@skrr-ai/cli 0.1.23 → 0.1.24

package/dist/commands/tasks/result/show.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const task_resolver_1 = require("../../../lib/task-resolver");
+const task_legacy_1 = require("../../../lib/task-legacy");
 class TasksResultShow extends base_command_1.BaseCommand {
     static description = 'Show the current Task Result and its exact Review';
     static args = {
@@ -29,12 +30,29 @@ class TasksResultShow extends base_command_1.BaseCommand {
             return this.log(JSON.stringify(result, null, 2));
         const current = result.results.find((row) => row.id === result.currentResultId);
         if (!current)
-            return this.log('No Result submitted.');
+            return this.log(await (0, task_legacy_1.emptyCanonicalView)(task.id, 'Result'));
         const review = result.reviews.find((row) => row.resultId === current.id);
         this.log(`Result v${current.version}\n${current.summary}`);
         if (current.conclusion)
             this.log(`Conclusion (${current.conclusion.type}): ${JSON.stringify(current.conclusion.value)}`);
-        this.log(`Review: ${review ? review.decision : 'awaiting review'}`);
+        // Only "awaiting" while a review can still be recorded. A closed Task
+        // refuses one outright (`TASK_REOPEN_REQUIRED`), so the old wording named a
+        // state nothing could ever leave — and a reader could not tell it from a
+        // review that is genuinely pending. The extra read happens only on the
+        // no-review path, where the distinction is the whole point.
+        let reviewLine = 'awaiting review';
+        if (review) {
+            reviewLine = review.decision;
+        }
+        else {
+            const full = (await data_provider_1.dataService
+                .getTask(task.id, { enrich: false })
+                .catch(() => undefined));
+            if (['completed', 'cancelled'].includes(String(full?.statusType ?? ''))) {
+                reviewLine = 'none recorded — the Task is closed';
+            }
+        }
+        this.log(`Review: ${reviewLine}`);
         if (flags.history && result.results.length > 1) {
             this.log(`Superseded versions: ${result.results
                 .slice(1)

package/dist/commands/tasks/resume/save.js

@@ -15,7 +15,17 @@ class TasksResumeSave extends base_command_1.BaseCommand {
     static flags = {
         task: core_1.Flags.string({ description: 'Task id; overrides runtime context' }),
         'run-id': core_1.Flags.string({ required: true, description: 'Canonical Task Run' }),
-        snapshot: core_1.Flags.string({ required: true, description: 'Resume Point JSON snapshot' }),
+        snapshot: core_1.Flags.string({
+            required: true,
+            description: 'Resume Point JSON snapshot. ' +
+                'Every field is optional. `completed`, `nextActions` and `currentFocus` accept either a ' +
+                'plain sentence or {summary,sourceRefs} — the object form is canonical and a bare string ' +
+                'is lifted into it, so the same sentence you put in an Update’s nextActions works here ' +
+                'unchanged. Shape: {completed:[], currentFocus, nextActions:[], ' +
+                'openQuestions:[{question,sourceRef?}], relevantUpdateIds:[], evidenceRefs:[], ' +
+                'deliverableRefs:[], childHeads:[{runId,resumePointId,status}], workspaceStateRef}. ' +
+                'Never put a credential, token or lease in a snapshot — the server refuses one.',
+        }),
         'spec-version': core_1.Flags.integer({ description: 'Task specification version' }),
         'idempotency-key': core_1.Flags.string({ description: 'Stable retry key' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),

package/dist/commands/tasks/self-schedule.js

@@ -31,10 +31,13 @@ class TasksSelfSchedule extends base_command_1.BaseCommand {
         at: core_1.Flags.string({ description: 'Absolute return time (ISO-8601 UTC)' }),
         in: core_1.Flags.string({ description: 'Relative return time such as 90m, 2h, 3d' }),
         note: core_1.Flags.string({
-            // Was "handed to the agent as the return prompt", which is not true:
-            // `task_execute` builds the run's prompt from the Task, so this string is
-            // recorded and never read by the run. See `TaskScheduler/selfSchedule.js`.
-            description: 'Why you are coming back — recorded on the return for you to read back',
+            // This DOES reach the run now. It is read by `buildTaskExecutionPrompt`,
+            // the one place every dispatch path assembles a task prompt, and rendered
+            // as `### Why You Parked This Task` alongside the instant it was parked
+            // for. For a while it was recorded and never delivered, and the help said
+            // so; both halves are fixed rather than only the sentence.
+            description: 'Why you are coming back. Delivered to the agent on the return as its own ' +
+                'prompt section, and readable any time with --show',
         }),
         'max-per-day': core_1.Flags.integer({
             description: 'Cap on self-initiated returns per day (1-24, default 4)',

package/dist/commands/tasks/show.js

@@ -262,6 +262,25 @@ class TasksShow extends base_command_1.BaseCommand {
             this.log(`Created:     ${formatTime(t.createdAt)}`);
         if (t.updatedAt)
             this.log(`Updated:     ${formatTime(t.updatedAt)}`);
+        /**
+         * Say which Task model this row belongs to, on the one surface everybody
+         * reads first.
+         *
+         * Canonical Task Model v1 deliberately migrated nothing, so a Task created
+         * before it is a second class of object with visibly different behaviour —
+         * no Updates, no Result, no Activity, no timeline. The only marker was
+         * `specVersion` being ABSENT under `--json`, and absence-as-a-marker is not
+         * something a reader can notice: you have to already know the field exists
+         * to observe that it does not. So `tasks show` said nothing, and the user
+         * found out by watching four other commands report emptiness about a Task
+         * with years of history.
+         *
+         * Printed only for the legacy class. A canonical Task needs no line saying
+         * it is ordinary.
+         */
+        if (t.specVersion === undefined || t.specVersion === null) {
+            this.log('Model:       predates the canonical Task model — no Result, Updates, Activity or timeline');
+        }
         if (t.description) {
             this.log('');
             this.log('Description:');

package/dist/commands/tasks/timeline.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const task_legacy_1 = require("../../lib/task-legacy");
 /**
  * `<action> (<k=v ...>)`, or just the preview when there is nothing to add.
  *
@@ -49,7 +50,14 @@ class TasksTimeline extends base_command_1.BaseCommand {
             this.log(JSON.stringify(result, null, 2));
             return;
         }
-        (0, format_1.renderTable)((result.data ?? []).map((item) => ({
+        const rows = result.data ?? [];
+        if (rows.length === 0) {
+            // `renderTable([])` prints NOTHING — no header, no empty state, exit 0 —
+            // which is indistinguishable from a broken command. Say what happened.
+            this.log(await (0, task_legacy_1.emptyCanonicalView)(args.id, 'timeline entries'));
+            return;
+        }
+        (0, format_1.renderTable)(rows.map((item) => ({
             time: String(item.occurredAt ?? '-')
                 .replace('T', ' ')
                 .slice(0, 19),

package/dist/commands/tasks/updates/add.js

@@ -21,6 +21,9 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> tasks updates add <task> --type progress --summary "Migration review complete" --data \'{"completedSinceLast":["Checked migrations 001-014"],"nextActions":["Review authorization"]}\'',
         '<%= config.bin %> tasks updates add <task> --type decision --summary "Use a resource object" --data \'{"decision":"Use WorkResource","rationale":"Identity must survive URL changes"}\'',
+        '<%= config.bin %> tasks updates add <task> --type finding --summary "Cross-tenant leak" --data \'{"finding":"Space ACL is not applied on the list path","impact":"Any member can read another space","severity":"high","evidenceRefs":[]}\'',
+        '<%= config.bin %> tasks updates add <task> --type blocker --summary "Needs a prod credential" --data \'{"cause":"No Atlas API key in this runtime","requiredAction":"Provision a read-only key","nextOwner":{"kind":"human","userId":"<user-id>"}}\'',
+        '<%= config.bin %> tasks updates add <task> --type verification --summary "Repro is gone" --data \'{"claim":"The 409 no longer reproduces","result":"passed","evidenceRefs":[]}\'',
     ];
     static args = {
         task: core_1.Args.string({ required: false, ignoreStdin: true, description: 'Task id or ref' }),
@@ -33,9 +36,27 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
             description: 'What changed in the shared understanding of the Task',
         }),
         summary: core_1.Flags.string({ required: true, description: 'One sentence saying what became true' }),
-        data: core_1.Flags.string({ required: true, description: 'Kind-specific JSON payload' }),
+        data: core_1.Flags.string({
+            required: true,
+            description: 'Kind-specific JSON payload. The server enforces one shape per --type, and the array ' +
+                'fields are required even when empty. ' +
+                'progress {completedSinceLast:[],nextActions:[],currentFocus?} · ' +
+                'finding {finding,evidenceRefs:[],impact?,severity?} · ' +
+                'decision {decision,rationale,alternativesConsidered?} · ' +
+                'blocker {cause,requiredAction,nextOwner} · ' +
+                'verification {claim,result:passed|failed|inconclusive,evidenceRefs:[]}. ' +
+                'nextOwner is a principal object like {"kind":"human","userId":"..."}, not a name. ' +
+                "Note --reference sets the Update's own references, NOT data.evidenceRefs.",
+        }),
         resume: core_1.Flags.string({
-            description: 'JSON recovery snapshot; requires --run-id and is committed with the Update',
+            description: 'JSON recovery snapshot; requires --run-id and is committed with the Update. ' +
+                'Every field is optional. `completed`, `nextActions` and `currentFocus` accept either a ' +
+                'plain sentence or {summary,sourceRefs} — the object form is canonical and a bare string ' +
+                'is lifted into it, so the same sentence you put in an Update’s nextActions works here ' +
+                'unchanged. Shape: {completed:[], currentFocus, nextActions:[], ' +
+                'openQuestions:[{question,sourceRef?}], relevantUpdateIds:[], evidenceRefs:[], ' +
+                'deliverableRefs:[], childHeads:[{runId,resumePointId,status}], workspaceStateRef}. ' +
+                'Never put a credential, token or lease in a snapshot — the server refuses one.',
         }),
         'run-id': core_1.Flags.string({ description: 'Canonical Task Run that performed this work' }),
         'spec-version': core_1.Flags.integer({

package/dist/lib/dedicated-machines.d.ts

@@ -0,0 +1,66 @@
+import { type HarnessLease } from './harnesses';
+export type DedicatedLeaseAction = 'start' | 'stop' | 'restart' | 'snapshot' | 'health-check';
+export declare const DEDICATED_LEASE_ACTIONS: DedicatedLeaseAction[];
+export interface DedicatedRuntimeScope {
+    workspaceId?: string;
+}
+export interface CreateDedicatedRuntimeInput extends DedicatedRuntimeScope {
+    requestId: string;
+    displayName: string;
+    sizePreset: string;
+    regionClass?: string;
+    storageGb?: number;
+    retentionClass?: string;
+    backupProfile?: 'crash-consistent' | 'application-consistent';
+    monthlySpendingLimitCents: number;
+    repositoryRef?: string;
+}
+export interface DedicatedRuntimeResponse {
+    lease?: HarnessLease;
+}
+/**
+ * Flags in, request body out — and the point of it being a function is the
+ * OMISSION.
+ *
+ * A field the user did not set must be ABSENT from the body, not present as
+ * `undefined`, because the server reaches its own default through
+ * `input.x || <default>`. Restating those defaults on the client looks
+ * harmless and is not: `--storage-gb` shipped with a client default of 100
+ * against a product default of 50, so a user who never chose a disk size was
+ * billed for twice the documented one and `workspaceDefaultGb` was unreachable
+ * through the CLI. The three neighbouring flags happened to agree, which only
+ * means the same bug was invisible in them.
+ */
+export declare function dedicatedRuntimeCreateInput(input: {
+    requestId: string;
+    displayName: string;
+    sizePreset: string;
+    monthlySpendingLimitCents: number;
+    regionClass?: string;
+    storageGb?: number;
+    retentionClass?: string;
+    backupProfile?: string;
+    workspaceId?: string;
+}): CreateDedicatedRuntimeInput;
+export declare function createDedicatedRuntime(input: CreateDedicatedRuntimeInput): Promise<DedicatedRuntimeResponse>;
+export declare function listDedicatedRuntimes(options?: {
+    limit?: number;
+    state?: string;
+}): Promise<{
+    leases?: HarnessLease[];
+}>;
+export declare function getDedicatedRuntime(leaseId: string): Promise<DedicatedRuntimeResponse>;
+export declare function performDedicatedLeaseAction(leaseId: string, action: DedicatedLeaseAction): Promise<DedicatedRuntimeResponse>;
+export declare function growDedicatedRuntime(leaseId: string, storageGb: number, options?: {
+    requestId?: string;
+}): Promise<DedicatedRuntimeResponse>;
+export declare function closeDedicatedRuntimeIncidentHold(leaseId: string, options?: {
+    requestId?: string;
+}): Promise<DedicatedRuntimeResponse>;
+export declare function destroyDedicatedRuntime(leaseId: string, options?: {
+    retentionIntent?: 'retain' | 'purge';
+}): Promise<DedicatedRuntimeResponse>;
+export declare function dedicatedLeaseId(lease: HarnessLease | undefined | null): string;
+export declare function dedicatedLeaseState(lease: HarnessLease | undefined | null): string;
+export declare function dedicatedLeaseDisplayName(lease: HarnessLease | undefined | null): string;
+export declare function formatDedicatedRuntimeApiError(err: unknown): string | null;

package/dist/lib/dedicated-machines.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_LEASE_ACTIONS = void 0;
+exports.dedicatedRuntimeCreateInput = dedicatedRuntimeCreateInput;
+exports.createDedicatedRuntime = createDedicatedRuntime;
+exports.listDedicatedRuntimes = listDedicatedRuntimes;
+exports.getDedicatedRuntime = getDedicatedRuntime;
+exports.performDedicatedLeaseAction = performDedicatedLeaseAction;
+exports.growDedicatedRuntime = growDedicatedRuntime;
+exports.closeDedicatedRuntimeIncidentHold = closeDedicatedRuntimeIncidentHold;
+exports.destroyDedicatedRuntime = destroyDedicatedRuntime;
+exports.dedicatedLeaseId = dedicatedLeaseId;
+exports.dedicatedLeaseState = dedicatedLeaseState;
+exports.dedicatedLeaseDisplayName = dedicatedLeaseDisplayName;
+exports.formatDedicatedRuntimeApiError = formatDedicatedRuntimeApiError;
+const api_fetch_1 = require("./api-fetch");
+const harnesses_1 = require("./harnesses");
+exports.DEDICATED_LEASE_ACTIONS = [
+    'start',
+    'stop',
+    'restart',
+    'snapshot',
+    'health-check',
+];
+/**
+ * Flags in, request body out — and the point of it being a function is the
+ * OMISSION.
+ *
+ * A field the user did not set must be ABSENT from the body, not present as
+ * `undefined`, because the server reaches its own default through
+ * `input.x || <default>`. Restating those defaults on the client looks
+ * harmless and is not: `--storage-gb` shipped with a client default of 100
+ * against a product default of 50, so a user who never chose a disk size was
+ * billed for twice the documented one and `workspaceDefaultGb` was unreachable
+ * through the CLI. The three neighbouring flags happened to agree, which only
+ * means the same bug was invisible in them.
+ */
+function dedicatedRuntimeCreateInput(input) {
+    return {
+        requestId: input.requestId,
+        displayName: input.displayName,
+        sizePreset: input.sizePreset,
+        monthlySpendingLimitCents: input.monthlySpendingLimitCents,
+        ...(input.regionClass ? { regionClass: input.regionClass } : {}),
+        ...(input.storageGb !== undefined ? { storageGb: input.storageGb } : {}),
+        ...(input.retentionClass ? { retentionClass: input.retentionClass } : {}),
+        ...(input.backupProfile
+            ? { backupProfile: input.backupProfile }
+            : {}),
+        ...(input.workspaceId ? { workspaceId: input.workspaceId } : {}),
+    };
+}
+async function createDedicatedRuntime(input) {
+    const { requestId, workspaceId, ...body } = input;
+    if (workspaceId) {
+        return (0, api_fetch_1.apiFetch)(`/api/machines/dedicated?workspaceId=${encodeURIComponent(workspaceId)}`, {
+            method: 'POST',
+            body,
+            headers: { 'Idempotency-Key': requestId },
+        });
+    }
+    return (0, api_fetch_1.apiFetch)('/api/machines/dedicated', {
+        method: 'POST',
+        body,
+        headers: { 'Idempotency-Key': requestId },
+    });
+}
+async function listDedicatedRuntimes(options = {}) {
+    return (0, harnesses_1.listHarnessLeases)({
+        ...options,
+        machineProduct: 'dedicated-machine',
+    });
+}
+async function getDedicatedRuntime(leaseId) {
+    return (0, harnesses_1.getHarnessLease)(leaseId);
+}
+async function performDedicatedLeaseAction(leaseId, action) {
+    return (0, harnesses_1.performHarnessLeaseAction)(leaseId, action);
+}
+async function growDedicatedRuntime(leaseId, storageGb, options = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/storage`, {
+        method: 'POST',
+        body: { storageGb },
+        ...(options.requestId ? { headers: { 'Idempotency-Key': options.requestId } } : {}),
+    });
+}
+async function closeDedicatedRuntimeIncidentHold(leaseId, options = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/incident-hold/close`, {
+        method: 'POST',
+        body: {},
+        ...(options.requestId ? { headers: { 'Idempotency-Key': options.requestId } } : {}),
+    });
+}
+async function destroyDedicatedRuntime(leaseId, options = {}) {
+    const query = options.retentionIntent
+        ? `?retentionIntent=${encodeURIComponent(options.retentionIntent)}`
+        : '';
+    return (0, api_fetch_1.apiFetch)(`/api/machines/leases/${encodeURIComponent(leaseId)}${query}`, { method: 'DELETE' });
+}
+function dedicatedLeaseId(lease) {
+    return String(lease?.id ?? '');
+}
+function dedicatedLeaseState(lease) {
+    return String(lease?.state ?? 'unknown');
+}
+function dedicatedLeaseDisplayName(lease) {
+    return lease?.displayName ? String(lease.displayName) : '-';
+}
+/**
+ * Dedicated Runtime commands are unusually likely to meet a server that has
+ * never heard of them.
+ *
+ * The CLI ships independently of the API (`@skrr-ai/cli` on npm), so "CLI newer
+ * than the deployed server" is the normal state for anyone who runs
+ * `npm update`, and this feature widened that window: twelve commands arrived at
+ * once, and three of them call endpoints that land in a later deploy. The server
+ * redacts an unknown-route 404 to "An unexpected error occurred.", so every one
+ * of those users got eight words that cannot be told apart from a wrong lease
+ * id or a broken server.
+ *
+ * A 404 carrying no product `code` is that case. Naming it is the difference
+ * between "wait for the deploy" and "open a bug".
+ */
+function describeMissingEndpoint(err) {
+    if (err.status !== 404) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(err.body || '');
+        // A product code means the server DID handle the route and refused on the
+        // merits — that message is the useful one and must not be overwritten.
+        if (parsed.code) {
+            return null;
+        }
+    }
+    catch {
+        // Unparseable body: no product code by definition.
+    }
+    return ('This server does not have that Dedicated Runtime endpoint. Your CLI is probably ahead of ' +
+        'the deployment — `skrr context` names the server it is talking to, and `skrr machines ' +
+        'dedicated list` will still work if the feature is deployed at all.');
+}
+function formatDedicatedRuntimeApiError(err) {
+    if (!(err instanceof api_fetch_1.ApiFetchError) || !err.body) {
+        return null;
+    }
+    if (err.status === 401) {
+        return null;
+    }
+    const missingEndpoint = describeMissingEndpoint(err);
+    if (missingEndpoint) {
+        return missingEndpoint;
+    }
+    try {
+        const parsed = JSON.parse(err.body);
+        return parsed.message || parsed.error || parsed.code || null;
+    }
+    catch {
+        return err.body.trim() || null;
+    }
+}

package/dist/lib/harnesses.d.ts

@@ -97,6 +97,11 @@ export interface HarnessLease {
         assignable?: boolean;
         reasons?: string[];
     } & Record<string, unknown>;
+    storage?: {
+        retentionClass?: string;
+        lastBackupAt?: string;
+        backupProfile?: string;
+    };
     createdAt?: string;
     updatedAt?: string;
 }

package/dist/lib/harnesses.js

@@ -177,8 +177,11 @@ async function listHarnessLeases(options = {}) {
         query.set('state', options.state);
     if (options.machineProduct)
         query.set('machineProduct', options.machineProduct);
-    const suffix = query.toString() ? `?${query.toString()}` : '';
-    return (0, api_fetch_1.apiFetch)(`/api/machines/leases${suffix}`);
+    const encoded = query.toString();
+    if (encoded) {
+        return (0, api_fetch_1.apiFetch)(`/api/machines/leases?${encoded}`);
+    }
+    return (0, api_fetch_1.apiFetch)('/api/machines/leases');
 }
 async function getHarnessLease(leaseId) {
     return (0, api_fetch_1.apiFetch)(`/api/machines/leases/${encodeURIComponent(leaseId)}`);

package/dist/lib/task-legacy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Tell a reader when an empty canonical view means "nothing happened" and when
+ * it means "this Task predates the records this view reads".
+ *
+ * Canonical Task Model v1 shipped with an explicit decision not to migrate
+ * legacy data, so a Task created before 2026-09-11 has no TaskUpdate, TaskResult
+ * or TaskActivityEvent rows — its history is in `activityLog`, `TaskWorkEvent`
+ * and TASK_OUTPUT comments. Every canonical read surface therefore answered
+ * "No activity." / "Result: none submitted" / nothing at all for Tasks with
+ * years of history, stating absence as fact.
+ *
+ * The marker is that `specVersion` is ABSENT — a field the caller can only
+ * notice by its own missingness, which is why this belongs in one helper rather
+ * than in each command.
+ */
+export declare function isLegacyTask(taskId: string): Promise<boolean>;
+/**
+ * The sentence to print instead of claiming emptiness. `surface` names what the
+ * reader just asked for, so the message says which view is empty rather than
+ * implying the Task is.
+ */
+export declare function legacyEmptyStateMessage(surface: string): string;
+/** Render the right empty state for a canonical view that came back empty. */
+export declare function emptyCanonicalView(taskId: string, surface: string): Promise<string>;

package/dist/lib/task-legacy.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLegacyTask = isLegacyTask;
+exports.legacyEmptyStateMessage = legacyEmptyStateMessage;
+exports.emptyCanonicalView = emptyCanonicalView;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Tell a reader when an empty canonical view means "nothing happened" and when
+ * it means "this Task predates the records this view reads".
+ *
+ * Canonical Task Model v1 shipped with an explicit decision not to migrate
+ * legacy data, so a Task created before 2026-09-11 has no TaskUpdate, TaskResult
+ * or TaskActivityEvent rows — its history is in `activityLog`, `TaskWorkEvent`
+ * and TASK_OUTPUT comments. Every canonical read surface therefore answered
+ * "No activity." / "Result: none submitted" / nothing at all for Tasks with
+ * years of history, stating absence as fact.
+ *
+ * The marker is that `specVersion` is ABSENT — a field the caller can only
+ * notice by its own missingness, which is why this belongs in one helper rather
+ * than in each command.
+ */
+async function isLegacyTask(taskId) {
+    try {
+        const task = (await data_provider_1.dataService.getTask(taskId));
+        return task !== undefined && task !== null && task.specVersion === undefined;
+    }
+    catch {
+        // Never turn a diagnostic into a failure: the caller is rendering an empty
+        // state, not making a decision.
+        return false;
+    }
+}
+/**
+ * The sentence to print instead of claiming emptiness. `surface` names what the
+ * reader just asked for, so the message says which view is empty rather than
+ * implying the Task is.
+ */
+function legacyEmptyStateMessage(surface) {
+    return (`No ${surface} recorded under the canonical Task model.\n` +
+        'This Task predates it, so its history was never migrated — read it with ' +
+        '`skrr tasks show`, `skrr tasks comments list`, or `skrr tasks transcript`.');
+}
+/** Render the right empty state for a canonical view that came back empty. */
+async function emptyCanonicalView(taskId, surface) {
+    return (await isLegacyTask(taskId))
+        ? legacyEmptyStateMessage(surface)
+        : `No ${surface} recorded yet.`;
+}

package/dist/lib/tasks.d.ts

@@ -59,6 +59,7 @@ export type TaskCreateFlagValues = {
         description?: string;
         presetKey?: string;
     }>;
+    'review-policy'?: string;
     'start-date'?: string;
     'due-date'?: string;
     estimate?: number;
@@ -98,6 +99,37 @@ export declare function parseExpectations(specs: string[] | undefined): {
     error: string;
 };
 export declare const EXPECT_FLAG_HELP: string;
+/**
+ * What `--default-expect` means, as a value rather than a side effect.
+ *
+ * `clear` REMOVES the Space default, and it has to exist. Every Expectation gates
+ * closure and a Space default is inherited by every task created afterwards, so a
+ * default set by mistake — or one that outlived its project — gated the whole
+ * board with no way back. `tasks update --expect` already had this sentinel; the
+ * Space flag, the one the design calls "configured once and then holds", did not.
+ * The only exit was to waive the expectation on every task, which writes `dropped`
+ * into the ledger about a requirement that was never real. That is a false record,
+ * not a workaround.
+ *
+ * `null` rather than `[]`: the route declares the field `.nullable()` and the API
+ * turns null into an `$unset`, so the Space stops carrying a default instead of
+ * carrying an empty one. `undefined` means the flag was not passed and the
+ * existing default must be left exactly as it is.
+ *
+ * `clear` must be the SOLE value. Combined with an expectation it is two
+ * contradictory instructions, and honouring one of them silently is how a caller
+ * ends up with a contract they did not ask for.
+ *
+ * Extracted so the three outcomes can be tested without a command harness — the
+ * bug being fixed was in this decision, not in the HTTP call after it.
+ */
+export declare function resolveDefaultExpectations(values: string[] | undefined): {
+    ok: true;
+    value: Array<Record<string, unknown>> | null | undefined;
+} | {
+    ok: false;
+    error: string;
+};
 /**
  * Parse a deliverable coordinate. Also delegated — `:` and `@` and now `/` all
  * mean different things, and a second implementation of that grammar is how the

package/dist/lib/tasks.js

@@ -6,6 +6,7 @@ exports.taskUpdateMutationGuard = taskUpdateMutationGuard;
 exports.executionIsolationFromWorktreeFlag = executionIsolationFromWorktreeFlag;
 exports.parseExpectation = parseExpectation;
 exports.parseExpectations = parseExpectations;
+exports.resolveDefaultExpectations = resolveDefaultExpectations;
 exports.parseDeliverableCoordinate = parseDeliverableCoordinate;
 exports.buildTaskCreatePayload = buildTaskCreatePayload;
 exports.boundSessionAgentId = boundSessionAgentId;
@@ -156,10 +157,54 @@ const kindsForHelp = Array.isArray(data_provider_1.TASK_OUTCOME_KINDS)
 const presetsForHelp = Array.isArray(data_provider_1.EXPECTATION_PRESETS)
     ? data_provider_1.EXPECTATION_PRESETS.map((preset) => `@${preset.key}`).join(', ')
     : '@merged-to-main, @pdf-delivered';
-exports.EXPECT_FLAG_HELP = 'What this task must produce, as <kind>[/<format>][:<target>] or @<preset> — ' +
+exports.EXPECT_FLAG_HELP = 'What this task must produce. Each one GATES closure: the Task cannot enter a ' +
+    'completed state until every Expectation is assessed met or waived ' +
+    '(`tasks expectations assess`). Form: <kind>[/<format>][:<target>] or @<preset> — ' +
     `e.g. 'code:origin/main', 'file/pdf:Drive/Reports', '@merged-to-main'. ` +
     `Kinds: ${kindsForHelp}. Presets: ${presetsForHelp}. ` +
     'Anything else is stored as a plain-language expectation a person settles. Repeatable.';
+/**
+ * What `--default-expect` means, as a value rather than a side effect.
+ *
+ * `clear` REMOVES the Space default, and it has to exist. Every Expectation gates
+ * closure and a Space default is inherited by every task created afterwards, so a
+ * default set by mistake — or one that outlived its project — gated the whole
+ * board with no way back. `tasks update --expect` already had this sentinel; the
+ * Space flag, the one the design calls "configured once and then holds", did not.
+ * The only exit was to waive the expectation on every task, which writes `dropped`
+ * into the ledger about a requirement that was never real. That is a false record,
+ * not a workaround.
+ *
+ * `null` rather than `[]`: the route declares the field `.nullable()` and the API
+ * turns null into an `$unset`, so the Space stops carrying a default instead of
+ * carrying an empty one. `undefined` means the flag was not passed and the
+ * existing default must be left exactly as it is.
+ *
+ * `clear` must be the SOLE value. Combined with an expectation it is two
+ * contradictory instructions, and honouring one of them silently is how a caller
+ * ends up with a contract they did not ask for.
+ *
+ * Extracted so the three outcomes can be tested without a command harness — the
+ * bug being fixed was in this decision, not in the HTTP call after it.
+ */
+function resolveDefaultExpectations(values) {
+    if (values === undefined || values.length === 0)
+        return { ok: true, value: undefined };
+    const clears = values.filter((value) => value.trim().toLowerCase() === 'clear');
+    if (clears.length > 0 && values.length > 1) {
+        return {
+            ok: false,
+            error: '--default-expect clear removes the space default and cannot be combined with an ' +
+                'expectation. Run it alone, then set the new default.',
+        };
+    }
+    if (clears.length > 0)
+        return { ok: true, value: null };
+    const parsed = parseExpectations(values);
+    if (!parsed.ok)
+        return { ok: false, error: parsed.error };
+    return { ok: true, value: parsed.value };
+}
 /**
  * Parse a deliverable coordinate. Also delegated — `:` and `@` and now `/` all
  * mean different things, and a second implementation of that grammar is how the
@@ -214,6 +259,7 @@ function buildTaskCreatePayload(body, flags = {}) {
         assigneeUserIds: flags['assignee-user'],
         executionMode: flags['execution-mode'],
         expectations: flags.expectations,
+        reviewPolicy: flags['review-policy'],
         startDate: flags['start-date'],
         dueDate: flags['due-date'],
         estimate: flags.estimate,