-          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
-          "name": "raw",
-          "allowNo": false,
-          "type": "boolean"
         },
         "json": {
-          "description": "Output as JSON",
+          "description": "Output the complete policy and provenance as JSON",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "agent": {
-          "description": "Agent ID",
-          "name": "agent",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "title": {
-          "description": "Human-readable direction, e.g. \"Production reliability\"",
-          "name": "title",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "domain": {
-          "description": "Broad subject area, e.g. \"aws\" or \"finops\"",
-          "name": "domain",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "invariant": {
-          "description": "Invariant target description (repeatable). The state the agent keeps true.",
-          "name": "invariant",
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "type": "option"
-        },
-        "json-body": {
-          "description": "Path to a JSON file with the full body (merged under the flags)",
-          "name": "json-body",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "compass:create",
+      "id": "compass:effective-policy",
       "pluginAlias": "@skrr-ai/cli",
       "pluginName": "@skrr-ai/cli",
       "pluginType": "core",
@@ -34773,7 +35681,7 @@
         "dist",
         "commands",
         "compass",
-        "create.js"
+        "effective-policy.js"
       ]
     },
     "compass:list": {
@@ -35337,7 +36245,8 @@
       "examples": [
         "<%= config.bin %> compass update agch_abc --agent agent_xyz --title \"Reliability & cost\"",
         "<%= config.bin %> compass update agch_abc --agent agent_xyz --invariant \"p99 under 300ms\" --reason \"new SLO\"",
-        "<%= config.bin %> compass update agch_abc --agent agent_xyz --json-body ./compass.json"
+        "<%= config.bin %> compass update agch_abc --agent agent_xyz --json-body ./compass.json",
+        "<%= config.bin %> compass update agch_abc --agent agent_xyz --title \"New\" --expected-version 4"
       ],
       "flags": {
         "bare": {
@@ -35426,6 +36335,13 @@
           "multiple": false,
           "type": "option"
         },
+        "expected-version": {
+          "description": "Compass version this change is based on; the update is refused if it moved. Defaults to the version read at the start of this command.",
+          "name": "expected-version",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "json-body": {
           "description": "Path to a JSON file with the full body",
           "name": "json-body",
@@ -55691,7 +56607,7 @@
           "type": "option"
         },
         "request-id": {
-          "description": "Idempotency key for this command. Repeating the invocation with the same id returns the run it already started (and its output, for 5 minutes after it ends) instead of running it again. Letters, digits and . _ : / - only.",
+          "description": "Idempotency key for this command. Repeating the invocation with the same id returns the run it already started instead of running it again. Output is kept for at most 5 minutes after it ends and at most 60 seconds after the first terminal read, whichever expires sooner. Letters, digits and . _ : / - only.",
           "name": "request-id",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -94152,11 +95068,22 @@
           "type": "boolean"
         },
         "json": {
-          "description": "Output the cancelled run as JSON",
+          "description": "Output the cancelled run as JSON (cancellation.scope and the waitingFor.workflowRunId of the cancelled nodes show which child runs were left running)",
           "name": "json",
           "allowNo": false,
           "type": "boolean"
         },
+        "scope": {
+          "description": "What happens to child workflow runs this run started: preserve_children (default) leaves them running, subtree stops every descendant run too",
+          "name": "scope",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "preserve_children",
+            "subtree"
+          ],
+          "type": "option"
+        },
         "yes": {
           "char": "y",
           "description": "Skip confirmation prompt",
@@ -94184,6 +95111,105 @@
         "cancel.js"
       ]
     },
+    "spaces:workflows:cancel-node": {
+      "aliases": [],
+      "args": {
+        "spaceId": {
+          "description": "Owning Space ID",
+          "name": "spaceId",
+          "required": true
+        },
+        "runId": {
+          "description": "Workflow run ID",
+          "name": "runId",
+          "required": true
+        },
+        "nodeKey": {
+          "description": "Node key to stop",
+          "name": "nodeKey",
+          "required": true
+        }
+      },
+      "description": "Request cancellation of one exact workflow node attempt and show the returned execution state",
+      "examples": [
+        "<%= config.bin %> spaces workflows run <space> <run> --json > reviewed-run.json",
+        "<%= config.bin %> spaces workflows cancel-node <space> <run> <node> --from-json reviewed-run.json"
+      ],
+      "flags": {
+        "bare": {
+          "description": "Bare mode — ignore keychain/file credential sources. Token must come from env or --token.",
+          "name": "bare",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "token": {
+          "description": "Bearer token for this invocation (debugging/impersonation). Overrides env and stored creds.",
+          "name": "token",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "description": "Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).",
+          "name": "workspace",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "description": "Which stored session to use. Each profile keeps its own credential and deployment, so signing into one does not sign you out of another. Also OVERSKY_PROFILE. List them with `profiles list`.",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "raw": {
+          "description": "With --json, keep the Mongo storage fields (_id next to id, __v) that the CLI otherwise strips. Also OVERSKY_CLI_RAW=1.",
+          "name": "raw",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "from-json": {
+          "description": "Saved canonical workflow run snapshot, or - for stdin",
+          "name": "from-json",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "reason": {
+          "description": "Cancellation reason (at most 500 characters)",
+          "name": "reason",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Output the updated workflow run as JSON",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "spaces:workflows:cancel-node",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "autonomousCredentialPolicy": "delegated",
+      "resolveSpaceFlag": true,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "spaces",
+        "workflows",
+        "cancel-node.js"
+      ]
+    },
     "spaces:workflows:create": {
       "aliases": [],
       "args": {
@@ -117234,7 +118260,7 @@
           "dependsOn": [
             "cron"
           ],
-          "description": "Cap total fires (recurring only)",
+          "description": "Cap total occurrences (recurring only): each scheduled fire counts, and so does an occurrence you complete by hand before the scheduler touches it",
           "name": "max-runs",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -124262,7 +125288,7 @@
           "type": "option"
         },
         "scope": {
-          "description": "Trigger scope kind",
+          "description": "Trigger scope kind. A scope can have prerequisites (a space_oracle Space needs a Leader agent): `triggers capabilities <scope>` lists them under \"Needs\"",
           "name": "scope",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -124515,7 +125541,7 @@
           "type": "option"
         },
         "max-fires-per-day": {
-          "description": "Daily fire cap",
+          "description": "Daily fire cap (schedule, stochastic and self_scheduled triggers only)",
           "name": "max-fires-per-day",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -126299,7 +127325,7 @@
           "type": "option"
         },
         "max-fires-per-day": {
-          "description": "Daily fire cap",
+          "description": "Daily fire cap (schedule, stochastic and self_scheduled triggers only)",
           "name": "max-fires-per-day",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -128215,6 +129241,71 @@
         "add.js"
       ]
     },
+    "widgets:check": {
+      "aliases": [],
+      "args": {
+        "file": {
+          "description": "File to check, or - for stdin. Text containing a widget block, or a JSON widget (a payload, a ui_widget part, or the ui_widget_render arguments, one or an array).",
+          "name": "file",
+          "required": true
+        }
+      },
+      "description": "Check a generative-UI widget offline before sending it: grammar, size limits, JavaScript syntax and likely sandbox failures. Runs entirely offline: it reaches no API, so it needs no sign-in and has no route to keep in parity.",
+      "examples": [
+        "<%= config.bin %> widgets check reply.md",
+        "<%= config.bin %> widgets check - < reply.md",
+        "<%= config.bin %> widgets check widget.json --json",
+        "<%= config.bin %> widgets check widget.json --render-fence > block.txt"
+      ],
+      "flags": {
+        "json": {
+          "description": "Output the report as JSON: { ok, widgets: [{ id, title, bytes, limits, complete, accepted, ok, issues }], errors, warnings, summary }",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "format": {
+          "description": "How to read the input: auto (JSON if it parses as JSON, otherwise text that contains a widget block), fence, or json",
+          "name": "format",
+          "default": "auto",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "auto",
+            "fence",
+            "json"
+          ],
+          "type": "option"
+        },
+        "strict": {
+          "description": "Also fail (exit 1) on warnings",
+          "name": "strict",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "render-fence": {
+          "description": "For a JSON widget: print the correctly delimited block to stdout (the report goes to stderr), verified by parsing it back",
+          "name": "render-fence",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "widgets:check",
+      "pluginAlias": "@skrr-ai/cli",
+      "pluginName": "@skrr-ai/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": false,
+      "relativePath": [
+        "dist",
+        "commands",
+        "widgets",
+        "check.js"
+      ]
+    },
     "widgets:list": {
       "aliases": [],
       "args": {},
@@ -131362,5 +132453,5 @@
       ]
     }
   },
-  "version": "0.1.101"
+  "version": "0.1.103"
 }