atris 3.27.0 → 3.29.0

package/AGENTS.md

@@ -110,7 +110,7 @@ member -> mission start --verify -> status --status active -> one bounded step -
 - [ ] Only use `atris task accept <id>` when the human has approved the proof
 - [ ] Keep durable learning in Atris-owned policy/skill/wiki/task state; keep `AGENTS.md` as a generated/pointer layer
 - [ ] Treat `atris/TODO.md` as a rendered view; do not manually use it as the source of truth
-- [ ] Use `atris-labs` for the Atris Labs business computer slug in docs and links
+- [ ] Use the real business slug from local Atris state; do not hardcode private slugs in generated docs
 
 ## Anti-patterns
 
@@ -136,12 +136,10 @@ Load these first:
 - `atris/now.md`
 - `atris/brain/STATUS.md`
 - `atris/brain/self_improvement_ledger.md`
-- `atris/wiki/concepts/agent-activation-contract.md`
 - `atris/skills/atris/SKILL.md`
 - `atris/PERSONA.md`
 - `atris/MAP.md`
 - `atris/TODO.md`
-- `atris/wiki/index.md`
 
 First-message rule: lead with the move before writing to the operator.
 Purpose: optimize for decision-speed; lead with the move, then use descriptions only when they help the operator act.

package/README.md

@@ -10,7 +10,7 @@ Owner has many Computers
 Computer = workspace + files + tools + secrets + memory + agents + validation loop
 ```
 
-A computer can be personal or shared by a business. It can run a job like code, research, CRM, reporting, recruiting, event ops, support, or business ops.
+A computer can be personal or shared by a business. It can run a job like code, research, CRM, reporting, event ops, support, or business ops.
 
 ## For Coding Agents
 
@@ -142,9 +142,9 @@ leaderboard.
 If you want a shared owner for a company, lab, collective, community, artist, team, or project, use the business command instead of raw `atris init`.
 
 ```bash
-atris business init "BLOND:ISH" --owner-email joel@blondish.world
-cd ~/arena/atris-business/blondish
-atris business onboard --website https://blondish.world --contact "Joel Zimmerman" --note "artist-led brand and ticket sales"
+atris business init "Example Co" --owner-email operator@example.com
+cd ~/arena/atris-business/example-co
+atris business onboard --website https://example.com --contact "Example Owner" --note "sample customer workspace"
 atris align --fix
 ```
 
@@ -166,7 +166,7 @@ You can also use bare input:
 atris business onboard https://example.com "founder-led b2b ops" ./notes.md
 ```
 
-If you already have a folder full of source material, run it from there with `atris business init "BLOND:ISH" --here`.
+If you already have a folder full of source material, run it from there with `atris business init "Example Co" --here`.
 
 When the first recap is done, record it into the RL state logs:
 

package/atris/features/company-brain-sync/build.md

@@ -2,9 +2,9 @@
 
 ## Current Patch
 
-The immediate DoorDash lane now follows the correct company-brain model:
+The immediate Example Co lane now follows the correct company-brain model:
 
-- `atris push` keeps the business root as the path root so `doordash/atris/MAP.md` maps to cloud `/atris/MAP.md`
+- `atris push` keeps the business root as the path root so `example-co/atris/MAP.md` maps to cloud `/atris/MAP.md`
 - business `pull` and `push` default to the `atris/` scope
 - root-level duplicates such as `MAP.md`, `TODO.md`, and `security-report.md` are ignored by default
 - manifests record the local workspace root to prevent a manifest from one folder authorizing pushes from another folder
@@ -114,7 +114,7 @@ Later it should also let the user ask Atris to merge semantically with model ass
 
 `atris sync --watch` is the current always-on lane:
 
-- watch `doordash/atris/`
+- watch `example-co/atris/`
 - debounce local edits
 - fetch cloud hashes periodically
 - sync clean changes
@@ -136,5 +136,5 @@ Required before broad customer use:
 - retry-policy tests proving watch failures do not kill the alive loop
 - fixture tests proving parent-folder junk is ignored
 - fixture tests proving no cloud deletes without explicit opt-in
-- end-to-end dry-run against a real DoorDash-shaped workspace
+- end-to-end dry-run against a real Example Co-shaped workspace
 - command copy that never recommends `--force` for normal use

package/atris/features/company-brain-sync/idea.md

@@ -2,7 +2,7 @@
 
 ## Problem
 
-Atris business workspaces are company brains, not plain folders. The canonical knowledge surface is the `atris/` folder inside each business workspace, for example `doordash/atris/`.
+Atris business workspaces are company brains, not plain folders. The canonical knowledge surface is the `atris/` folder inside each business workspace, for example `example-co/atris/`.
 
 Raw push/pull is the wrong abstraction for this surface. It makes a shared knowledge base feel like file mirroring, which creates merge anxiety and makes users responsible for sync safety.
 
@@ -19,7 +19,7 @@ Cloud Atris is canonical. Local Atris is a working copy. Sync publishes proposed
 
 ## User Model
 
-Jonathan should be able to work inside `doordash/atris/` and run one command:
+Jonathan should be able to work inside `example-co/atris/` and run one command:
 
 ```bash
 atris sync

package/atris/features/company-brain-sync/validate.md

@@ -51,47 +51,47 @@ node -c commands/pull.js
 node -c commands/push.js
 ```
 
-Fresh DoorDash-shaped workspace dry-run:
+Fresh Example Co-shaped workspace dry-run:
 
 ```bash
-atris sync doordash --dry-run
+atris sync example-co --dry-run
 ```
 
 Observed result:
 
 ```text
-Syncing doordash knowledge wiki...
+Syncing example-co knowledge wiki...
 scope: atris/
 ...
-Pushing to DoorDash...
+Pushing to Example Co...
 Checking cloud freshness... fresh
 Already up to date.
 ```
 
-Fresh DoorDash-shaped workspace real command with no local edits:
+Fresh Example Co-shaped workspace real command with no local edits:
 
 ```bash
-atris sync doordash
+atris sync example-co
 ```
 
 Observed result:
 
 ```text
-Pulling DoorDash...
+Pulling Example Co...
 Already up to date.
 122 unchanged.
-Pushing to DoorDash...
+Pushing to Example Co...
 Checking cloud freshness... fresh
 Already up to date.
 ```
 
 No cloud writes were required in the validation case because the clean workspace had no local changes to publish.
 
-Local edit dry-run in a DoorDash-shaped workspace:
+Local edit dry-run in an Example Co-shaped workspace:
 
 ```bash
 printf '# Sync smoke\n\nLocal-only knowledge update.\n' > atris/wiki/smoke/local-edit.md
-atris sync doordash --dry-run
+atris sync example-co --dry-run
 ```
 
 Observed result:
@@ -101,11 +101,11 @@ Observed result:
 1 would be pushed, 122 unchanged. (--dry-run, nothing sent)
 ```
 
-Local delete dry-run in a DoorDash-shaped workspace:
+Local delete dry-run in an Example Co-shaped workspace:
 
 ```bash
 rm -f atris/wiki/index.md
-atris sync doordash --dry-run
+atris sync example-co --dry-run
 ```
 
 Observed result:
@@ -118,7 +118,7 @@ Deletes require an explicit real push with --delete.
 Real delete attempt without `--delete`:
 
 ```bash
-atris sync doordash
+atris sync example-co
 ```
 
 Observed result:
@@ -148,10 +148,10 @@ Slug auto-detection:
 atris sync --dry-run
 ```
 
-Observed result from a DoorDash-shaped workspace:
+Observed result from an Example Co-shaped workspace:
 
 ```text
-Syncing doordash knowledge wiki...
+Syncing example-co knowledge wiki...
 scope: atris/
 ```
 
@@ -165,7 +165,7 @@ Observed shape:
 
 ```text
 Company brain status
-  business: doordash
+  business: example-co
   brain: atris/ (...)
   conflicts: none
   watcher: ...
@@ -218,12 +218,12 @@ atris pull example-co --keep-local --only atris/wiki --timeout 120
 atris push example-co --only atris/wiki --dry-run
 ```
 
-- DoorDash post-publish smoke:
+- Example Co post-publish smoke:
 
 ```bash
-cd ~/arena/atris-business/doordash
+cd ~/arena/atris-business/example-co
 atris wiki verify
-atris push doordash --dry-run
+atris push example-co --dry-run
 ```
 
 - Packaged CLI smoke already passed locally for `3.15.12`: tarball install exposes `atris pull --no-manifest` and `atris wiki verify`.

package/atris/skills/aeo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: aeo
 description: "AI Engine Optimization — write content engineered to get cited by ChatGPT, Claude, and Gemini. Not SEO. Triggers on: aeo, AI engine, llm citation, get cited, write for ai."
-when_to_use: "Use when the user wants content that ranks in AI answers (not Google SERP). Examples: 'write an AEO page', 'get ExampleCo cited by ChatGPT', 'aeo for our recruiting page', 'make this quotable by LLMs'."
+when_to_use: "Use when the user wants content that ranks in AI answers (not Google SERP). Examples: 'write an AEO page', 'get ExampleCo cited by ChatGPT', 'aeo for our pricing page', 'make this quotable by LLMs'."
 version: 0.1.0
 allowed-tools: Read, Write, Edit, Glob, Grep, Bash
 tags:

package/atris/skills/autopilot/SKILL.md

@@ -20,8 +20,8 @@ Every tick prints this BEFORE scanning for work, so you can see the loop's state
   ┌──────────────────────────────────────────────────────────────┐
   │ tick · 14:23                                                 │
   │ identity:  building atris-business cloud for design partners │
-  │ horizon:   wiki-from-atris-labs                              │
-  │            atris-cli wiki has 3 new pages from atris-labs    │
+  │ horizon:   customer-onboarding                               │
+  │            three setup checks are ready to ship               │
   │ progress:  ████████░░░░  6/9 endgame steps                   │
   └──────────────────────────────────────────────────────────────┘
 ```

package/atris/skills/slides/SKILL.md

@@ -121,7 +121,7 @@ curl -s -X POST "https://api.atris.ai/api/integrations/google-slides/presentatio
     {
       "insertText": {
         "objectId": "subtitleId",
-        "text": "Atris Labs - Confidential"
+        "text": "{{company_name}} - Confidential"
       }
     }
   ]
@@ -207,7 +207,7 @@ curl -s -X POST "https://api.atris.ai/api/integrations/google-slides/presentatio
     {
       "replaceAllText": {
         "containsText": {"text": "{{company_name}}"},
-        "replaceText": "Atris Labs"
+        "replaceText": "Example Co"
       }
     }
   ]

package/bin/atris.js

@@ -345,7 +345,7 @@ function showHelp() {
   console.log('Atris Computers:');
   console.log('  Owner = User | Business');
   console.log('  Owners have Computers: workspace + files + tools + secrets + memory + agents + validation');
-  console.log('  Types: code, research, CRM, reporting, recruiting, events, support, business ops');
+  console.log('  Types: code, research, CRM, reporting, events, support, business ops');
   console.log('');
   console.log('Setup:');
   console.log('  setup      - Guided first-time setup (login, pick business, pull)');
@@ -823,7 +823,7 @@ if (command === '2' && ['fast', 'pro'].includes(String(firstCommandArg || '').to
 const knownCommands = ['init', 'log', 'now', 'radar', 'ctop', 'status', 'analytics', 'visualize', 'brain', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'verify', 'search', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'plugin', 'experiments', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube',
-                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'probe', 'worktree', 'aeo', 'slop', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'xp', 'play', 'gm', 'x', 'recap', 'signup', 'clarity', 'moves',
+                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'probe', 'worktree', 'aeo', 'slop', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'xp', 'play', 'gm', 'x', 'recap', 'signup', 'clarity', 'moves',
                        'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'compile', 'spaceship'];
 
@@ -2061,6 +2061,27 @@ if (command === 'init') {
   Promise.resolve(require('../commands/slop').slopCommand(process.argv.slice(3)))
     .then((code) => process.exit(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'security-review' || command === 'secure') {
+  // Security review: deterministic secrets/PII/code-risk scan (no LLM). Exit 1 = HIGH finding,
+  // for the autopilot/mission/CI gate + a SOC 2 evidence artifact via --json.
+  Promise.resolve(require('../commands/security-review').securityReviewCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'signup') {
+  // Signup: one-call seedless agent signup → writes the active profile (install→signup→play seam).
+  Promise.resolve(require('../commands/signup').signupCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'moves') {
+  // Moves: your 3 next moves — approve one into the loop, kill, or skip.
+  Promise.resolve(require('../commands/moves').movesCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
+} else if (command === 'clarity') {
+  // Clarity: interview yourself once; agents read how you work so you stop repeating it.
+  Promise.resolve(require('../commands/clarity').clarityCommand(process.argv.slice(3)))
+    .then((code) => process.exit(typeof code === 'number' ? code : 0))
+    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'deck') {
   // Deck: premium Google Slides from a plain content spec, via the Atris deck engine (anti-slop design system).
   Promise.resolve(require('../commands/deck').run(process.argv.slice(3)))
@@ -2086,22 +2107,6 @@ if (command === 'init') {
   Promise.resolve(require('../commands/reel').run(process.argv.slice(3)))
     .then((code) => process.exit(typeof code === 'number' ? code : 0))
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
-} else if (command === 'signup') {
-  // Signup: one-call seedless agent signup (POST /auth/agent/signup) → writes the
-  // active profile so `atris play` works next. The install→signup→play seam.
-  Promise.resolve(require('../commands/signup').signupCommand(process.argv.slice(3)))
-    .then((code) => process.exit(typeof code === 'number' ? code : 0))
-    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
-} else if (command === 'moves') {
-  // Moves: your 3 next moves — approve one into the loop, kill, or skip.
-  Promise.resolve(require('../commands/moves').movesCommand(process.argv.slice(3)))
-    .then((code) => process.exit(typeof code === 'number' ? code : 0))
-    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
-} else if (command === 'clarity') {
-  // Clarity: interview yourself once; agents read how you work so you stop repeating it.
-  Promise.resolve(require('../commands/clarity').clarityCommand(process.argv.slice(3)))
-    .then((code) => process.exit(typeof code === 'number' ? code : 0))
-    .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'receipt' || command === 'proof' || command === 'openclaw') {
   const subcommand = process.argv[3];
   const args = process.argv.slice(4);

package/commands/aeo.js

@@ -173,7 +173,7 @@ function printHelp() {
   console.log('');
   console.log('Examples:');
   console.log('  atris aeo log --engine perplexity --limit 5');
-  console.log('  atris aeo packet pallet');
+  console.log('  atris aeo packet <slug>');
   console.log('  atris aeo status');
   console.log('  atris aeo discover https://atris.ai/aeo --canonical-url https://atris.ai/aeo');
 }

package/commands/autopilot.js

@@ -42,7 +42,7 @@ function looksOwnerGatedTitle(title) {
     /\bhuman[- ](?:approval|input|gate|gated)\b/.test(text) ||
     /\bmanual send\b/.test(text) ||
     /\broute confirmation\b/.test(text) ||
-    /\bconfirm pallet destination\b/.test(text) ||
+    /\bconfirm customer destination\b/.test(text) ||
     /\bconfirm .+ destination before .+ approval\b/.test(text) ||
     /\bapprove and manually send\b/.test(text)
   );

package/commands/computer.js

@@ -1601,8 +1601,8 @@ async function computerCreate(token, args = [], defaults = {}) {
     console.log('Create a business computer, activate it, and wake it in one command.');
     console.log('');
     console.log('Examples:');
-    console.log('  atris computer create "My Business Computer" --business atris-labs');
-    console.log('  atris computer create "Recruiting Computer"');
+    console.log('  atris computer create "My Business Computer" --business <business>');
+    console.log('  atris computer create "Support Computer"');
     if (!options.name && !options.help) process.exitCode = 1;
     return;
   }
@@ -1810,8 +1810,8 @@ async function computerDelete(token, ctx, options = {}, args = []) {
     console.log('Sleeps the computer first, then deletes the non-default workspace after confirmation.');
     console.log('');
     console.log('Examples:');
-    console.log('  atris computer delete --business atris-labs --workspace ws_123');
-    console.log('  atris computer delete --business atris-labs --workspace ws_123 --confirm "delete ws_123"');
+    console.log('  atris computer delete --business <business> --workspace ws_123');
+    console.log('  atris computer delete --business <business> --workspace ws_123 --confirm "delete ws_123"');
     return;
   }
 
@@ -3291,7 +3291,7 @@ async function runComputer() {
     console.log('  Owner has many Computers');
     console.log('  Computer = workspace + files + tools + secrets + memory + agents + validation');
     console.log('');
-    console.log('Common types: codeops, research, CRM, reporting, recruiting, event ops, support, business ops.');
+    console.log('Common types: codeops, research, CRM, reporting, event ops, support, business ops.');
     console.log('A business can be a company, lab, collective, community, artist, team, or project.');
     console.log('');
     console.log('First use:');
@@ -3342,10 +3342,10 @@ async function runComputer() {
     console.log('  atris computer');
     console.log('  atris computer card --write');
     console.log('  atris business init "My Lab"     # first/default computer with Atris + operator');
-    console.log('  atris computer create "Recruiting Computer" --business atris-labs');
-    console.log('  atris computer --business atris-labs --workspace <workspace-id>');
-    console.log('  atris computer sleep --business atris-labs --workspace <workspace-id>');
-    console.log('  atris computer delete --business atris-labs --workspace <workspace-id>');
+    console.log('  atris computer create "Support Computer" --business <business>');
+    console.log('  atris computer --business <business> --workspace <workspace-id>');
+    console.log('  atris computer sleep --business <business> --workspace <workspace-id>');
+    console.log('  atris computer delete --business <business> --workspace <workspace-id>');
     console.log('  atris computer proof');
     console.log('  atris computer local');
     console.log('  atris computer codex');

package/commands/feedback.js

@@ -231,7 +231,7 @@ function printHelp(write = console.log) {
   write('  atris feedback delete <id>             Delete feedback (admin)');
   write('');
   write('IDs may be the first 8 chars of the UUID.');
-  write('Business slugs come from ~/.atris/businesses.json (e.g. acme, atris-labs).');
+  write('Business slugs come from ~/.atris/businesses.json.');
   write('');
 }
 

package/commands/init.js

@@ -257,7 +257,7 @@ function initAtris() {
   }
   // GUARD: Refuse nested init.
   // Bug: running `atris init` inside an existing `atris/` folder creates
-  // `atris/atris/` nesting hell. Cloud doordash had this exact problem.
+  // `atris/atris/` nesting hell. A cloud business workspace had this exact problem.
   // Fix: detect three nesting conditions and refuse with a clear error.
   const cwd = process.cwd();
   const cwdBase = path.basename(cwd);
@@ -705,7 +705,7 @@ member -> mission start --verify -> status --status active -> one bounded step -
 - [ ] Only use \`atris task accept <id>\` when the human has approved the proof
 - [ ] Keep durable learning in Atris-owned policy/skill/wiki/task state; keep \`AGENTS.md\` as a generated/pointer layer
 - [ ] Treat \`atris/TODO.md\` as a rendered view; do not manually use it as the source of truth
-- [ ] Use \`atris-labs\` for the Atris Labs business computer slug in docs and links
+- [ ] Use the real business slug from local Atris state; do not hardcode private slugs in generated docs
 
 ## Anti-patterns
 

package/commands/live.js

@@ -101,10 +101,10 @@ function printLiveHelp() {
   console.log('Keeps a business brain fresh: doctor, pull, watch local changes, push after quiet, and periodically pull.');
   console.log('');
   console.log('Examples:');
-  console.log('  atris live atris-labs');
+  console.log('  atris live <business>');
   console.log('  atris live --once');
-  console.log('  atris live atris-labs --dry-run');
-  console.log('  atris live atris-labs --interval=120 --debounce=30');
+  console.log('  atris live <business> --dry-run');
+  console.log('  atris live <business> --interval=120 --debounce=30');
   console.log('');
   console.log('Options:');
   console.log('  --once             Run one freshness cycle and exit');

package/commands/plugin.js

@@ -46,7 +46,7 @@ function generateManifest(skills, projectDir) {
     version: pkg.version || '1.0.0',
     description: `Atris workspace skills for Cowork — ${skills.length} integrations (email, calendar, slack, drive, notion, and more)`,
     author: {
-      name: typeof pkg.author === 'string' ? pkg.author : (pkg.author?.name || 'Atris Labs')
+      name: typeof pkg.author === 'string' ? pkg.author : (pkg.author?.name || 'Atris')
     },
     homepage: pkg.homepage || 'https://github.com/atrislabs/atris',
     keywords: ['atris', 'workspace', 'integrations', 'email', 'calendar', 'slack', 'notion', 'drive']

package/commands/pull.js

@@ -110,9 +110,9 @@ async function pullAtris() {
     console.log('  Local files that conflict with cloud are replaced by the cloud version.');
     console.log('');
     console.log('  atris pull                   Pull into current business workspace');
-    console.log('  atris pull doordash          Pull a business into ./doordash or --into <path>');
-    console.log('  atris pull doordash --into /tmp/doordash');
-    console.log('  atris pull doordash --only atris/wiki/');
+    console.log('  atris pull <business>         Pull a business into ./<business> or --into <path>');
+    console.log('  atris pull <business> --into /tmp/<business>');
+    console.log('  atris pull <business> --only atris/wiki/');
     console.log('  atris pull --keep-local      Preserve conflicting local edits as .remote files (legacy)');
     console.log('  atris pull --dry-run         Preview pull changes without writing local files');
     console.log('  atris pull --no-manifest     Pull for inspection without changing this machine\'s sync anchor');
@@ -249,7 +249,7 @@ async function pullBusiness(slug) {
   // correct workspace for THIS business — i.e. it has a `.atris/business.json`
   // whose slug matches `slug`. Any other signal (a stray `atris/` folder, a
   // business.json for a different business, etc.) is NOT enough: pulling
-  // atris-labs on top of another business workspace would mix two businesses into
+  // one business on top of another business workspace would mix two businesses into
   // one directory and write one manifest over the other (or vice
   // versa), causing the next sync to do strange things.
   //