briefops 1.1.0 → 2.1.1

package/docs/quickstart.md

@@ -1,11 +1,26 @@
 # Quickstart
 
+## Install
+
+For normal use:
+
+```bash
+npm install -g briefops
+briefops --version
+```
+
+For repository development:
+
+```bash
+npm install
+npm run build
+npm test
+```
+
 ## Codex First Context Path
 
 ```bash
-briefops init
-briefops codex install
-briefops codex plugin install
+briefops bootstrap
 briefops skill create risk-review --description "Review risk and governance."
 briefops project create atlas-q --description "Rule-based quantitative system."
 briefops worker create quant-reviewer --project atlas-q --skills "risk-review" --style "skeptical,verify before completion"
@@ -15,7 +30,9 @@ briefops memory add --type lessons --project atlas-q --skill risk-review --conte
 briefops prime --task "Continue rebalance review" --format codex --max-tokens 800
 ```
 
-`briefops codex plugin install` is local and deterministic. It does not publish to a marketplace and does not write to global Codex folders by default.
+`briefops bootstrap` initializes `.briefops/`, installs `AGENTS.md` guidance that tells Codex to prime BriefOps first, writes local Codex prompt/plugin assets, keeps `.briefops/` ignored by default, and runs bounded privacy/stability checks.
+
+`briefops codex plugin install` is still available as the manual local plugin path. It is deterministic, does not publish to a marketplace, and does not write to global Codex folders by default.
 
 `briefops export all` writes router files for Codex, Claude Code, and Cursor. These files point harnesses at BriefOps commands and do not copy `.briefops` memory, logs, handoffs, or worker summaries.
 
@@ -25,11 +42,10 @@ After work finishes, log the result and promote only useful lessons:
 
 ```bash
 briefops finish --project atlas-q --skill risk-review --worker quant-reviewer --task "Review rebalance" --result "Found missing turnover warning check." --lesson "Always verify turnover warning threshold."
-briefops approve latest
 briefops continue --worker quant-reviewer --task "Continue rebalance review" --pack
 ```
 
-BriefOps skills must never auto-approve memory proposals or skill patches. Approval is a human step.
+`finish` applies durable memory locally by default and keeps the proposal file as an audit trail. Use `--memory-review` only when you explicitly want a pending local queue.
 
 For small or exploratory work, keep durable memory clean:
 

package/docs/release-checklist.md

@@ -10,6 +10,7 @@ npm pack --dry-run
 npm run verify:release
 briefops --help
 npm whoami
+npm view briefops versions --json
 ```
 
 `npm audit --audit-level=moderate` is included in `npm run verify:release`. It contacts the npm registry and sends dependency/audit metadata, so run it only from an environment where that network disclosure is acceptable.
@@ -31,12 +32,17 @@ briefops export claude-md --force
 briefops export cursor-rules --force
 briefops prime --task "Start this task." --format codex --max-tokens 800
 briefops compare context --worker quant-reviewer --task "Start this task."
+briefops obs continuity --worker quant-reviewer --task "Start this task." --json
 briefops doctor --stability
 briefops doctor --security
 briefops doctor --security --fix-stale-locks
 briefops doctor --privacy
+briefops doctor --strict --json
+briefops harness route --task "Review work"
+briefops harness matrix
 briefops finish --worker quant-reviewer --project atlas-q --skill risk-review --task "Review work" --result "Found unresolved risk." --lesson "Check unresolved risk before finishing." --importance durable
-briefops approve latest
+briefops finish --worker quant-reviewer --project atlas-q --skill risk-review --task "Review pending memory path" --result "Created review proposal." --decision "Use review mode only when a pending queue is explicitly desired." --memory-review
+briefops memory proposal-apply latest
 briefops finish --worker quant-reviewer --task "Fix typo" --result "Fixed typo." --importance trivial
 briefops memory hygiene
 briefops memory prune --dry-run
@@ -45,15 +51,21 @@ briefops memory prune --dry-run
 Confirm:
 
 - `briefops --version` matches `package.json`.
-- `docs/file-format.md`, `docs/compatibility.md`, and `docs/privacy-model.md` describe the 1.0 public contract.
+- `docs/file-format.md`, `docs/compatibility.md`, and `docs/privacy-model.md` describe the 2.1.x public behavior and current workspace file contract.
+- The target package version is not already present in `npm view briefops versions --json`.
+- npm authentication has read-write access to the `briefops` package.
+- `briefops harness route` returns the workflow depth, artifacts, exit criteria, and final-response contract for the task.
+- `briefops obs continuity` reports compression, continuity, queues, and memory hygiene counts without dumping private memory.
 - Harness exports are routers, not memory dumps.
 - `shared-only` exports omit private memory, local project file details, raw work logs, open risks, local next steps, private worker history, and private metadata counts.
-- Memory and skill patches require human approval.
+- `finish` applies directory-local durable memory by default, while skill patches still require explicit direction.
 - `finish --importance trivial` and `finish --no-memory-proposal` avoid durable memory proposals.
 - `memory hygiene` and `memory prune --dry-run` do not mutate memory.
-- Proposal generation and approval are local file-backed operations protected by workspace locks.
+- Memory items and proposals can carry optional evidence anchors without breaking older memory files.
+- Proposal generation and application are local file-backed operations protected by workspace locks.
 - `doctor --stability` is read-only, bounds detailed examples, and does not add diagnostics to generated prompt artifacts.
 - `doctor --security --fix-stale-locks` removes stale locks only.
+- `doctor --strict --json` reports `releaseReady: false` when any release-readiness warning or failure remains.
 - Explicit output paths do not overwrite without `--force`.
 - Generated Codex plugin files do not overwrite local changes without `--force`.
 - `.briefops/` is ignored or intentionally curated.
@@ -66,5 +78,7 @@ git status --short --branch
 git tag v<version>
 git push origin HEAD
 git push origin v<version>
+npm view briefops versions --json
 npm publish
+npm view briefops version
 ```

package/docs/roadmap.md

@@ -8,15 +8,22 @@
 - shared-only export privacy hardening
 - file format, compatibility, and privacy model documentation
 
-## Near Term After 1.0
+## 2.1.x Complete
 
-- expand context savings eval fixtures
-- improve memory hygiene suggestions beyond dry-run reporting, without auto-pruning
-- release readiness CI
+- strict local release-readiness checks that aggregate stability, security, privacy, and memory hygiene
+- evidence-backed memory references for decisions, lessons, incidents, and risks
+- continuity observability reports for context compression, queues, and hygiene signals
+- Codex-first Master Harness routing for task workflow depth
+- npm package refresh for the 2.1.x public release line
+
+## Near Term After 2.1.x
+
+- persistent `.briefops/harness/` route, goal, finding, and verification ledgers
+- stronger Spec-Kit detection and route-aware handoff
+- richer eval fixtures for context savings and continuity quality
 
 ## Later
 
-- optional cross-harness projection beyond router files
 - richer eval fixtures for token savings
 - curated shared-memory export bundles
 - signed release artifacts

package/docs/superpowers/plans/2026-06-08-briefops-oss-readiness.md

@@ -594,7 +594,7 @@ describe("privacy doctor", () => {
         type: "facts",
         project: "atlas-q",
         skill: "risk-review",
-        content: "Use API key sk-test-12345678901234567890 for local sandbox.",
+        content: "Use api_key: REDACTED_TEST_VALUE for local sandbox.",
         visibility: "private",
         exportable: false
       });

package/docs/token-budget.md

@@ -50,6 +50,14 @@ briefops compare context --worker <worker> --task "Review this PR."
 
 The command estimates local `.briefops` candidate inputs such as project context, worker summary, active memory, and recent logs, then compares them with compiled `briefops prime` output.
 
+Use `obs continuity` when you want the same context compression signal alongside continuity health, local queue counts, and memory hygiene:
+
+```bash
+briefops obs continuity --worker <worker> --task "Review this PR." --json
+```
+
+This command is read-only and reports counts and token estimates rather than dumping private memory.
+
 ## Harness Router Budgets
 
 Harness exports should stay small:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "briefops",
-  "version": "1.1.0",
+  "version": "2.1.1",
   "description": "Local-first CLI for AI coding agents with persistent memory, handoffs, and token-aware context.",
   "type": "module",
   "bin": {
@@ -44,7 +44,7 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@types/node": "^22.5.5",
+    "@types/node": "^26.0.0",
     "tsx": "^4.19.1",
     "typescript": "^5.6.2",
     "vitest": "^4.1.8"

package/plugins/briefops-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "briefops",
-  "version": "1.1.0",
+  "version": "2.1.1",
   "description": "Local-first, token-aware persistent work history for Codex workflows.",
   "author": {
     "name": "BriefOps contributors",
@@ -29,6 +29,7 @@
       "Write"
     ],
     "defaultPrompt": [
+      "Route this task through the BriefOps Master Harness.",
       "Start this task with the smallest useful BriefOps context.",
       "Finish this task and prepare memory for the next thread."
     ],

package/plugins/briefops-codex/README.md

@@ -5,25 +5,27 @@ This is a skill-only Codex plugin bundle for BriefOps.
 It does not run a hosted service and does not sync data. The skills call the local `briefops` CLI and local `.briefops/` workspace.
 It does not publish to a marketplace and does not write to global Codex folders by default.
 
-The BriefOps plugin is a local CLI helper. It does not require network access, does not publish to a marketplace, and should not auto-approve memory or skill patches. Use `--export-policy shared-only` before copying context outside the local workspace.
+The BriefOps plugin is a local CLI helper. It does not require network access and does not publish to a marketplace. It may update directory-local `.briefops/` memory; use `--export-policy shared-only` before copying context outside the local workspace, and ask before applying skill patches.
 
 Recommended local setup:
 
 ```bash
-briefops init
-briefops codex install
-briefops codex plugin install
+briefops bootstrap
 briefops worker use <worker>
 briefops prime --task "Start this task." --format codex
 ```
 
+`briefops bootstrap` initializes `.briefops/`, installs `AGENTS.md` first-context guidance, writes local Codex prompt/plugin assets, keeps `.briefops/` ignored by default, and runs bounded privacy/stability checks.
+
 The generated local plugin copy is written to:
 
 ```text
 .briefops/codex/plugin/briefops
 ```
 
-BriefOps plugin skills must never auto-approve memory proposals or skill patches.
+BriefOps plugin skills treat `.briefops/` memory as local repo state. Explicit confirmation is reserved for exporting private memory outside the workspace or applying skill patches.
+
+Use `briefops-route-task` at the start of development work when Codex should classify the task before implementation. It routes small fixes, features, refactors, UI work, incidents, research, code review, and release preparation to the smallest sufficient workflow depth.
 
 For repo-level harness guidance, generate router files:
 
@@ -32,7 +34,7 @@ briefops export agents-md
 briefops export all
 ```
 
-These exports route local harnesses back to `briefops prime`, `briefops finish`, `briefops approve`, and `briefops continue --pack`. They do not copy `.briefops` memory, logs, handoffs, or worker summaries.
+These exports route local harnesses back to `briefops prime`, `briefops finish`, and `briefops continue --pack`. They do not copy `.briefops` memory, logs, handoffs, or worker summaries.
 
 Use shared-only exports for portable context:
 

package/plugins/briefops-codex/skills/briefops-continue-worker/SKILL.md

@@ -5,9 +5,9 @@ description: Use when continuing a persistent BriefOps worker in a fresh Codex t
 
 # BriefOps Continue Worker
 
-The BriefOps plugin is a local CLI helper. It does not require network access, does not publish to a marketplace, and should not auto-approve memory or skill patches.
+The BriefOps plugin is a local CLI helper. It does not require network access and does not publish to a marketplace.
 
-Use `--export-policy shared-only` before copying context outside the local workspace.
+BriefOps may update directory-local `.briefops/` memory. Use `--export-policy shared-only` before copying context outside the local workspace, and ask before applying skill patches.
 
 Use this workflow when the user wants a fresh Codex thread to continue prior work with the same worker identity, project constraints, memory, and risks.
 
@@ -17,6 +17,6 @@ Prepare a resume prompt and optional portable pack:
 briefops continue --worker <worker> --task "<next task>" --pack
 ```
 
-If BriefOps reports pending memory proposals, surface the review command before continuing. Do not apply memory automatically.
+Pending memory proposals are optional local review drafts and do not block continuing. Apply relevant local memory when useful; ask before applying skill patches.
 
 Use portable packs only as explicit local user artifacts. They may include private local memory and should be reviewed before sharing.

package/plugins/briefops-codex/skills/briefops-finish-task/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: briefops-finish-task
-description: Use when finishing a Codex task to record the outcome, propose durable memory, and prepare the next thread without auto-approving memory
+description: Use when finishing a Codex task to record the outcome, update directory-local durable memory, and prepare the next thread
 ---
 
 # BriefOps Finish Task
 
-The BriefOps plugin is a local CLI helper. It does not require network access, does not publish to a marketplace, and should not auto-approve memory or skill patches.
+The BriefOps plugin is a local CLI helper. It does not require network access and does not publish to a marketplace.
 
-Use `--export-policy shared-only` before copying context outside the local workspace.
+BriefOps may update directory-local `.briefops/` memory. Use `--export-policy shared-only` before copying context outside the local workspace, and ask before applying skill patches.
 
 Use BriefOps at the end of meaningful work so future Codex threads do not spend tokens rediscovering the same decisions, risks, and lessons.
 
@@ -19,4 +19,4 @@ briefops finish --worker <worker> --task "<task>" --result "<result>" --lesson "
 
 Only include lessons, decisions, incidents, open risks, and next steps that will help future work. Do not store secrets or personal data.
 
-If a memory proposal is created, ask the user to review it. Never run `briefops approve` without explicit user confirmation.
+`briefops finish` applies durable memory locally by default and keeps the proposal file as an audit trail. Use `--memory-review` only when the user explicitly wants a pending review queue.

package/plugins/briefops-codex/skills/briefops-prime-context/SKILL.md

@@ -5,9 +5,9 @@ description: Use when starting work in any Codex project or fresh thread to load
 
 # BriefOps Prime Context
 
-The BriefOps plugin is a local CLI helper. It does not require network access, does not publish to a marketplace, and should not auto-approve memory or skill patches.
+The BriefOps plugin is a local CLI helper. It does not require network access and does not publish to a marketplace.
 
-Use `--export-policy shared-only` before copying context outside the local workspace.
+BriefOps may update directory-local `.briefops/` memory. Use `--export-policy shared-only` before copying context outside the local workspace, and ask before applying skill patches.
 
 Use BriefOps before broad repo/history inspection when a `.briefops` workspace exists or may exist.
 
@@ -17,8 +17,8 @@ Run:
 briefops prime --format codex --task "<current user task>" --max-tokens 800
 ```
 
-If the command reports that no workspace exists, keep the response short and suggest `briefops init`.
+If the command reports `setup-required`, keep the response short and suggest `briefops bootstrap` for first adoption.
 
-Never apply memory automatically. If pending proposals exist, show the review command.
+BriefOps memory is directory-local. `briefops finish` auto-promotes durable memory by default; pending proposals from older or review-mode flows can be applied locally without blocking the task.
 
 Treat the prime output as a compact routing brief, not as permission to skip relevant code inspection.

package/plugins/briefops-codex/skills/briefops-review-memory/SKILL.md

@@ -1,15 +1,15 @@
 ---
 name: briefops-review-memory
-description: Use when BriefOps reports pending memory proposals or skill patches that need human review before becoming durable local memory
+description: Use when BriefOps reports pending local memory proposals or skill patches that need inspection
 ---
 
 # BriefOps Review Memory
 
-The BriefOps plugin is a local CLI helper. It does not require network access, does not publish to a marketplace, and should not auto-approve memory or skill patches.
+The BriefOps plugin is a local CLI helper. It does not require network access and does not publish to a marketplace.
 
-Use `--export-policy shared-only` before copying context outside the local workspace.
+BriefOps may update directory-local `.briefops/` memory. Use `--export-policy shared-only` before copying context outside the local workspace, and ask before applying skill patches.
 
-BriefOps memory is human-approved. Pending proposals are local drafts until the user accepts or rejects them.
+BriefOps memory is directory-local. Pending memory proposals are optional audit/review drafts; they should not block normal continuation.
 
 Inspect proposals before applying:
 
@@ -18,10 +18,11 @@ briefops memory proposal-show latest
 briefops inbox
 ```
 
-Apply only after explicit user confirmation:
+Apply relevant local memory proposals directly, or reject inaccurate, duplicate, sensitive, or overly broad proposals:
 
 ```bash
-briefops approve latest
+briefops memory proposal-apply latest
+briefops memory proposal-reject latest
 ```
 
-Reject inaccurate, duplicate, sensitive, or overly broad proposals instead of carrying noisy context into future threads.
+Ask before applying skill patches or exporting private memory outside the local workspace.

package/plugins/briefops-codex/skills/briefops-route-task/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: briefops-route-task
+description: Use when starting Codex development work to classify the task and choose the smallest sufficient BriefOps Master Harness workflow
+---
+
+# BriefOps Route Task
+
+The BriefOps plugin is a local CLI helper. It does not require network access and does not publish to a marketplace.
+
+BriefOps may update directory-local `.briefops/` memory. Use `--export-policy shared-only` before copying context outside the local workspace, and ask before applying skill patches.
+
+Use this before implementation when the task may need memory, specification, planning, findings, verification, or handoff discipline.
+
+Run:
+
+```bash
+briefops harness route --task "<current user task>"
+```
+
+For explicit routing, pass a task type:
+
+```bash
+briefops harness route --task "<current user task>" --type large-feature
+```
+
+Use the route as a workflow contract:
+
+- Do not force full specification on tiny tasks.
+- Do not skip goal ledgers, findings, visual evidence, or handoff when the route requires them.
+- If repository evidence contradicts the inferred route, choose the safer route and say why.
+- Treat `briefops prime` as the memory intake step and `briefops finish` as the work-log/memory closeout step.
+
+Supported task types: small-bug-fix, medium-feature, large-feature, refactor, dependency-upgrade, ui-change, test-repair, production-incident, documentation-task, architecture-decision, exploratory-research, code-review, release-preparation.