@skrr-ai/cli 0.1.101 → 0.1.103

package/dist/lib/commitments.js

@@ -9,6 +9,7 @@ exports.parseCommitmentConcurrencyLimit = parseCommitmentConcurrencyLimit;
 exports.commitmentConcurrencyEnvelopePatch = commitmentConcurrencyEnvelopePatch;
 exports.describeCommitmentConcurrency = describeCommitmentConcurrency;
 exports.parseIntervalToMs = parseIntervalToMs;
+exports.normalizeWatchedSourceDeclarations = normalizeWatchedSourceDeclarations;
 exports.buildWatchedSources = buildWatchedSources;
 exports.describeEvidenceHealth = describeEvidenceHealth;
 exports.describeIntervalMs = describeIntervalMs;
@@ -17,14 +18,17 @@ exports.cadenceLabel = cadenceLabel;
 exports.renderCommitmentList = renderCommitmentList;
 exports.extractStandstillFromCheck = extractStandstillFromCheck;
 exports.describeExecutorBlocked = describeExecutorBlocked;
+exports.withLiveAssessment = withLiveAssessment;
 exports.renderCommitmentSummary = renderCommitmentSummary;
 exports.describeWakeDecision = describeWakeDecision;
 exports.renderCheckList = renderCheckList;
 exports.renderCommitmentLedger = renderCommitmentLedger;
 exports.renderCommitmentTrace = renderCommitmentTrace;
+exports.renderProactivenessScorecard = renderProactivenessScorecard;
 exports.formatCommitmentCycles = formatCommitmentCycles;
 exports.formatCommitmentExplanation = formatCommitmentExplanation;
 exports.renderListPageHint = renderListPageHint;
+exports.describeObservationArtifacts = describeObservationArtifacts;
 exports.renderCommitmentObservations = renderCommitmentObservations;
 exports.renderCommitmentHypotheses = renderCommitmentHypotheses;
 exports.renderCommitmentLineage = renderCommitmentLineage;
@@ -33,6 +37,7 @@ exports.renderCommitmentCases = renderCommitmentCases;
 exports.renderCommitmentCaseDetail = renderCommitmentCaseDetail;
 exports.renderCommitmentRemediationProposals = renderCommitmentRemediationProposals;
 exports.renderCommitmentRemediationProposal = renderCommitmentRemediationProposal;
+const node_util_1 = require("node:util");
 const data_provider_1 = require("@skrr-ai/data-provider");
 /**
  * commitments.ts — request-based client for the Commitments subsystem
@@ -132,12 +137,25 @@ exports.commitmentApi = {
      * swept, how stale that is, and the tally it last persisted. Aggregate only.
      */
     livenessSweep: () => data_provider_2.request.get('/api/commitments/liveness/sweep'),
+    /** One agent's Commitments, system roles included, each with its loop status. */
+    roster: (agentId) => data_provider_2.request.get((0, triggers_1.withQuery)('/api/commitments/roster', { agentId })),
+    /** Is this Commitment's loop installed and working. */
+    loopStatus: (id) => data_provider_2.request.get(`${base(id)}/loop-status`),
     manifest: (id) => data_provider_2.request.get(`${base(id)}/manifest`),
     import: (body) => data_provider_2.request.post('/api/commitments/import', body),
     fork: (id, body) => data_provider_2.request.post(`${base(id)}/fork`, body),
     // GET /:id returns `{ commitment, latestCheck }` — NOT a bare contract.
     // Unwrap before rendering, or every field reads as undefined.
     get: (id) => data_provider_2.request.get(base(id)),
+    controlPreview: (id, query) => data_provider_2.request.get((0, triggers_1.withQuery)(`${base(id)}/control-preview`, query)),
+    applyControl: (id, body) => data_provider_2.request.post(`${base(id)}/control`, body),
+    controlReceipt: (id, controlId) => data_provider_2.request.get(`${base(id)}/control/${encodeURIComponent(controlId)}`),
+    workPlan: (id) => data_provider_2.request.get(`${base(id)}/work-plan`),
+    observationSummary: (query = {}) => data_provider_2.request.get((0, triggers_1.withQuery)('/api/commitments/observation-summary', query)),
+    draftObservationProbe: (body) => data_provider_2.request.post('/api/commitments/observation-probe', body),
+    observationProbe: (id, body = {}) => data_provider_2.request.post(`${base(id)}/observation-probe`, body),
+    verifyReadiness: (id, body) => data_provider_2.request.post(`${base(id)}/readiness-receipt`, body),
+    readinessReceipt: (id, receiptId) => data_provider_2.request.get(`${base(id)}/readiness-receipt/${encodeURIComponent(receiptId)}`),
     create: (body) => data_provider_2.request.post('/api/commitments', body),
     update: (id, body) => data_provider_2.request.patch(base(id), body),
     draftPreflight: (body) => data_provider_2.request.post('/api/commitments/preflight', body),
@@ -496,11 +514,35 @@ function parseIntervalToMs(input) {
     }
     return ms;
 }
+/** Keep the canonical one-binding-per-source contract without discarding conflicting intent. */
+function normalizeWatchedSourceDeclarations(declarations) {
+    const bySource = new Map();
+    const normalized = [];
+    for (const binding of declarations) {
+        if (!binding ||
+            typeof binding !== 'object' ||
+            !('source' in binding) ||
+            typeof binding.source !== 'string') {
+            normalized.push(binding); // The API owns validation of the remaining DTO.
+            continue;
+        }
+        if (bySource.has(binding.source)) {
+            if (!(0, node_util_1.isDeepStrictEqual)(bySource.get(binding.source), binding)) {
+                throw new Error(`Watched source "${binding.source}" has conflicting declarations. ` +
+                    'Choose one complete binding per source.');
+            }
+            continue;
+        }
+        bySource.set(binding.source, binding);
+        normalized.push(binding);
+    }
+    return normalized;
+}
 function buildWatchedSources(inputs) {
     const watched = (inputs.watch ?? []).filter(Boolean);
     const metricKeys = (inputs.metricKey ?? []).filter(Boolean);
-    const spaceIds = (inputs.spaceIds ?? []).filter(Boolean);
-    const monitorIds = (inputs.monitorIds ?? []).filter(Boolean);
+    const spaceIds = [...new Set((inputs.spaceIds ?? []).filter(Boolean))];
+    const monitorIds = [...new Set((inputs.monitorIds ?? []).filter(Boolean))];
     const githubEvents = (inputs.githubEvents ?? []).filter(Boolean);
     const githubRepository = String(inputs.githubRepository || '')
         .trim()
@@ -584,7 +626,7 @@ function buildWatchedSources(inputs) {
             rows.push({ source, enabled: true });
         }
     }
-    return rows;
+    return normalizeWatchedSourceDeclarations(rows);
 }
 /**
  * One line an author can act on, or nothing.
@@ -613,10 +655,33 @@ function describeEvidenceHealth(health, criteriaCount) {
         return `unevidenceable_criteria${detail} — the criteria below cannot be judged from what this commitment observes; rewrite them or attach a Measure`;
     }
     if (state === 'degraded_observability') {
-        return `degraded_observability${detail} — an evaluator could not run; this is a fault, not a criteria problem`;
+        return `degraded_observability${detail} — ${describeDegradedObservability(reasons)}`;
     }
     return `${state}${detail}`;
 }
+/**
+ * What a `degraded_observability` verdict actually says, from its reasons.
+ *
+ * The state is a catch-all on the server (anything that is not purely an
+ * authoring problem lands here), so the copy used to assert "an evaluator
+ * could not run; this is a fault" for every case — including a commitment
+ * whose first run had simply not reported yet (OSK-15989). Only the
+ * `*_evidence_unavailable` reasons say an evaluator could not run; the rest
+ * say which part of the reading was missing, and that is what this names.
+ */
+function describeDegradedObservability(reasons) {
+    const has = (reason) => reasons.includes(reason);
+    if (has('state_evidence_unavailable') || has('outcome_evidence_unavailable')) {
+        return 'an evaluator could not run; this is a fault, not a criteria problem';
+    }
+    if (has('access_issues') || has('source_warning_or_error') || has('no_healthy_source')) {
+        return 'not every configured source could be read on the last check (`skrr commitments doctor <id>` names the next step)';
+    }
+    if (has('evidence_stale')) {
+        return "the freshest evidence is older than this commitment's freshness expectation";
+    }
+    return 'the last check could not see everything it needs to judge this commitment';
+}
 /** Render an interval back as a compact human string. */
 function describeIntervalMs(ms) {
     if (!ms || !Number.isFinite(ms))
@@ -794,6 +859,20 @@ function describeExecutorBlocked(commitment) {
                 : reason || 'blocked';
     return `${label}${until ? ` until ${until}` : ''}`;
 }
+/**
+ * The commitment `show` should render: its stored contract, with the
+ * assessment replaced by the one the operating state recomputed for this read
+ * when the server sent one (OSK-15989). The stored `commitment.assessment` is
+ * what the LAST check wrote; while a run is in flight it can still say
+ * `blocked`, and printing it above "Agent is working" made the header
+ * contradict the rest of the page. `doctor` already reads the live one first.
+ */
+function withLiveAssessment(commitment, operatingState) {
+    const live = operatingState?.assessment;
+    if (!live || typeof live !== 'object')
+        return commitment;
+    return { ...commitment, assessment: live };
+}
 function renderCommitmentSummary(commitment, log, 
 /**
  * The most recent check, when the caller has one. Optional because pause /
@@ -1162,10 +1241,103 @@ function renderCommitmentTrace(trace, log) {
         { key: 'stop', header: 'STOPPED AT', maxWidth: 48 },
         { key: 'summary', header: 'SUMMARY', maxWidth: 72 },
     ], 'No trace events recorded.', log);
+    const scorecard = record(trace.proactiveness);
+    if (scorecard)
+        renderProactivenessScorecard(scorecard, log);
     if (trace.has_more === true && trace.next_cursor) {
         log(`More events are available; continue with --cursor ${text(trace.next_cursor)}.`);
     }
 }
+/*
+ * Display order and words for `workClassification.counts`. The names are owned
+ * by the API scorecard (`COMMITMENT_CHECK_WORK_CLASSIFICATIONS` in
+ * CommitmentProactivenessMetrics); an unknown name still prints, by its key.
+ */
+const WORK_CLASSIFICATION_LABELS = {
+    justified_source_change: 'source changed',
+    justified_time_boundary: 'review/deadline due',
+    justified_evidence: 'evidence refresh',
+    work_item: 'open work item',
+    instruction: 'instruction',
+    repeat_identical_evidence: 'REPEAT on identical evidence',
+    unknown_basis: 'basis not recorded',
+};
+const SCORECARD_METRICS = [
+    { key: 'justifiedDecisionRate', label: 'Justified work', kind: 'ratio' },
+    { key: 'repeatDecisionRate', label: 'Repeat decisions', kind: 'ratio' },
+    { key: 'duplicateInvestigationRate', label: 'Duplicate investigations', kind: 'ratio' },
+    { key: 'usefulActionYield', label: 'Useful action yield', kind: 'ratio' },
+    { key: 'notificationPrecision', label: 'Notification precision', kind: 'ratio' },
+    { key: 'taskClosureRate', label: 'Task closure', kind: 'ratio' },
+    { key: 'provenanceCompleteness', label: 'Provenance complete', kind: 'ratio' },
+    { key: 'materialDetectionLatencyMs', label: 'Detection latency p50', kind: 'latency' },
+    { key: 'evidenceFreshnessMs', label: 'Evidence age p50', kind: 'latency' },
+];
+function scorecardValue(value, kind) {
+    if (kind === 'ratio') {
+        return typeof value === 'number' && Number.isFinite(value)
+            ? `${Math.round(value * 100)}%`
+            : '-';
+    }
+    const p50 = record(value)?.p50;
+    if (typeof p50 !== 'number' || !Number.isFinite(p50))
+        return '-';
+    return p50 >= 60_000 ? `${Math.round(p50 / 60_000)}m` : `${Math.round(p50 / 1000)}s`;
+}
+/** The qualifier that keeps a number from claiming more than its samples can. */
+function scorecardQualifier(coverage) {
+    if (!coverage)
+        return '';
+    const samples = typeof coverage.samples === 'number' ? coverage.samples : null;
+    const parts = [];
+    if (samples !== null)
+        parts.push(`${samples} sample${samples === 1 ? '' : 's'}`);
+    if (coverage.reliability === 'no_samples')
+        return '(no samples)';
+    if (coverage.reliability === 'mostly_unknown_basis') {
+        parts.push(`ESTIMATE: ${text(coverage.unknownBasis, '?')} with no recorded basis`);
+    }
+    else if (typeof coverage.unknownBasis === 'number' && coverage.unknownBasis > 0) {
+        parts.push(`${coverage.unknownBasis} with no recorded basis`);
+    }
+    if (typeof coverage.partialObservation === 'number' && coverage.partialObservation > 0) {
+        parts.push(`${coverage.partialObservation} partial observation`);
+    }
+    if (coverage.partialWindow === true)
+        parts.push('partial page');
+    return parts.length ? `(${parts.join('; ')})` : '';
+}
+function renderProactivenessScorecard(scorecard, log) {
+    const coverage = record(scorecard.coverage);
+    const metrics = record(scorecard.metrics) || {};
+    const metricCoverage = record(scorecard.metricCoverage) || {};
+    log('');
+    log(coverage?.partialWindow === true || record(scorecard.window)?.partial === true
+        ? 'Proactiveness (this page only — not the whole window)'
+        : 'Proactiveness');
+    if (coverage) {
+        log(`  Checks: ${text(coverage.checks, '0')} read · ${text(coverage.decisioningChecks, '0')} decided work · ` +
+            `${text(coverage.quietChecks, '0')} quiet · ${text(coverage.dedupeSuppressedChecks, '0')} suppressed as duplicate`);
+    }
+    const counts = record(record(scorecard.workClassification)?.counts);
+    if (counts) {
+        const parts = Object.entries(counts)
+            .filter(([, value]) => typeof value === 'number' && value > 0)
+            .map(([key, value]) => `${WORK_CLASSIFICATION_LABELS[key] || key} ${value}`);
+        log(`  Why work was decided: ${parts.length ? parts.join(' · ') : 'no decisioning Checks'}`);
+    }
+    for (const metric of SCORECARD_METRICS) {
+        if (!(metric.key in metrics))
+            continue;
+        const qualifier = scorecardQualifier(record(metricCoverage[metric.key]));
+        log(`  ${metric.label.padEnd(26)} ${scorecardValue(metrics[metric.key], metric.kind).padStart(5)}` +
+            (qualifier ? `  ${qualifier}` : ''));
+    }
+    for (const note of Array.isArray(coverage?.notes) ? coverage.notes : []) {
+        if (typeof note === 'string' && note)
+            log(`  Note: ${note}`);
+    }
+}
 const CYCLE_GLYPH = {
     advanced: '✓',
     stopped: '●',
@@ -1192,7 +1364,12 @@ function cycleWake(cycle) {
 function cycleSummary(cycle) {
     if (cycle.outcome === 'stopped' && cycle.stop) {
         const { question, gate, reason, fix, detail } = cycle.stop;
-        return `${question}  ${reason || gate} — ${fix || detail || 'stopped'}`;
+        // A stopped cycle can still have moved something (the Check's own read, a task it
+        // made); say so, or the row reads as if nothing happened (OSK-15408).
+        const moved = cycle.advancementKinds?.length
+            ? ` (moved: ${cycle.advancementKinds.join(', ')})`
+            : '';
+        return `${question}  ${reason || gate} — ${fix || detail || 'stopped'}${moved}`;
     }
     if (cycle.outcome === 'advanced') {
         return cycle.advancementKinds?.length
@@ -1288,6 +1465,8 @@ function formatCycleLatency(cycle) {
     ];
 }
 const ANSWER_GLYPH = { yes: '✓', no: '✗', 'n/a': '–' };
+/** The mark `cycles` already gives a chosen quiet: the loop looked and decided to say nothing. */
+const QUIET_ANSWER_GLYPH = CYCLE_GLYPH.quiet;
 /** The six questions for the latest Cycle, the first ✗ carrying its fix. */
 function formatCommitmentExplanation(explanation) {
     const cycle = explanation.cycle;
@@ -1299,7 +1478,14 @@ function formatCommitmentExplanation(explanation) {
     if (cycle)
         lines.push(...formatCycleLatency(cycle));
     for (const answer of explanation.answers || []) {
-        lines.push(`  ${ANSWER_GLYPH[answer.answer] || '?'} ${answer.question}  ${answer.because}`);
+        // The answer a deliberate quiet stopped at is not a refusal: `cycles` marks
+        // that cycle ○, and a ✗ here would read as a gate (OSK-15403).
+        const glyph = explanation.verdict === 'quiet' &&
+            answer.answer === 'no' &&
+            answer.key === explanation.stoppedAt
+            ? QUIET_ANSWER_GLYPH
+            : ANSWER_GLYPH[answer.answer] || '?';
+        lines.push(`  ${glyph} ${answer.question}  ${answer.because}`);
         if (answer.fix)
             lines.push(`      Fix: ${answer.fix}`);
     }
@@ -1343,6 +1529,30 @@ function yesNo(value) {
         return 'no';
     return '-';
 }
+/**
+ * Whether a row's retained evidence can still be reopened (OSK-16125).
+ *
+ * The count alone read as evidence even when every path pointed into a
+ * worktree the daemon had already deleted. `retained` artifacts are git
+ * locators on the run's delivery commit; `ephemeral` ones cannot be counted
+ * on; `unconfirmed` are locators for a path the run did not change. Refs the
+ * server classified as none of these (URLs, hashes, legacy rows) count as
+ * `other`. `--json` carries each artifact's `ref`, `locator` and `originalRef`.
+ */
+function describeObservationArtifacts(artifacts) {
+    const list = Array.isArray(artifacts) ? artifacts : [];
+    if (list.length === 0)
+        return '-';
+    const counts = new Map();
+    for (const artifact of list) {
+        const availability = text(record(artifact)?.availability, 'other');
+        counts.set(availability, (counts.get(availability) || 0) + 1);
+    }
+    return ['retained', 'unconfirmed', 'ephemeral', 'other']
+        .filter((name) => counts.has(name))
+        .map((name) => `${counts.get(name)} ${name}`)
+        .join(', ');
+}
 function renderCommitmentObservations(response, log, options = {}) {
     const data = records(response.data);
     renderRows(data.map((item) => ({
@@ -1371,6 +1581,7 @@ function renderCommitmentObservations(response, log, options = {}) {
         declared: yesNo(item.declared),
         access: text(item.accessStatus),
         confidence: (0, format_1.formatCell)(item.confidence),
+        artifacts: describeObservationArtifacts(item.artifacts),
     })), [
         { key: 'at', header: 'OBSERVED', maxWidth: 24 },
         { key: 'recorded', header: 'RECORDED', maxWidth: 24 },
@@ -1386,6 +1597,7 @@ function renderCommitmentObservations(response, log, options = {}) {
         { key: 'declared', header: 'DECLARED', maxWidth: 9 },
         { key: 'access', header: 'ACCESS', maxWidth: 13 },
         { key: 'confidence', header: 'CONF', maxWidth: 6 },
+        { key: 'artifacts', header: 'ARTIFACTS', maxWidth: 36 },
     ], options.emptyMessage || 'No observations recorded.', log);
 }
 /** Human view for causal hypotheses. */

package/dist/lib/compasses.d.ts

@@ -88,6 +88,9 @@ export declare const compassApi: {
     }>;
     create: (body: Record<string, unknown>) => Promise<Compass>;
     get: (id: string, query: Parameters<typeof withQuery>[1]) => Promise<Compass>;
+    effectivePolicy: (id: string, query: {
+        agentId: string;
+    }) => Promise<Record<string, unknown>>;
     update: (id: string, body: Record<string, unknown>) => Promise<Compass>;
     archive: (id: string, query: Parameters<typeof withQuery>[1]) => Promise<{
         ok: boolean;

package/dist/lib/compasses.js

@@ -35,6 +35,7 @@ exports.compassApi = {
     list: (query) => data_provider_2.request.get((0, triggers_1.withQuery)('/api/compasses', query)),
     create: (body) => data_provider_2.request.post('/api/compasses', body),
     get: (id, query) => data_provider_2.request.get((0, triggers_1.withQuery)(base(id), query)),
+    effectivePolicy: (id, query) => data_provider_2.request.get((0, triggers_1.withQuery)(`${base(id)}/effective-policy`, query)),
     update: (id, body) => data_provider_2.request.patch(base(id), body),
     archive: (id, query) => data_provider_2.request.delete((0, triggers_1.withQuery)(base(id), query)),
     revisions: (id, query) => data_provider_2.request.get((0, triggers_1.withQuery)(`${base(id)}/revisions`, query)),

package/dist/lib/delegated-cli.d.ts

@@ -2,7 +2,29 @@ import { type ResolvedCredential } from '@skrr-ai/auth-core';
 export declare function isDelegatedCliSession(env?: Record<string, string | undefined>): boolean;
 /** Drop the memoized credential. Exported for tests. */
 export declare function resetDelegatedCliCredentialCache(): void;
-/** Fetch a full-permission CLI access token from the local daemon. */
+/**
+ * The daemon's delegated broker answered and could not mint, for a reason it
+ * named (OSK-12151). `retryable` says whether waiting can help: false when only
+ * a new daemon sign-in repairs it (DEVICE_PROOF_PIN_MISMATCH), and then
+ * `remedy` is the command to run.
+ */
+export declare class DelegatedCliUnavailableError extends Error {
+    readonly retryable: boolean;
+    readonly upstreamStatus?: number;
+    readonly upstreamCode?: string;
+    readonly upstreamReason?: string;
+    /** ISO time before which the daemon will not ask the server again. */
+    readonly retryAt?: string;
+    readonly remedy?: string;
+    constructor(message: string, fields: {
+        retryable: boolean;
+        upstreamStatus?: number;
+        upstreamCode?: string;
+        upstreamReason?: string;
+        retryAt?: string;
+        remedy?: string;
+    });
+}
 export declare function fetchDelegatedCliCredential(env?: Record<string, string | undefined>, options?: {
     forceRefresh?: boolean;
 }): Promise<ResolvedCredential | null>;

package/dist/lib/delegated-cli.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegatedCliUnavailableError = void 0;
 exports.isDelegatedCliSession = isDelegatedCliSession;
 exports.resetDelegatedCliCredentialCache = resetDelegatedCliCredentialCache;
 exports.fetchDelegatedCliCredential = fetchDelegatedCliCredential;
@@ -198,6 +199,50 @@ function composeUnreachableBrokerMessage(brokerUrl, err) {
         (code ? ` (${code})` : ''));
 }
 /** Fetch a full-permission CLI access token from the local daemon. */
+/**
+ * Upstream codes the SAME daemon credential will keep getting, so retrying is
+ * pointless and the repair is signing the daemon in again (OSK-15990). Mirrors
+ * the daemon's `CREDENTIAL_BOUND_CODES`; it is the fallback for a daemon that
+ * predates the `retryable` field on its 503.
+ */
+const SIGN_IN_BOUND_CODES = new Set([
+    'DEVICE_PROOF_PIN_MISMATCH',
+    'CI_TOKEN_REFUSED',
+    'SESSION_REVOKED',
+    'PRINCIPAL_UNRESOLVED',
+    'USER_ID_UNRESOLVED',
+]);
+function isSignInBoundCode(code) {
+    return typeof code === 'string' && SIGN_IN_BOUND_CODES.has(code);
+}
+/**
+ * The daemon's delegated broker answered and could not mint, for a reason it
+ * named (OSK-12151). `retryable` says whether waiting can help: false when only
+ * a new daemon sign-in repairs it (DEVICE_PROOF_PIN_MISMATCH), and then
+ * `remedy` is the command to run.
+ */
+class DelegatedCliUnavailableError extends Error {
+    retryable;
+    upstreamStatus;
+    upstreamCode;
+    upstreamReason;
+    /** ISO time before which the daemon will not ask the server again. */
+    retryAt;
+    remedy;
+    constructor(message, fields) {
+        super(message);
+        this.name = 'DelegatedCliUnavailableError';
+        this.retryable = fields.retryable;
+        this.upstreamStatus = fields.upstreamStatus;
+        this.upstreamCode = fields.upstreamCode;
+        this.upstreamReason = fields.upstreamReason;
+        this.retryAt = fields.retryAt;
+        this.remedy =
+            fields.remedy ??
+                (fields.retryable ? undefined : 'run `skrr daemon login` on the machine running the daemon');
+    }
+}
+exports.DelegatedCliUnavailableError = DelegatedCliUnavailableError;
 async function fetchDelegatedCliCredential(env = process.env, options = {}) {
     if (!isDelegatedCliSession(env))
         return null;
@@ -270,11 +315,23 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
                 ]
                     .filter(Boolean)
                     .join(' ');
-                // The daemon's `message` already names the refusal; fall back to the
-                // status and code when an older daemon sent none.
-                throw new Error(typeof body?.message === 'string' && body.message
+                // The daemon's `message` already names the refusal (and, from a
+                // daemon with OSK-16117, when to retry or what to run); fall back to
+                // the status and code when an older daemon sent none.
+                throw new DelegatedCliUnavailableError(typeof body?.message === 'string' && body.message
                     ? `the daemon's delegated CLI broker could not mint a credential: ${body.message}`
-                    : `the skrr server refused the daemon's request for this session's credential (${named}).`);
+                    : `the skrr server refused the daemon's request for this session's credential (${named}).`, {
+                    ...(typeof body?.upstreamStatus === 'number' ? { upstreamStatus: body.upstreamStatus } : {}),
+                    ...(typeof body?.upstreamCode === 'string' ? { upstreamCode: body.upstreamCode } : {}),
+                    ...(typeof body?.upstreamReason === 'string'
+                        ? { upstreamReason: body.upstreamReason }
+                        : {}),
+                    ...(typeof body?.retryAt === 'string' ? { retryAt: body.retryAt } : {}),
+                    ...(typeof body?.remedy === 'string' ? { remedy: body.remedy } : {}),
+                    // Only an explicit `false` from the daemon makes this terminal; an
+                    // older daemon sends nothing and keeps today's retryable answer.
+                    retryable: !(body?.retryable === false || isSignInBoundCode(body?.upstreamCode)),
+                });
             }
             if (res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') {
                 throw new Error(`the daemon's delegated CLI broker is alive but cannot mint a credential ` +

package/dist/lib/first-party-harness.d.ts

@@ -139,7 +139,7 @@ export declare function resolveEngine(env?: NodeJS.ProcessEnv): EngineResolution
  * Build the engine argv for a `skrr code` invocation.
  *
  * Exported and pure so the forwarding contract is unit-testable without an
- * oclif runtime or a real binary — the convention `buildOverskyLogsArgs` uses.
+ * oclif runtime or a real binary — the convention `buildDaemonLogsArgs` uses.
  *
  * `subcommand === null` means bare `skrr code`, which launches the interactive
  * TUI: the engine takes no subcommand for that, and passing one would put it

package/dist/lib/first-party-harness.js

@@ -266,7 +266,7 @@ function resolveEngine(env = process.env) {
  * Build the engine argv for a `skrr code` invocation.
  *
  * Exported and pure so the forwarding contract is unit-testable without an
- * oclif runtime or a real binary — the convention `buildOverskyLogsArgs` uses.
+ * oclif runtime or a real binary — the convention `buildDaemonLogsArgs` uses.
  *
  * `subcommand === null` means bare `skrr code`, which launches the interactive
  * TUI: the engine takes no subcommand for that, and passing one would put it

package/dist/lib/responsibility-controls.d.ts

@@ -0,0 +1,11 @@
+/** Scope/version coordinates are intent. The server re-authorizes every read and write. */
+export declare const RESPONSIBILITY_CONTROL_SCOPES: readonly ["mute_updates", "pause_observation", "cancel_worker", "cancel_episode", "cancel_subtree", "retire"];
+/**
+ * Apply only the saved preview, never a newly fetched version or live target set.
+ * Presentation and authority fields cannot become request fields. The canonical
+ * service validates every attempt pin and rejects stale or enlarged selections.
+ */
+export declare function controlFromPreview(commitmentId: string, preview: Record<string, unknown>, idempotencyKey: string, reason?: string): Record<string, unknown>;
+export declare function renderControl(value: Record<string, unknown>, log: (line: string) => void): void;
+export declare function renderReadiness(value: Record<string, unknown>, log: (line: string) => void): void;
+export declare function renderProbe(value: Record<string, unknown>, log: (line: string) => void): void;

package/dist/lib/responsibility-controls.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESPONSIBILITY_CONTROL_SCOPES = void 0;
+exports.controlFromPreview = controlFromPreview;
+exports.renderControl = renderControl;
+exports.renderReadiness = renderReadiness;
+exports.renderProbe = renderProbe;
+/** Scope/version coordinates are intent. The server re-authorizes every read and write. */
+exports.RESPONSIBILITY_CONTROL_SCOPES = [
+    'mute_updates', 'pause_observation', 'cancel_worker', 'cancel_episode', 'cancel_subtree', 'retire',
+];
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Apply only the saved preview, never a newly fetched version or live target set.
+ * Presentation and authority fields cannot become request fields. The canonical
+ * service validates every attempt pin and rejects stale or enlarged selections.
+ */
+function controlFromPreview(commitmentId, preview, idempotencyKey, reason) {
+    if (preview.schemaVersion !== 1 || preview.commitmentId !== commitmentId) {
+        throw new Error('Use a control preview for this exact Commitment.');
+    }
+    if (preview.available !== true)
+        throw new Error('The reviewed control is unavailable; refresh its preview.');
+    if (!exports.RESPONSIBILITY_CONTROL_SCOPES.some((scope) => scope === preview.scope)) {
+        throw new Error('The preview has an unsupported control scope.');
+    }
+    if (typeof preview.expectedVersion !== 'number' || !Number.isSafeInteger(preview.expectedVersion)
+        || preview.expectedVersion < 1)
+        throw new Error('The preview must pin its Commitment version.');
+    if (!idempotencyKey.trim() || idempotencyKey.length > 200)
+        throw new Error('Use an idempotency key of 1..200 characters.');
+    if (reason !== undefined && reason.length > 1000)
+        throw new Error('The control reason must be at most 1000 characters.');
+    if (!Array.isArray(preview.targetIds) || !Array.isArray(preview.expectedTargets)
+        || preview.targetIds.length > 500 || preview.expectedTargets.length > 500) {
+        throw new Error('The preview must contain a bounded, frozen target set.');
+    }
+    const pinKeys = new Set(['id', 'type', 'generation', 'attempt', 'taskWorkflowGeneration',
+        'workflowPlanGeneration', 'workflowNodeAttempt', 'workflowTaskRunId', 'bindingDigest',
+        'executorAttemptRef', 'taskRunId']);
+    const executorKeys = new Set(['kind', 'runId', 'generation', 'attempt']);
+    const targetIds = preview.targetIds;
+    const pins = preview.expectedTargets;
+    if (targetIds.some((id) => typeof id !== 'string' || !id || id.length > 200)
+        || new Set(targetIds).size !== targetIds.length
+        || pins.some((pin) => !record(pin) || typeof pin.id !== 'string'
+            || typeof pin.generation !== 'number' || !Number.isSafeInteger(pin.generation) || pin.generation < 0
+            || Object.keys(pin).some((key) => !pinKeys.has(key))
+            || (pin.executorAttemptRef != null && (!record(pin.executorAttemptRef)
+                || Object.keys(pin.executorAttemptRef).some((key) => !executorKeys.has(key)))))
+        || pins.length !== targetIds.length
+        || new Set(pins.map((pin) => record(pin) ? pin.id : null)).size !== pins.length
+        || pins.some((pin) => !record(pin) || !targetIds.includes(pin.id))) {
+        throw new Error('Use the exact target identities and generation pins returned by control preview.');
+    }
+    if (String(preview.scope).startsWith('cancel_') && pins.length === 0) {
+        throw new Error('A cancellation preview must identify the exact worker or episode attempts.');
+    }
+    return {
+        scope: preview.scope, expectedVersion: preview.expectedVersion,
+        targetIds, expectedTargets: pins, idempotencyKey,
+        ...(reason !== undefined ? { reason } : {}),
+    };
+}
+function renderControl(value, log) {
+    log(`${value.scope}: ${value.state ?? (value.available === true ? 'available' : 'unavailable')}`);
+    if (value.controlId)
+        log(`Control receipt: ${value.controlId}`);
+    if (value.expectedVersion !== undefined)
+        log(`Commitment version: ${value.expectedVersion}`);
+    if (value.unavailableReason)
+        log(`Reason: ${value.unavailableReason}`);
+    for (const key of ['affected', 'remaining']) {
+        const rows = value[key];
+        if (!Array.isArray(rows))
+            continue;
+        log(`${key === 'affected' ? 'Affected' : 'Remaining'} work: ${rows.length}`);
+        for (const row of rows)
+            if (record(row))
+                log(`  ${row.id}: ${row.status ?? 'unknown'}${row.acknowledgement ? ` (${row.acknowledgement})` : ''}`);
+    }
+    if (Array.isArray(value.warnings))
+        for (const warning of value.warnings)
+            log(String(warning));
+}
+function renderReadiness(value, log) {
+    const activation = value.object === 'commitment_readiness_activation_receipt';
+    log(`${activation ? 'Activation' : 'Readiness'} receipt: ${value.id ?? 'not recorded'}`);
+    if (activation) {
+        log(`Validated version: ${value.validatedVersion ?? 'unknown'}`);
+        log(`Activated version: ${value.activatedVersion ?? 'unknown'}`);
+        if (record(value.materialization))
+            log(`Trigger materialization: ${value.materialization.status ?? 'unknown'}`);
+        log(`Worker observation: ${value.workerObservationConfirmed === true ? 'confirmed' : 'unconfirmed'}`);
+    }
+    if (record(value.preflight))
+        log(`Preflight: ${value.preflight.verdict ?? 'unknown'}`);
+    if (record(value.observation)) {
+        log(`Observation: ${value.observation.status ?? 'unknown'}`);
+        log(`Required source coverage: ${value.observation.requiredCoverageComplete === true ? 'complete' : 'incomplete'}`);
+        log(`Worker observation: ${value.observation.workerObservationConfirmed === true ? 'confirmed' : 'unconfirmed'}`);
+    }
+    if (value.isCurrent !== undefined)
+        log(`Current evidence: ${value.isCurrent === true ? 'yes' : 'no'}`);
+    if (value.validUntil)
+        log(`Evidence valid until: ${value.validUntil}`);
+}
+function renderProbe(value, log) {
+    log(`Source observation: ${value.status ?? 'unknown'}`);
+    log(`Coverage: ${value.coverageComplete === true ? 'complete' : 'incomplete'}`);
+    if (Array.isArray(value.rows))
+        for (const row of value.rows) {
+            if (record(row))
+                log(`  ${row.source ?? row.key ?? 'source'}: ${row.status ?? 'unknown'}${row.reason ? ` (${row.reason})` : ''}`);
+        }
+    log(`Worker observation: ${value.workerObservationConfirmed === true ? 'confirmed' : 'unconfirmed'}`);
+}