@ucsandman/legcli 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,217 @@
 # Changelog
 
+## 0.12.0 (2026-09-17)
+
+The board is rebuilt around the two questions you actually open it to answer:
+which terminal needs you, and which model is about to run out. Usage stops
+being a region and becomes one strip plus a property of every row; a hand-off
+can now change the model instead of the CLI; and background work comes back as
+rows you can read at a glance instead of a ledger you have to dig through.
+
+- **The board top: a capacity strip, and the login panels behind one
+  disclosure.** Under the verdict, one strip prints each login's *binding*
+  bucket rather than whichever window happened to be stored: `claude 63%
+  6:01 PM`, `codex back Sat 10:11 PM`, `agy no figure`, `grok no reading`. The
+  four login panels are not rewritten, they move intact behind **Capacity and
+  models** with every gauge, notch and `aria-valuetext` they had, and the
+  claude panel head grows a model rail whose chips read `fable 63%` and
+  `opus 12%`. Every branch of `verdictLines()` is now asserted under
+  `VERDICT_CH` by `test/board-verdict.test.mjs`, so a 52px headline can no
+  longer wrap to three lines. Measured on the seeded board at 1280: the first
+  terminal row sits at 536px, where it used to sit at 1382px.
+- **A terminal row says what it is doing, on which model.** The register reads
+  `waiting on you  baton on main  dirty 3  ahead 2  claude/fable`, and a quiet
+  agent carries `quiet 5m`. `ahead` is one `git rev-list --count` on the
+  existing poll; the model is the alias the leg resolved to, updated from the
+  transcript for claude so a silent fallback off Fable becomes visible, and
+  never a guessed default. Under the prompt the row prints its binding bucket,
+  `63% of the fable week`, and past the warn threshold the rung that would keep
+  the terminal.
+- **A terminal waiting on a human says so, everywhere.** Leg now wires Claude
+  Code's `Notification` hook (`permission_prompt`, `idle_prompt`,
+  `agent_needs_input`). The row's status word becomes `waiting on you` and it
+  carries the question verbatim: `waiting on you: permission to run Bash(git
+  push origin HEAD), asked 2m ago`. That sorts the row first, counts it in the
+  region head (`4 running, 2 waiting on you, 4 share the claude login`) and in
+  the tab, which becomes `(2) Leg` with a dotted favicon. Codex, agy and grok
+  publish no such signal, so their rows say `quiet Nm` and never claim to be
+  waiting. `permission_prompt` fires after about six seconds and mostly when
+  you look away, so this is a reliable notice, not an instant one.
+- **A hand-off can now change the model, not just the CLI.** Destinations are
+  rungs of `(agent, account, model)`. The ladder's default is `claude/fable`,
+  `claude/opus`, `claude/sonnet`, then each remaining installed agent, and a
+  terminal's expansion prints it: `now: claude / fable, then claude / opus,
+  then claude / sonnet, then codex, then agy` with `first eligible now:
+  claude / opus` under it. A claude downshift with a known session id starts
+  `claude --resume <id> --model <alias>` and skips the bundle, so the
+  conversation survives the switch; every other rung is primed from the bundle
+  as before. `leg ladder` prints and edits the same thing from a terminal
+  (`ls`, `set <n> <agent>[/<account>[/<model>]]`, `rm <n>`, `spend on|off`),
+  and `leg sessions handoff <id> --to claude/default/opus` names a rung.
+- **The wall is attributed to what it actually walled.** A Fable limit walls
+  Fable, not the login: `walls{}` is keyed by model and `limited_until` is left
+  alone, so `claude/sonnet` keeps working. A session, weekly or spend limit is
+  account scoped, and a same-login model rung is then refused as a wasted
+  switch with the reason on the row. Wording Leg cannot parse walls the whole
+  login and prints the evidence it failed on rather than guessing.
+- **Nothing spends money unless you said it could.** `may_spend` is off. An
+  automatic hand-off skips any rung that bills credits or a metered balance and
+  writes the reason to the ledger; the Settings sentence is *A rung that spends
+  usage credits or metered balance may be taken by an automatic hand-off*, and
+  today it adds *Usage credits are off, so there is nothing to spend through
+  the wall.* rather than offering a dead control. A `reserve` per login holds a
+  floor back from automatic hand-offs only: *An automatic hand-off skips a rung
+  past the floor; a hand-off you press yourself still takes it, and the picker
+  says so.* Climbing back is a radio with the rule printed under it: *Leg never
+  interrupts a running turn to climb.*
+- **Cards are terminals you are not sitting at.** Live cards are rows in a
+  **Background** panel directly under Terminals, in the terminal row's
+  register with a measured work stat and the same button grid; a running card
+  says `no message until this leg ends, started 8:15 PM`, because `-p
+  --output-format json` is mute until the leg exits. Finished cards fall into
+  one ledger line, `10 finished cards, 5 done, 5 failed, last 8:15 PM`, so ten
+  done cards are one row and not ten. Starting one is a single field,
+  `Run in the background:`, over an inferred sentence whose nouns are buttons
+  (*in recruiting-tool on main, with claude/fable then claude/opus then
+  claude/sonnet then codex then agy, build only*); the old thirteen-field
+  dialog is still there as **More settings**.
+- **Two verbs for leaving and coming back.** The End confirm row grows
+  **End, and keep going as a card**: it writes the bundle, hands the
+  terminal's own worktree to a card with its lineage, and says where the work
+  went. On a card, **Take over** pauses it and hands back the one command a
+  browser cannot run, `leg claude --resume-card <id>`, in an interactive
+  terminal primed from the card's bundle.
+- **A time figure, or nothing, and never a time without its sample count.**
+  `burn()` reads a per-bucket history ring and prints a rate only with at least
+  three samples spanning ten minutes inside the current window; the estimate is
+  the endpoint slope, capped at the reset, and a flat or falling line prints
+  nothing at all. Where it can speak, the row and the verdict say *about 2h 40m
+  of Fable left, from 9 samples over 4h*. A reading that comes back unchanged
+  more than ten minutes after the last sample is still recorded, so a flat hour
+  is a measured zero rather than a starved gate.
+
+Fixes:
+
+- **Fixed: the only live Claude wall Leg ever captured was classified as no
+  progress.** The fixture pattern matched `You've hit your Fable limit` and
+  Anthropic now writes `You've reached your Fable limit`, so a real wall on the
+  headless path scored `{outcome: "no_progress", signal: "none"}` and the
+  terminal sat on a dead login. The pattern takes both wordings, and
+  `fixtures/limits/claude/claude-fable-limit.json` is a new `observed-live`
+  fixture produced from the captured response rather than from the docs.
+- **Fixed: the board printed the wrong percentage for a claude login.** The tap
+  kept only `five_hour` and `seven_day` out of the usage response and threw the
+  rest away, so a login whose binding bucket was the Fable week was reported at
+  the account-wide figure. The whole `limits[]` array is now read into
+  `buckets[]`, and the strip, the verdict and the row all print the bucket that
+  will actually stop you.
+- **Fixed: a seeded board's rows were live controls on real repositories.**
+  `scripts/seed-wes-board.mjs` named real paths, and a click on a seeded row
+  cut a worktree in a real checkout. The seed now names `C:\Projects-seed\...`,
+  realistic in shape and impossible in fact. `docs/ERRORS.md` carries the
+  entry.
+
+Migration:
+
+- `preferences.json` keeps `handoff_order` and now derives it from the ladder,
+  so `validHandoffOrder`, `requireHandoffOrder` and every older terminal keep
+  working unchanged. It gains `handoff_ladder` (rungs of `{agent, account,
+  model, when, cost}`), `may_spend` (default `false`), `climb_back` (default
+  `next-handoff`, or `never`), `reserve` (`{agent: percent}`),
+  `notify_terminal` (default `true`) and `notify_board` (default `false`). A
+  bare `handoff_order` expands into one `model: null, when: always` rung per
+  agent, so behaviour is unchanged until you edit a rung.
+- Usage records under `$LEG_HOME/usage/` gain `buckets`, `walls`, `history`,
+  `extra_usage` and `facts`. An older Leg ignores them; a record without them
+  falls back to the two windows it has always had.
+- Session records gain `model`, `waiting` and `ahead`, all nullable. On a
+  shared board all three are dropped from someone else's row (`waiting` carries
+  the verbatim question, `model` and `ahead` describe this machine's usage and
+  someone else's work). Your own terminal is never redacted, so you keep all
+  three on it whichever role you hold.
+- `playwright` is a dev dependency now, so `scripts/board-shots.mjs` runs from
+  a fresh `npm install`. It is not shipped in the package.
+
+Still assumed, and marked as such:
+
+- Whether `codex resume <id> -m <model>` composes. The `resume` subcommand and
+  the `-m` flag are each verified from `codex --help`; putting them together is
+  not. A codex rung therefore ships primed from the bundle, and only the claude
+  rungs claim to keep the conversation.
+- Whether codex, agy and grok leave an OSC 2 terminal title alone once the
+  child starts drawing. That is why naming the terminal tab is not in this
+  release: the browser tab badge needs no such assumption, and ships.
+
+## 0.11.0 (2026-09-17)
+
+- **grok is a card adapter, not just a terminal.** `--chain grok` works. Its
+  flags were read from `grok --help` on grok 1.0.34 (`3736acbc8658`) and its
+  result envelope out of the shipped binary, both on 2026-09-17, replacing the
+  guessed field names the unregistered adapter carried. The prompt now travels
+  by `--prompt-file` (a hand-off prompt carries the whole bundle summary, and
+  Windows caps a command line near 32k) and `--cwd` is passed explicitly,
+  because grok can run against a shared leader process and a leg must edit its
+  own worktree. The probe reached the account and came back with a real wall.
+- **A grok terminal at the wall now hands off.** An exhausted Grok Build
+  account answers `402 Payment Required: Grok Build usage balance exhausted`,
+  and none of the rate-limit strings the tap looked for appear in it. The
+  terminal sat on a dead login instead of moving on. Both the tap
+  (`src/taps/grok.mjs`) and the leg classifier (a new observed-live fixture)
+  now read it as a limit. Found by running the probe against an exhausted
+  account on 2026-09-17.
+- **Any CLI can be a card agent, from a JSON spec and no code.** `leg adapter
+  template --name muse > muse.json`, `leg adapter add muse.json`, then
+  `--chain muse,claude`. `leg adapter check muse` prints the exact command line
+  a leg would run before one does; `leg adapter list|show|rm` are the rest.
+  Placeholders (`{{prompt}}`, `{{promptFile}}`, `{{cwd}}`, `{{mode}}`,
+  `{{model}}`, `{{resume}}`, `{{maxTurns}}`, `{{runDir}}`) fill the argv, and a
+  group in the args is dropped whole when a placeholder inside it is unset, so
+  an absent model never leaves a bare `--model`. The flags that turn a
+  supervised agent into an unsupervised one are refused whatever a spec says.
+  A broken spec is reported by name and reason, never thrown, so one typo
+  cannot stop the board. See [docs/adapters.md](docs/adapters.md#custom-adapters).
+- **Hand off now can name its destination.** The button still takes the next
+  option in the order; Details → **Hand off now to** lists every destination
+  with the reason a greyed one cannot be picked, and `leg sessions handoff
+  <id> --to codex` is the same choice from a terminal. A destination that is
+  not on the chain, not installed, or at its wall is refused at the click with
+  the reset time. If the one you picked walls between the click and the
+  hand-off, the work continues down the order and the terminal says which
+  agent took it instead, rather than going somewhere else in silence.
+- **TLS for a shared board.** `leg share on --tls-cert <file> --tls-key <file>`,
+  or `LEG_TLS_CERT` / `LEG_TLS_KEY`. Leg issues no certificate: a self-signed
+  pair teaches everyone to click through a warning, which is worse than
+  plaintext on a network that is already private, so it takes a pair you have
+  (`tailscale cert <machine>.<tailnet>.ts.net` is one command). Half a pair, a
+  missing file or an empty one stops the board with exit 3 rather than quietly
+  serving plaintext. The loopback companion stays http, because the certificate
+  is for the shared name and that traffic never leaves the machine.
+- **An `operator` role, between owner and guest.** An operator runs the
+  pipeline board — adds, runs, approves, reassigns and kills cards — and their
+  own terminals, and sees nothing that describes this machine: no settings, no
+  home path, no repository paths, no conversation index, no audit. `leg share
+  add dana --role operator`. What each role may reach is decided in one place
+  (`mayUseCards` / `mayUseMachine` in `src/share.mjs`) instead of per endpoint.
+- **An audit trail: who did what, across every terminal and every card.**
+  Settings → **Audit trail** on the board, `GET /api/audit` for a script, owner
+  only. Hand-offs, landings, approvals, reassignments and kills, newest first,
+  each with the person or agent that did it. It reads what the ledger already
+  recorded and stores nothing new, and every answer carries how much it read
+  (`14 terminals and 3 cards, 812 events read`) so an empty trail cannot be
+  mistaken for a quiet week.
+- **Fixed: a guest's own terminal leaked the owner's reset times.** The new
+  hand-off destination list carried the exact reset timestamp of every
+  account, and a guest owns their own terminal, so it reached them through it.
+  A guest and an operator now get the destinations and the coarse reason
+  (`at its usage limit`) without the timestamp. Caught by the share-security
+  suite in the same change.
+- **Fixed: the board slowed down as soon as a custom adapter existed.**
+  `/api/health` asks every adapter where its binary is, and reading the spec
+  directory on each of those calls put a readdir, a read and a JSON parse per
+  spec on the event loop the terminals lane is pushed from. The parsed list is
+  now cached against the directory's entries with a one-second floor, so a
+  spec added or removed is still seen at once.
+
 ## 0.10.0 (2026-09-17)
 
 - **The board is responsive again, `leg` starts straight away, and the board

package/README.md

@@ -11,7 +11,7 @@
 
 *Claude hits the five-hour wall. The terminal reads `handing off to codex`, and codex carries on there. Nothing is retyped. ([the full 53-second run](https://legcli.com/#handoff))*
 
-![The Leg board at 1280px: a headline reading "All 4 terminals are on claude, and claude has 5% left", under it the staleness of the reading; a lit claude panel with its 7 day gauge at 95 percent past the reserve notch and its 5 hour gauge at 38; half panels for codex, at the wall, and agy, which publishes no figure; four terminal rows with their prompts and buttons; and counts for finished terminals, what landed and background tasks](https://legcli.com/img/docs/terminals-1280.png)
+![The Leg board at 1280px: a headline naming the terminal that has waited on you longest; under it a capacity strip with claude at 63 percent of its fable week, codex back on Saturday, agy with no figure and grok with no reading, and a button that opens the login panels; then four terminal rows, each with its status, repo and branch, uncommitted and unpushed counts, agent and model, the prompt, the one thing worth knowing and four buttons; then a Background panel of live cards and a one-line field for starting another; then counts for finished terminals, what landed, conversations and finished cards](https://legcli.com/img/docs/terminals-1280.png)
 
 You keep using your coding agents exactly as you do today, in any terminal,
 from your own config directory: Leg adds its hooks in a separate per-session
@@ -21,11 +21,16 @@ files and regions). `leg claude --model opus` is
 `claude --model opus` with four things running alongside it:
 
 1. **A board.** Opened once in your browser, reused after that. Every Leg
-   session in every terminal is a card on it: agent, account, repo and branch,
-   the task, the files it is touching, its 5h and 7d usage, what has landed on
-   trunk. Two sessions editing the same file in one repo are flagged on both
-   cards, and a second session in a checkout that already has one gets its
-   own worktree and a **Land** button instead of writing over the first.
+   session in every terminal is a row on it, and the row's register reads
+   status, repo on branch, uncommitted and unpushed counts, agent and model,
+   and how long it has been quiet: `waiting on you  baton on main  dirty 3
+   ahead 2  claude/fable`. Under that come the prompt, the one thing worth
+   knowing, the files it is touching and the usage bucket that will stop it.
+   Capacity is one strip at the top rather than a region, with the login
+   panels and their gauges behind **Capacity and models**. Two sessions
+   editing the same file in one repo are flagged on both rows, and a second
+   session in a checkout that already has one gets its own worktree and a
+   **Land** button instead of writing over the first.
 2. **Usage tracking** per agent and account, from what each CLI already
    exposes: Claude Code's usage endpoint and its `StopFailure` hook, Codex's
    read-only app-server rate-limit read, agy's log, and Grok's billing proxy endpoint.
@@ -33,12 +38,18 @@ files and regions). `leg claude --model opus` is
    refreshed as the session goes, so the work is always ready to hand off.
 4. **The handoff itself.** Near the limit you get a warning. At the limit Leg
    saves the bundle, stops the agent, and starts the next option in the same
-   terminal from that bundle: another login of the same agent if you added
-   one, otherwise the next agent in the order shown on the terminal card.
-   The default is claude -> codex -> agy (with grok supported in handoff order),
-   and Settings changes the default for new terminals. Nothing is retyped.
-   When every option is out, it tells you which resets first and when, waits
-   for that reset with a countdown, and starts that agent from the bundle.
+   terminal from that bundle. The options are a ladder of rungs, and a rung is
+   an agent, a login and a model: the default is `claude/fable`,
+   `claude/opus`, `claude/sonnet`, then each remaining installed agent. A
+   Fable limit walls Fable and not the login, so the first move is usually to
+   another model on the same subscription, and for claude that move is
+   `claude --resume <id> --model opus`, which keeps the conversation instead
+   of replaying the bundle. Only when every claude rung is out does it move to
+   another CLI. Settings holds the ladder for new terminals, `leg ladder`
+   edits it from a shell, and **Details** on a row edits the copy that
+   terminal is running. Nothing is retyped. When every rung is out, Leg tells
+   you which resets first and when, waits for that reset with a countdown, and
+   starts that agent from the bundle.
 
 Subscription logins only: Leg strips `ANTHROPIC_API_KEY`,
 `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_CUSTOM_HEADERS`,
@@ -183,21 +194,23 @@ presenting it as current.
    both are stamped with the commit and the live terminals they describe.
    `claude "<prompt>"`, `codex "<prompt>"` and `agy -i "<prompt>"` all open the
    normal interactive session with that first turn.
-5. **Order.** Other accounts of the same agent come first, then every other
-   agent in the saved order, each tried once. The order is a priority list, not
-   a rotation: put agy at the bottom and agy is the last option from a Claude
-   terminal and from a Codex terminal alike. The board shows the exact
-   sequence with the agent running now skipped, plus the preferred option and
-   the first option eligible from current install and limit state. Use **Change
-   order** on a terminal card to change that terminal, or Settings to set the
-   default copied by new terminals. An option whose CLI is missing or whose
-   wall has not reset is skipped.
+5. **The ladder.** A rung is an agent, a login and a model, and Leg walks from
+   rung 1 every time. Other models on the same login come first, then other
+   accounts of the same agent, then every other agent in the saved order, each
+   tried once. It is a priority list, not a rotation: put agy at the bottom and
+   agy is the last rung from a Claude terminal and from a Codex terminal alike.
+   The board prints the exact sequence with the rung running now marked, plus
+   the first rung eligible from current install and limit state. Use **Change
+   the ladder** in a terminal's expansion to change that terminal, `leg ladder`
+   to do it from a shell, or Settings to set the default copied by new
+   terminals. A rung whose CLI is missing, whose wall has not reset, or that
+   shares the window that is already out, is skipped with its reason.
 6. **All out.** The terminal prints each option with its reset time, soonest
    first, then stays open with a countdown to the first reset and starts that
-   agent from the bundle when it arrives. The card says `waiting for <agent>
-   at <time>`. Ctrl-C (or End on the card) quits with exit 3 instead.
+   agent from the bundle when it arrives. The row says `waiting for <agent>
+   at <time>`. Ctrl-C (or End on the row) quits with exit 3 instead.
 
-You can force a handoff any time: the **Hand off now** button on the card, or
+You can force a handoff any time: the **Hand off now** button on the row, or
 `leg sessions handoff <id>`. Verified on this machine: `leg claude` opened
 the real Claude Code TUI with Leg's hooks firing into the session log, the
 usage poll recorded 36 % of the 5h window and 74 % of the 7d window, the
@@ -216,10 +229,12 @@ row flipped to observed-live (`node scripts/live-limits.mjs`). The same
 capture is wired for codex `usage_limit_exceeded` and agy `RESOURCE_EXHAUSTED`;
 no payload for either has been kept yet.
 
-Terminals started by this version can change order while they run. An older
-terminal stays on the order it started with; its card says a restart is needed
-and can save the desired default for the next launch. A normal agent exit ends
-the terminal. It does not trigger a handoff.
+Terminals started by this version can change their ladder while they run:
+Settings holds the default for new terminals, and **Details** on a row edits
+the copy that terminal is running. An older terminal stays on the order it
+started with; its row says a restart is needed and can save the desired
+default for the next launch. A normal agent exit ends the terminal. It does
+not trigger a handoff.
 
 ### The working environment travels too (optional)
 
@@ -275,12 +290,21 @@ token at all.
 
 ```
 leg share on              your own link, printed once
-leg share add sam         sam's link, printed once
+leg share add sam         sam's link, printed once (a guest)
+leg share add dana --role operator    dana runs cards, not this machine
 leg share                 who is on the board (never a token again)
 leg share rotate sam      sam's old link stops working
 leg share off             back to 127.0.0.1; every link stops working
 ```
 
+There are three roles. **owner** is everything: the machine's settings, the
+harness, every terminal, the cards, the history index and the audit trail.
+**operator** is the pipeline board and their own terminals: they add, run,
+approve, reassign and kill cards, and they never see this machine's settings,
+its home path, its repository paths, its conversation index or the audit.
+**guest** is the terminals lane, read-only and redacted, with **Request
+handoff** as their only button.
+
 A token is kept as a sha256 hash, so a lost link is re-issued, never re-read.
 The board takes the token out of the address bar and keeps it in the browser.
 Your own browser on this machine needs no token.
@@ -301,32 +325,68 @@ The security pass that goes with it: every `/api` route needs a token, the
 event stream included; twenty wrong tokens from one address and that address
 waits a minute; one identity gets 600 requests a minute; a guest gets 403 on
 everything that is not theirs; and the tests send a bad and a missing token to
-every route. There is still no TLS, so keep this on Tailscale or a network you
-trust. Verified live on 2026-09-11: two terminals on one machine, one wes's and
+every route. Verified live on 2026-09-11: two terminals on one machine, one wes's and
 one sam's; sam's board showed wes's card with the prompt hidden and only
 **Request handoff**, and sam's request reached wes's board (`~/.leg/board.log`:
 "hand-off requested … by sam").
 
+### TLS
+
+Off unless you hand it a certificate. Leg does not issue one: a self-signed
+pair teaches everyone on the board to click through a warning, which is worse
+than plaintext on a network that is already private. On Tailscale the pair is
+one command:
+
+```
+tailscale cert <machine>.<tailnet>.ts.net
+leg share on --tls-cert <machine>.<tailnet>.ts.net.crt --tls-key <machine>.<tailnet>.ts.net.key
+```
+
+`LEG_TLS_CERT` and `LEG_TLS_KEY` do the same without writing the paths into
+`share.json`, and they win over it. With a pair configured the shared address
+serves https and every printed link says `https://`; the companion listener on
+`127.0.0.1`, which exists so this machine's own browser needs no token, stays
+plain http, because the certificate is for the shared name and loopback traffic
+never leaves the machine. A pair that is half-configured, missing, unreadable
+or empty stops the board with exit 3 rather than quietly serving plaintext.
+Renew the pair, then `leg down && leg up` to pick it up.
+
+### Who did what
+
+Settings → **Audit trail** is one list across every terminal and every card,
+newest first: hand-offs, landings, approvals, reassignments, kills, each with
+the person or agent that did it, the repo and the time. Filter by person or by
+kind. It reads what the ledger already recorded, so nothing new is stored, and
+it prints how much it read beside the answer (`14 terminals and 3 cards, 812
+events read`) so an empty trail cannot be mistaken for a quiet week. Owner
+only: the trail names repositories and people.
+
 ## The board
 
 `leg <agent>` opens it; `leg open` reopens it; `leg down` stops it.
 
-- **Instrument head**: one row per login, sticky at the top of the board and of
-  the floor. Each row carries the 5h and 7d rails, the percentage, when that
-  window resets and how long that is, a burn-rate sentence under the 5h rail,
-  where and when Leg read the number, and one word for the state: `under 60`,
-  `over 60`, `over 85`, `stale <n>m`, `at the wall` or `no reading`. A login
-  at its wall keeps both rails and gains `at the wall`, `back <day time>` and
-  `in <duration>` beside them.
-- **Terminals**: one full-width panel per session, the ones that need an answer
-  first. Agent and session tail, the status word, the first prompt as a button,
-  exactly one sentence (the highest-ranked thing true about the terminal), an
-  `also:` disclosure naming the rest, the files as comma-separated text,
-  `repo@branch`, `own worktree, from main` when the session cut its own
-  worktree, and an elapsed clock. Two live sessions in one repo touching the
-  same file print `codex (codex-99ab) is changing src/server.mjs in another
-  checkout; whoever lands second rebases` on both panels, and a panel that needs
-  you rises one step and says `waiting on you` in place of its status word.
+- **Verdict and capacity strip**: the largest sentence on the page, then one
+  strip with a token per login carrying the binding bucket, a short track, the
+  percentage and one state word or clock: `claude 63% 6:01 PM`, `codex back
+  Sat 10:11 PM`, `agy no figure`, `grok no reading`. **Capacity and models**
+  opens a drawer holding the full login panels: the 5h and 7d rails, the reset
+  and how long that is, where and when Leg read the number, `at the wall` with
+  its `back <day time>`, and on the claude panel a rail of model chips
+  (`fable 63%`, `opus 12%`, a walled one saying `out until 9:14 PM`). The
+  sticky instrument head is still what `/floor` puts at the top.
+- **Terminals**: one full-width row per session, the ones that need an answer
+  first. The register reads the status word, `repo on branch`, `dirty <n>` and
+  `ahead <n>`, `agent/model`, `quiet <n>m`, and `own worktree, from main` when
+  the session cut its own worktree; then the first prompt as a
+  button, exactly one sentence (the highest-ranked thing true about the
+  terminal), an `also:` disclosure naming the rest, the files as
+  comma-separated text, the binding bucket as `63% of the fable week`, and an
+  elapsed clock with the session tail. Two live sessions in one repo touching
+  the same file print `codex (codex-99ab) is changing src/server.mjs in
+  another checkout; whoever lands second rebases` on both rows. A Claude row
+  parked at a permission or idle prompt rises to the top, says `waiting on
+  you` in place of its status word, prints the question verbatim, and puts a
+  count in the browser tab (`(2) Leg`, with a dot on the favicon).
   After a Land the sentence is `landed on <base>, <7-char sha>, <n> files,
   +<added>/-<removed>`, or `Land was attempted at <time> onto <base> and
   bounced: <first line of the reason>. The branch still holds every commit;
@@ -337,14 +397,24 @@ one sam's; sam's board showed wes's card with the prompt hidden and only
 - **Buttons**, in a fixed order that never reflows: Land, Hand off now,
   Details, End. Once a session has ended, Remove and Remove record take End's
   place. Details opens an expansion in flow under the panel.
+  **Hand off now** takes the first open rung of the ladder. To name the
+  destination instead, open Details and use **Hand off now to**, which lists
+  every rung with its model, whether it keeps the conversation, and the reason
+  a greyed one cannot be picked (`at its usage limit, back 11:40`, `shares the
+  window that is out, buys nothing`, `not installed on this machine`).
+  `leg sessions handoff <id> --to claude/default/opus` is the same choice from
+  a terminal. If the rung you picked walls between the click and the hand-off,
+  the work still continues down the ladder and the terminal says which one
+  took it instead.
 - Below it, **Conversations**: every coding-agent conversation on this machine
   as a count that opens, the ones Leg started and the ones Claude Code, Codex,
   Grok, Antigravity and Copilot keep in their own stores. Filter by agent,
   search, repository, or only what Leg started; a row opens its last messages
   in place, with the `leg history continue` command to copy where the agent
   can resume by id. The same drawer lists every checkout Leg can see. Then
-  optional **Background tasks** an agent runs in a separate worktree without
-  joining the terminal conversation (see below), then **Settings**.
+  **Settings**. Background tasks are not down here: a live card is a row in
+  the **Background** panel directly under Terminals (see below), and only the
+  finished ones collapse into a ledger line beside these counts.
 
 The board reads `~/.leg/sessions/*/session.json` over server-sent events; a
 session whose runner process is gone is marked `lost`, never shown as live.
@@ -460,6 +530,7 @@ leg claude|codex|agy|grok [agent args…] the interactive agent, board alongside
 leg sessions ls [--json]             every session and its usage
 leg sessions show|events <id>
 leg sessions handoff|end <id>        same as the board buttons
+leg sessions handoff <id> --to <agent>[/<account>]   hand off to a destination you name
 leg sessions rm <id>                 forget an ended session
 leg sessions simulate-limit <id>     the real limit path without a real wall (claude, agy, grok)
 leg history [ls] [--provider p] [--repo r] [--search q] [--managed|--external] [--live] [--all] [--json]
@@ -474,9 +545,12 @@ leg harness sync [--to codex,agy] [--force] [--dry-run] | diff <client> | doctor
 leg harness capture [claude|codex] | source <client> | policy <mode> | disable
 leg license                          the license on this machine, or where to buy one
 leg license activate <key> | deactivate | refresh   (refresh renews a Team key)
+leg adapter list|show <n>|check <n>  every adapter, built-in and custom
+leg adapter template [--name n]      a starter spec to fill in
+leg adapter add <file.json> | rm <n> any CLI as a card agent, from JSON
 leg share                            who is on the board (off by default; Team plan)
-leg share on [--bind tailscale|lan|<addr>] [--port N] | off
-leg share add|rotate|rm <name>       one link per human, printed once
+leg share on [--bind tailscale|lan|<addr>] [--port N] [--tls-cert <f> --tls-key <f>] | off
+leg share add|rotate|rm <name> [--role owner|operator|guest]   one link per human, printed once
 leg open | down | status             the board
 leg uninstall [--yes]
 ```
@@ -488,24 +562,32 @@ open the browser), `LEG_USAGE_POLL_MS` (60000), `LEG_CLAUDE_ARGS` /
 `LEG_CODEX_ARGS` / `LEG_AGY_ARGS` / `LEG_GROK_ARGS` (extra args for a leg Leg starts after
 a hand-off, e.g. `-m gpt-5.3-codex-spark`), `LEG_CLAUDE_BIN`,
 `LEG_CODEX_BIN`, `LEG_AGY_BIN`, `LEG_GROK_BIN`, `LEG_CHB_BIN`, `LEG_PERSON` (whose
-terminal this is when the board is shared), `LEG_RATE_MAX` (600 requests a
-minute per human) and `LEG_RATE_MAX_FAILURES` (20 wrong tokens per address).
+terminal this is when the board is shared), `LEG_TLS_CERT` / `LEG_TLS_KEY`
+(serve the shared board over https; they win over `share.json`),
+`LEG_RATE_MAX` (600 requests a minute per human) and `LEG_RATE_MAX_FAILURES`
+(20 wrong tokens per address).
 
 ## Background tasks: the v0.1 extras
 
 Version 0.1 was the other way round: you dropped a task card on the board and
 Leg ran the agents headless in a git worktree, one per card, with a fallback
-chain, path leases, a scheduler and a merge queue. All of that still works and
-lives below the terminals lane, but it is no longer the way in.
-
-The New background card form starts with a repo, task, and real first agent.
-**Run now** queues it; turning that off saves a draft in Backlog. The default
-**Build only** workflow stops with its changes in the card's worktree and does
-not merge them. The Advanced **Build, test, and merge** and **Factory**
-workflows include an automatic land station; their labels say so before you
-choose them. Fallback agents, permissions, approval gates, turn caps, leases,
-trunk, merge method, tests, title, and scripted test/demo adapters are also
-under Advanced options.
+chain, path leases, a scheduler and a merge queue. All of that still runs, and
+a card is now a terminal you are not sitting at: same register, same one
+sentence, same ladder, same bundle. Live cards are rows in the **Background**
+panel directly under Terminals; finished ones fall into one ledger line that
+opens.
+
+Starting one is a single field. `Run in the background:` takes the task, and
+the sentence under it is inferred with its nouns as buttons: the repo of the
+terminal you were last in, the saved ladder, and the `build` workflow, which
+stops with its changes in the card's worktree and does not merge them.
+**More settings** is the full form, with the **Build, test, and merge** and
+**Factory** workflows that include an automatic land station, plus fallback
+agents, permissions, approval gates, turn caps, leases, trunk, merge method,
+tests, title, and scripted test and demo adapters. **End, and keep going as a
+card** on a terminal's End row makes a card out of the work in front of you;
+**Take over** on a card gives you the command that turns it back into a
+terminal.
 
 - `leg up` boots the board with the scheduler and merge queue and streams
   redacted logs; `leg card add --repo <path> --task "<t>" --chain claude,codex --queue`
@@ -514,8 +596,17 @@ under Advanced options.
 - Adapters spawn the CLIs headless as argv, never through a shell, with their
   own permission modes and never a bypass flag: `claude -p --output-format json
   --permission-mode <m>`, `codex exec --json -s <m> -C <worktree>`,
-  `agy -p --output-format json --mode <m> --add-dir <worktree>`; `fake`,
-  `fake-claude`, `fake-codex`, `fake-agy` for tests and demos.
+  `agy -p --output-format json --mode <m> --add-dir <worktree>`,
+  `grok --prompt-file <f> --output-format json --permission-mode <m> --cwd
+  <worktree>`; `fake`, `fake-claude`, `fake-codex`, `fake-agy` for tests and
+  demos.
+- **Any other CLI** is a card adapter too, from a JSON spec and no code:
+  `leg adapter template --name muse > muse.json`, fill in the command and its
+  flags, `leg adapter add muse.json`, then `--chain muse,claude`. `leg adapter
+  check muse` prints the exact command line a leg would run before one does.
+  See [docs/adapters.md](docs/adapters.md#custom-adapters). A custom adapter
+  runs cards; it is not an interactive `leg <agent>` terminal, because that
+  needs a usage tap and a wall signal, which only the four above expose.
 - A leg that ends on a limit signal, a stall, a crash or exit 0 without
   `.leg/DONE` hands off with a bundle to the next adapter in the same
   worktree; a `land` station rebases, tests and fast-forwards trunk or bounces
@@ -623,7 +714,7 @@ Leg is commercial software under the [Leg License Agreement](LICENSE).
 It ships as readable JavaScript so you can see what it does on your machine,
 and you may modify it for your own use, but not redistribute it or work
 around the license check. Versions 0.2.0 and 0.3.0 were published under MIT
-and remain available. The version in this source tree is 0.8.0; see
+and remain available. The version in this source tree is 0.12.0; see
 [npm](https://www.npmjs.com/package/legcli) for published versions and
 [CHANGELOG.md](CHANGELOG.md) for release notes.