@skrr-ai/cli 0.1.15 → 0.1.17

package/README.md

@@ -753,6 +753,9 @@ sky commitments preflight <commitment-id>                    # explain gates bef
 sky commitments create --agent <agent-id> \
   --title "Hiring loop" --outcome "Every candidate hears back within 48h" \
   --watch tasks --watch email --cadence 12h
+sky commitments create --agent <agent-id> --title "AWS cost watch" \
+  --outcome "Cost regressions are investigated" \
+  --agent-directive-file ./aws-cost-policy.md
 sky commitments resume <commitment-id>          # activate
 
 # Or draft it from a sentence (read-only proposal)

package/dist/commands/commitments/autonomy.js

@@ -29,6 +29,7 @@ class CommitmentsAutonomy extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> commitments autonomy <commitment-id> --mode ask_first',
         '<%= config.bin %> commitments autonomy <commitment-id> --mode auto_run_limited --reason "trusted after 2 weeks"',
+        '<%= config.bin %> commitments autonomy <commitment-id> --mode auto_run --reason "owns the pipeline end to end"',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }),
@@ -36,7 +37,14 @@ class CommitmentsAutonomy extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         mode: core_1.Flags.string({
-            description: 'Autonomy mode',
+            // The web surface groups these into three choices; the CLI keeps the
+            // canonical five because an operator and a coding agent both need to name
+            // the stored value. What it must NOT keep is the silence: the two acting
+            // rungs were indistinguishable in the decision core until the authority
+            // rework, and this help text never said what separated them.
+            description: 'Autonomy mode: off (stop) | suggestions_only (propose only) | ask_first (prepare, wait for approval) | ' +
+                'auto_run_limited (act unattended on low/medium-risk work, bring high-risk to the owner) | ' +
+                'auto_run (act unattended, high-risk work included)',
             options: [...commitments_1.COMMITMENT_AUTONOMY_MODES],
             required: true,
         }),

package/dist/commands/commitments/create.d.ts

@@ -1,10 +1,10 @@
 import { BaseCommand } from '../../base-command';
 /**
- * Public commitment creation is intentionally trust-first: an action-capable
- * mode requested in the create payload is staged as suggestions_only until an
- * owner explicitly grants it. That safety boundary must be visible at the CLI
- * boundary; otherwise a successful create response reads like the requested
- * autonomy is live when it is not.
+ * Creation preserves the policy its author wrote, so the mode that comes back
+ * is normally the mode that was asked for. When it is not — normalization
+ * rejected the value, or a governance layer sits lower — the difference has to
+ * be said out loud at the CLI boundary; otherwise a successful create response
+ * reads like the requested autonomy is live when something else is running.
  */
 export declare function autonomyStagingNotice({ payload, commitment, bin, }: {
     payload: Record<string, unknown>;
@@ -32,6 +32,8 @@ export default class CommitmentsCreate extends BaseCommand {
         title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         outcome: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'agent-directive': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'agent-directive-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         goal: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         deadline: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -47,6 +49,7 @@ export default class CommitmentsCreate extends BaseCommand {
         'cadence-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         timezone: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         autonomy: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        isolation: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'max-nudges': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/commitments/create.js

@@ -8,11 +8,11 @@ const prompt_1 = require("../../lib/prompt");
 const triggers_1 = require("../../lib/triggers");
 const commitments_1 = require("../../lib/commitments");
 /**
- * Public commitment creation is intentionally trust-first: an action-capable
- * mode requested in the create payload is staged as suggestions_only until an
- * owner explicitly grants it. That safety boundary must be visible at the CLI
- * boundary; otherwise a successful create response reads like the requested
- * autonomy is live when it is not.
+ * Creation preserves the policy its author wrote, so the mode that comes back
+ * is normally the mode that was asked for. When it is not — normalization
+ * rejected the value, or a governance layer sits lower — the difference has to
+ * be said out loud at the CLI boundary; otherwise a successful create response
+ * reads like the requested autonomy is live when something else is running.
  */
 function autonomyStagingNotice({ payload, commitment, bin, }) {
     const requestedPolicy = payload.policy && typeof payload.policy === 'object' && !Array.isArray(payload.policy)
@@ -27,8 +27,8 @@ function autonomyStagingNotice({ payload, commitment, bin, }) {
         return undefined;
     const id = typeof commitment.id === 'string' ? commitment.id : '<commitment-id>';
     return [
-        `Requested autonomy ${requested} was staged as ${admitted || 'suggestions_only'} for review; it is not active yet.`,
-        `To grant it explicitly: ${bin} commitments autonomy ${id} --mode ${requested} --reason "<why this scope is safe>"`,
+        `Requested autonomy ${requested} was not applied; this commitment is running as ${admitted || 'suggestions_only'}.`,
+        `To set it explicitly: ${bin} commitments autonomy ${id} --mode ${requested} --reason "<why this scope is safe>"`,
     ].join('\n');
 }
 /**
@@ -47,6 +47,7 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments create --agent <agent-id> --title "Ship v2" --outcome "v2 is live for all users" --cadence 6h',
         '<%= config.bin %> commitments create --agent <agent-id> --title "Hiring loop" --outcome "Every candidate hears back in 48h" --watch tasks --watch email --cadence 12h --status active',
         '<%= config.bin %> commitments create --agent <agent-id> --title "SLA" --outcome "p95 under 200ms" --criterion "p95 latency confirmed" --evaluator metric --measure <measure-id>',
+        '<%= config.bin %> commitments create --agent <agent-id> --title "AWS cost watch" --outcome "Cost regressions are investigated" --agent-directive-file ./aws-cost-policy.md',
         '<%= config.bin %> commitments create --from-json commitment.json --json',
     ];
     static flags = {
@@ -64,6 +65,12 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
             description: 'The outcome to hold true — required when setting any target field',
         }),
         description: core_1.Flags.string({ description: 'Longer description' }),
+        'agent-directive': core_1.Flags.string({
+            description: 'Per-Commitment domain policy (max 8,000 characters). Mutually exclusive with --agent-directive-file.',
+        }),
+        'agent-directive-file': core_1.Flags.string({
+            description: 'Read the per-Commitment domain policy from a text file, or - for stdin. Mutually exclusive with --agent-directive.',
+        }),
         goal: core_1.Flags.string({ description: 'Link to a goal ID' }),
         status: core_1.Flags.string({
             description: 'Create as draft (default) or active',
@@ -116,9 +123,24 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
         }),
         timezone: core_1.Flags.string({ description: 'IANA timezone for the cadence' }),
         autonomy: core_1.Flags.string({
-            description: 'How much the commitment may act without asking (default suggestions_only)',
+            // `--help` is where someone decides what to type, so the ceiling that can
+            // still bind has to be stated HERE and not only in the notice that
+            // corrects them afterwards. `commitments autonomy --mode` learned the
+            // same lesson: what it must not keep is the silence.
+            description: 'Autonomy to set at creation (default suggestions_only). Explicit values are preserved; ' +
+                'Agent, Compass, and workspace governance can still impose a visible effective ceiling.',
             options: [...commitments_1.COMMITMENT_AUTONOMY_MODES],
         }),
+        isolation: core_1.Flags.string({
+            // Omitting this is not the same as passing `shared`: an omitted value
+            // leaves the daemon's own isolation heuristic in force, while `shared` is
+            // an explicit contract that suppresses it. Say so here, because `--help`
+            // is where someone decides which of the two they mean.
+            description: 'Where autonomous runs do their work. "ephemeral" cuts a one-shot git worktree per run ' +
+                'and destroys it after; "shared" lands them on the daemon working tree, in place. ' +
+                'Omit to leave the runtime default. Cannot be combined with a remediation capability.',
+            options: [...commitments_1.COMMITMENT_EXECUTION_ISOLATION_MODES],
+        }),
         'max-nudges': core_1.Flags.integer({ description: 'Max user nudges per day (0..20)' }),
     };
     async run() {
@@ -138,6 +160,12 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
                 payload.title = flags.title;
             if (flags.description !== undefined)
                 payload.description = flags.description;
+            const agentDirective = await (0, commitments_1.readCommitmentAgentDirective)({
+                directive: flags['agent-directive'],
+                file: flags['agent-directive-file'],
+            });
+            if (agentDirective !== undefined)
+                payload.agentDirective = agentDirective;
             if (flags.goal)
                 payload.goalId = flags.goal;
             if (flags.status)
@@ -197,6 +225,8 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
             const policy = {};
             if (flags.autonomy)
                 policy.autonomyMode = flags.autonomy;
+            if (flags.isolation)
+                policy.executionIsolation = flags.isolation;
             if (flags['max-nudges'] !== undefined)
                 policy.maxUserNudgesPerDay = flags['max-nudges'];
             if (Object.keys(policy).length)

package/dist/commands/commitments/doctor.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+export declare function doctorVerdict(input: {
+    commitment?: Record<string, unknown>;
+    preflight?: Record<string, unknown>;
+}): {
+    verdict: string;
+    next: string;
+};
+export default class CommitmentsDoctor extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        strict: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/doctor.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.doctorVerdict = doctorVerdict;
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+function doctorVerdict(input) {
+    const commitment = input.commitment || {};
+    const preflight = input.preflight || {};
+    if (commitment.status !== 'active')
+        return { verdict: 'blocked', next: 'skrr commitments resume <id>' };
+    if (preflight.verdict === 'blocked')
+        return { verdict: 'blocked', next: 'skrr commitments preflight <id> --json' };
+    const attention = preflight.attention;
+    if (attention?.allowed === false)
+        return { verdict: 'attention_suppressed', next: 'skrr commitments effective-policy <id>' };
+    return { verdict: 'active_healthy', next: 'skrr commitments trace <id> --limit 50' };
+}
+class CommitmentsDoctor extends base_command_1.BaseCommand {
+    static description = 'Summarize commitment readiness and the next operator action';
+    static args = {
+        id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the composed health report as JSON' }),
+        strict: core_1.Flags.boolean({
+            description: 'Exit non-zero unless the commitment is active and healthy',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommitmentsDoctor);
+        let commitment;
+        let preflight;
+        let triggerStatus;
+        let ledger;
+        try {
+            const [shown, pf, triggers, runs] = await Promise.all([
+                commitments_1.commitmentApi.get(args.id),
+                commitments_1.commitmentApi.preflight(args.id),
+                commitments_1.commitmentApi.triggerStatus(args.id, 5),
+                commitments_1.commitmentApi.ledger(args.id, { limit: 5 }),
+            ]);
+            commitment = (shown.commitment || {});
+            preflight = pf;
+            triggerStatus = triggers;
+            ledger = runs;
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        const diagnosis = doctorVerdict({ commitment, preflight });
+        const report = {
+            ...diagnosis,
+            commitment,
+            preflight,
+            triggerStatus,
+            ledger,
+            observedAt: new Date().toISOString(),
+        };
+        if (flags.json)
+            this.log(JSON.stringify(report, null, 2));
+        else {
+            this.log(`Verdict: ${diagnosis.verdict}`);
+            this.log(`Next:    ${diagnosis.next.replace('<id>', args.id)}`);
+        }
+        if (flags.strict && diagnosis.verdict !== 'active_healthy')
+            process.exitCode = 1;
+    }
+}
+exports.default = CommitmentsDoctor;

package/dist/commands/commitments/preflight.d.ts

@@ -28,11 +28,13 @@ export default class CommitmentsPreflight extends BaseCommand {
     static description: string;
     static examples: string[];
     static args: {
-        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        id: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
     };
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         next: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'from-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'event-fixture': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/commitments/preflight.js

@@ -4,6 +4,7 @@ exports.preflightGateLines = preflightGateLines;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
+const prompt_1 = require("../../lib/prompt");
 /**
  * The lines one preflight gate contributes.
  *
@@ -46,21 +47,42 @@ class CommitmentsPreflight extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments preflight <commitment-id> --json',
     ];
     static args = {
-        id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }),
+        id: core_1.Args.string({
+            description: 'Commitment ID (omit with --from-json to preview before creation)',
+            required: false,
+            ignoreStdin: true,
+        }),
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output the complete preflight report as JSON' }),
         next: core_1.Flags.integer({ description: 'Number of upcoming runs to project (1–10)' }),
+        'from-json': core_1.Flags.string({
+            description: 'Unsaved Commitment create body file, or - for stdin',
+        }),
+        'event-fixture': core_1.Flags.string({
+            description: 'Optional event fixture JSON file, or - for stdin',
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(CommitmentsPreflight);
+        if (Boolean(args.id) === Boolean(flags['from-json'])) {
+            this.error('Pass either a commitment ID or --from-json <file|->.', { exit: 1 });
+        }
         if (flags.next != null && (flags.next < 1 || flags.next > 10)) {
             this.error('--next must be between 1 and 10', { exit: 1 });
         }
         let report;
         try {
-            report = await commitments_1.commitmentApi.preflight(args.id, flags.next);
+            report = args.id
+                ? await commitments_1.commitmentApi.preflight(args.id, flags.next)
+                : await commitments_1.commitmentApi.draftPreflight({
+                    commitment: (0, commitments_1.normalizeCreateBody)(await (0, prompt_1.readJsonBody)(flags['from-json'])),
+                    ...(flags['event-fixture']
+                        ? { eventFixture: await (0, prompt_1.readJsonBody)(flags['event-fixture']) }
+                        : {}),
+                    ...(flags.next !== undefined ? { nextRunCount: flags.next } : {}),
+                });
         }
         catch (err) {
             this.handleApiError(err);
@@ -70,7 +92,7 @@ class CommitmentsPreflight extends base_command_1.BaseCommand {
             this.log(JSON.stringify(report, null, 2));
             return;
         }
-        this.log(`Preflight: ${String(report.verdict).replace(/_/g, ' ')}`);
+        this.log(`${args.id ? 'Preflight' : 'Pre-create preview (nothing persisted)'}: ${String(report.verdict).replace(/_/g, ' ')}`);
         this.log('\nGates:');
         for (const gate of report.gates || []) {
             for (const line of preflightGateLines(gate))

package/dist/commands/commitments/reports.js

@@ -13,7 +13,8 @@ const DESTINATIONS_NEEDING_TARGET = new Set(['slack_channel', 'email']);
  * completion, a ping on escalation), so `on` is NOT part of the key.
  */
 function reportKey(r) {
-    return r.destinationTarget ? `${r.destination}:${r.destinationTarget}` : r.destination;
+    const target = r.destinationTarget ? `${r.destination}:${r.destinationTarget}` : r.destination;
+    return `${target}:${r.on ?? 'material_change'}`;
 }
 /**
  * `skrr commitments reports <id>` — where this commitment tells you things.
@@ -98,8 +99,20 @@ class CommitmentsReports extends base_command_1.BaseCommand {
                 payload = { reports: (0, commitment_terms_1.appendUnique)(reports, next, reportKey, 'Report target') };
             }
             else {
+                const base = String(flags.remove);
+                const matches = reports.filter((report) => {
+                    const target = report.destinationTarget
+                        ? `${report.destination}:${report.destinationTarget}`
+                        : report.destination;
+                    return target === base && (!flags.on || (report.on ?? 'material_change') === flags.on);
+                });
+                if (matches.length !== 1) {
+                    throw new Error(matches.length > 1
+                        ? `Multiple report targets match ${base}. Pass --on to select one condition.`
+                        : `Report target ${base} is not attached to this commitment.`);
+                }
                 payload = {
-                    reports: (0, commitment_terms_1.removeByKey)(reports, String(flags.remove), reportKey, 'Report target'),
+                    reports: (0, commitment_terms_1.removeByKey)(reports, reportKey(matches[0]), reportKey, 'Report target'),
                 };
             }
         }

package/dist/commands/commitments/update.d.ts

@@ -13,8 +13,11 @@ import { BaseCommand } from '../../base-command';
  * `freshnessExpectation` thresholds the loop uses to detect stale open loops.
  * `--criterion` still REPLACES the criteria list (that is its purpose).
  *
- * Autonomy is deliberately not settable here — `policy` is likewise replaced
- * wholesale. Use `skrr commitments autonomy <id>`.
+ * Autonomy is deliberately not settable here: raising it wants a recorded
+ * reason, which `skrr commitments autonomy <id>` requires and this command has
+ * no place for. Other policy fields ARE patchable — the API deep-merges a
+ * `policy` patch (`mergePolicyPatch`), so a single-key patch leaves the rest of
+ * the contract untouched.
  */
 export default class CommitmentsUpdate extends BaseCommand {
     static description: string;
@@ -25,8 +28,11 @@ export default class CommitmentsUpdate extends BaseCommand {
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'from-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'if-version': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'agent-directive': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'agent-directive-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         outcome: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         deadline: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -40,6 +46,7 @@ export default class CommitmentsUpdate extends BaseCommand {
         cadence: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'cadence-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         timezone: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        isolation: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/commitments/update.js

@@ -20,8 +20,11 @@ const commitments_1 = require("../../lib/commitments");
  * `freshnessExpectation` thresholds the loop uses to detect stale open loops.
  * `--criterion` still REPLACES the criteria list (that is its purpose).
  *
- * Autonomy is deliberately not settable here — `policy` is likewise replaced
- * wholesale. Use `skrr commitments autonomy <id>`.
+ * Autonomy is deliberately not settable here: raising it wants a recorded
+ * reason, which `skrr commitments autonomy <id>` requires and this command has
+ * no place for. Other policy fields ARE patchable — the API deep-merges a
+ * `policy` patch (`mergePolicyPatch`), so a single-key patch leaves the rest of
+ * the contract untouched.
  */
 class CommitmentsUpdate extends base_command_1.BaseCommand {
     static description = "Update a commitment's contract (title, target, cadence, sources)";
@@ -30,6 +33,7 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments update <commitment-id> --title "Ship v2 (Q3)" --outcome "v2 is live for all users"',
         '<%= config.bin %> commitments update <commitment-id> --watch tasks --watch github',
         '<%= config.bin %> commitments update <commitment-id> --criterion "signups confirmed" --evaluator metric --measure <measure-id>',
+        '<%= config.bin %> commitments update <commitment-id> --agent-directive-file ./review-policy.md',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }),
@@ -39,8 +43,17 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         'from-json': core_1.Flags.string({
             description: 'Path to a JSON file (or "-" for stdin) for fields not exposed as flags',
         }),
+        'if-version': core_1.Flags.integer({
+            description: 'Only update this observed contract version; returns a conflict if it changed',
+        }),
         title: core_1.Flags.string({ description: 'New title' }),
         description: core_1.Flags.string({ description: 'New description' }),
+        'agent-directive': core_1.Flags.string({
+            description: 'Replace the per-Commitment domain policy (max 8,000 characters). Mutually exclusive with --agent-directive-file.',
+        }),
+        'agent-directive-file': core_1.Flags.string({
+            description: 'Read replacement domain policy from a text file, or - for stdin. Mutually exclusive with --agent-directive.',
+        }),
         status: core_1.Flags.string({
             description: 'New status. Invalid lifecycle jumps (e.g. completed → active) are rejected by the API.',
             options: [...commitments_1.COMMITMENT_STATUSES],
@@ -82,6 +95,14 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
             options: [...commitments_1.COMMITMENT_CADENCE_MODES],
         }),
         timezone: core_1.Flags.string({ description: 'IANA timezone for the cadence' }),
+        isolation: core_1.Flags.string({
+            // Sent as a single-key `policy` patch. The API deep-merges it, so this
+            // cannot blank an autonomy mode or an attention budget set elsewhere.
+            description: 'Where autonomous runs do their work: "ephemeral" (one-shot git worktree per run) or ' +
+                '"shared" (the daemon working tree, in place). Cannot be combined with a remediation ' +
+                'capability.',
+            options: [...commitments_1.COMMITMENT_EXECUTION_ISOLATION_MODES],
+        }),
     };
     async run() {
         this.requireAuth();
@@ -115,10 +136,18 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         let payload;
         try {
             payload = await (0, prompt_1.readJsonBody)(flags['from-json']);
+            if (flags['if-version'] !== undefined)
+                payload.expectedVersion = flags['if-version'];
             if (flags.title)
                 payload.title = flags.title;
             if (flags.description !== undefined)
                 payload.description = flags.description;
+            const agentDirective = await (0, commitments_1.readCommitmentAgentDirective)({
+                directive: flags['agent-directive'],
+                file: flags['agent-directive-file'],
+            });
+            if (agentDirective !== undefined)
+                payload.agentDirective = agentDirective;
             if (flags.status)
                 payload.status = flags.status;
             if (wantsTarget) {
@@ -189,6 +218,11 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
                     cadence.timezone = flags.timezone;
                 payload.cadence = cadence;
             }
+            // A single key, deliberately. `mergePolicyPatch` on the server merges it
+            // into the stored policy, so naming only this field is what keeps the
+            // rest of the contract intact.
+            if (flags.isolation)
+                payload.policy = { executionIsolation: flags.isolation };
         }
         catch (err) {
             this.error(err.message, { exit: 1 });

package/dist/commands/tasks/complete.js

@@ -22,6 +22,38 @@ const task_transcript_1 = require("../../lib/task-transcript");
 const web_url_1 = require("../../lib/web-url");
 const tasks_1 = require("../../lib/tasks");
 const git_task_1 = require("../../lib/git-task");
+/**
+ * Forward any `--deliverable` value that is really a ledger coordinate.
+ *
+ * FAIL-OPEN, and quietly. This is a convenience bridge on the completion path:
+ * the completion itself is the operation the caller asked for, and a ledger
+ * write that fails must not take it down. A caller who needed the row and did
+ * not get it meets the gate's refusal, which names the command that writes it.
+ *
+ * `local`, never anything stronger — this is the executor talking about its own
+ * work, which is exactly what the authority ladder is built to weigh.
+ */
+async function recordCoordinateDeliverables({ taskId, values, warn, }) {
+    const seen = new Set();
+    for (const value of values) {
+        const raw = (value ?? '').trim();
+        if (!raw || raw === 'none' || seen.has(raw)) {
+            continue;
+        }
+        seen.add(raw);
+        const parsed = (0, tasks_1.parseDeliverableCoordinate)(raw);
+        if (!parsed.ok) {
+            continue;
+        }
+        try {
+            await data_provider_1.dataService.addTaskDeliverable(taskId, parsed.value);
+        }
+        catch {
+            warn(`Recorded "${raw}" in the report but not in the deliverables ledger. ` +
+                `If the task refuses to close, run \`tasks deliverable add\` for it.`);
+        }
+    }
+}
 /**
  * Mutation endpoints require the task's canonical UUID even though the CLI
  * accepts human-readable refs and titles. Resolve the display reference before
@@ -483,6 +515,31 @@ class TasksComplete extends base_command_1.BaseCommand {
                 });
             }
         }
+        // THE THIRD SPELLING, BRIDGED.
+        //
+        // `--deliverable` here is PROSE for the TASK_OUTPUT block. The ledger the
+        // completion gate reads is written by `tasks deliverable add`, and nothing
+        // connected the two — so an agent that ran
+        // `tasks complete --deliverable code:abc@origin/main` had, from its own
+        // point of view, recorded its deliverable, and was then refused by a gate
+        // whose message told it to record its deliverable.
+        //
+        // Three surfaces in one CLI answer to the word (`tasks deliverable add`,
+        // this flag, and `tasks report --deliverable`), and the project's own
+        // operating instructions teach the two that do NOT write the ledger. That
+        // is a documentation problem only if you believe people read the docs
+        // before the error; the cheaper fix is to make the wrong spelling do the
+        // right thing when what was typed is unambiguously a coordinate.
+        //
+        // Deliberately narrow: only values that PARSE as `<kind>:<identity>` are
+        // forwarded. A prose reference like `report.pdf` is left exactly as it was —
+        // guessing a coordinate out of prose is how the ledger fills with rows
+        // nobody can look up again.
+        await recordCoordinateDeliverables({
+            taskId: completionTaskId,
+            values: [...(flags.deliverable ?? []), ...(flags.deliverables ?? [])],
+            warn: (message) => this.warn(message),
+        });
         let result;
         try {
             result = await completeTaskDurably({

package/dist/commands/tasks/create.js

@@ -71,7 +71,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Validate and print the create payload without writing a task',
         }),
         'from-json': core_1.Flags.string({
-            description: 'Path to a JSON file (or "-" for stdin) to use as the request body',
+            description: 'Path to a JSON file (or "-" for stdin) to use as the request body. ' +
+                'Accepts stored names (projectId, goalId) and create-flag aliases (project, goal, spawnedBy).',
         }),
         template: core_1.Flags.string({
             description: 'Saved task template ID, or an exact template name with --space. Creates its whole task tree; supplied task flags override the root.',

package/dist/commands/tasks/deliverable/confirm.d.ts

@@ -0,0 +1,35 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr tasks deliverable confirm <task> <kind>:<identity>[@<location>] --reason "<what you checked>"`
+ *
+ * Somebody looked, and it is there.
+ *
+ * WHY THIS IS A SEPARATE COMMAND from `deliverable add`. Recording and vouching
+ * are different claims. `add` says "this exists, and I am the one who made it";
+ * this says "I checked, independently of whoever made it". Five of the six
+ * outcome kinds have no automatic observer — nothing in the platform watches a
+ * Drive folder or a Slack channel — so without this rung an expectation for a
+ * PDF or a posted message could only ever be closed by waiving it, which
+ * records "we decided we did not need this" about work that was actually done.
+ *
+ * The reason is required, for the same purpose a waiver's and a judgement's
+ * are: the entire value of a confirmation is that a person actually looked, and
+ * a confirmation with nothing written down is indistinguishable from a click.
+ *
+ * It UPSERTS. Confirming something the executor never recorded is legitimate —
+ * the thing is there either way — and making a person file the row first before
+ * they may vouch for it is ceremony that buys nothing.
+ */
+export default class TasksDeliverableConfirm extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        task: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        coordinate: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        reason: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}