chainlesschain 0.165.10 → 0.166.1

package/src/command-help-index.json

@@ -100,7 +100,7 @@
     "note": "Usage: chainlesschain note [options] [command]\n\nNote and knowledge base management\n\nOptions:\n  -h, --help                         display help for command\n\nCommands:\n  add [options] <title>              Add a new note\n  list [options]                     List notes\n  show [options] <id>                Show note content\n  search [options] <query>           Search notes\n  delete [options] <id>              Delete a note (soft delete)\n  history [options] <id>             Show version history for a note\n  diff [options] <id> <v1> <v2>      Show diff between two versions of a note\n  revert [options] <id> <version>    Revert a note to a specific version\n  note-maturities-v2                 List V2 note maturity states\n  revision-lifecycles-v2             List V2 revision lifecycle states\n  stats-v2                           Show V2 governance stats\n  get-max-active-notes-v2            Get max active notes per author\n  set-max-active-notes-v2 <n>        Set max active notes per author\n  get-max-open-revs-v2               Get max open revisions per note\n  set-max-open-revs-v2 <n>           Set max open revisions per note\n  get-note-idle-ms-v2                Get note idle threshold (ms)\n  set-note-idle-ms-v2 <n>            Set note idle threshold (ms)\n  get-rev-stuck-ms-v2                Get revision stuck threshold (ms)\n  set-rev-stuck-ms-v2 <n>            Set revision stuck threshold (ms)\n  active-note-count-v2 <authorId>    Count active notes for an author\n  open-rev-count-v2 <noteId>         Count open revisions for a note\n  register-note-v2 [options] <id>    Register a V2 note\n  get-note-v2 <id>                   Get a V2 note\n  list-notes-v2 [options]            List V2 notes\n  activate-note-v2 <id>              draft|locked → active\n  lock-note-v2 <id>                  active → locked\n  archive-note-v2 <id>               → archived (terminal)\n  touch-note-v2 <id>                 Update lastSeenAt\n  create-revision-v2 [options] <id>  Create a V2 revision\n  get-revision-v2 <id>               Get a V2 revision\n  list-revisions-v2 [options]        List V2 revisions\n  review-revision-v2 <id>            proposed → reviewed\n  apply-revision-v2 <id>             reviewed → applied (non-terminal)\n  supersede-revision-v2 <id>         reviewed|applied → superseded (terminal)\n  discard-revision-v2 <id>           → discarded (terminal)\n  auto-lock-idle-notes-v2            Flip idle active notes → locked\n  auto-discard-stale-revisions-v2    Flip stale proposed/reviewed → discarded\n  help [command]                     display help for command\n",
     "notification": "Usage: chainlesschain notification|notif [options] [command]\n\nPush notifications to paired mobile devices\n\nOptions:\n  -h, --help      display help for command\n\nCommands:\n  send [options]  Send a push notification to a paired iPhone/Android\n  help [command]  display help for command\n",
     "ops": "Usage: chainlesschain ops [options] [command]\n\nAutonomous operations / AIOps\n\nOptions:\n  -h, --help                                                     display help for command\n\nCommands:\n  severities [options]                                           List severity levels\n  statuses [options]                                             List incident statuses\n  algorithms [options]                                           List detection algorithms\n  rollback-types [options]                                       List rollback types\n  baseline-update [options] <metric>                             Update metric baseline from values\n  baseline-show [options] <metric>                               Show metric baseline\n  baselines [options]                                            List metric baselines\n  detect [options] <metric> <value>                              Detect anomaly for a metric value\n  incident-create [options]                                      Create an incident manually\n  incident-show [options] <id>                                   Show incident details\n  incident-ack [options] <id>                                    Acknowledge an incident\n  incident-resolve [options] <id>                                Resolve an incident\n  incident-close [options] <id>                                  Close a resolved incident\n  incidents [options]                                            List incidents\n  playbook-create [options]                                      Create remediation playbook\n  playbook-show [options] <id>                                   Show playbook details\n  playbook-toggle [options] <id> <on|off>                        Enable or disable a playbook\n  playbook-record [options] <id> <success|failure>               Record playbook execution result\n  playbooks [options]                                            List playbooks\n  postmortem [options] <id>                                      Generate postmortem for resolved incident\n  stats [options]                                                AIOps statistics\n  playbook-maturities-v2 [options]                               List playbook V2 maturity states\n  remediation-lifecycles-v2 [options]                            List remediation V2 lifecycle states\n  default-max-active-playbooks-per-owner                         Show default max-active-playbooks-per-owner\n  max-active-playbooks-per-owner                                 Show current max-active-playbooks-per-owner\n  set-max-active-playbooks-per-owner <n>                         Set max-active-playbooks-per-owner\n  default-max-pending-remediations-per-owner                     Show default max-pending-remediations-per-owner\n  max-pending-remediations-per-owner                             Show current max-pending-remediations-per-owner\n  set-max-pending-remediations-per-owner <n>                     Set max-pending-remediations-per-owner\n  default-playbook-stale-ms                                      Show default playbook-stale-ms\n  playbook-stale-ms                                              Show current playbook-stale-ms\n  set-playbook-stale-ms <ms>                                     Set playbook-stale-ms\n  default-remediation-timeout-ms                                 Show default remediation-timeout-ms\n  remediation-timeout-ms                                         Show current remediation-timeout-ms\n  set-remediation-timeout-ms <ms>                                Set remediation-timeout-ms\n  active-playbook-count [options]                                Active playbook count (optionally scoped by owner)\n  pending-remediation-count [options]                            Pending/executing remediation count (optionally scoped by owner)\n  register-playbook-v2 [options] <playbook-id>                   Register a V2 playbook\n  playbook-v2 <playbook-id>                                      Get V2 playbook record\n  set-playbook-maturity-v2 [options] <playbook-id> <status>      Set playbook V2 maturity status\n  activate-playbook [options] <playbook-id>                      Transition playbook → active\n  deprecate-playbook-v2 [options] <playbook-id>                  Transition playbook → deprecated\n  retire-playbook [options] <playbook-id>                        Transition playbook → retired (terminal)\n  touch-playbook-activity <playbook-id>                          Bump lastUsedAt for a playbook\n  submit-remediation-v2 [options] <remediation-id>               Submit a V2 remediation\n  remediation-v2 <remediation-id>                                Get V2 remediation record\n  set-remediation-status-v2 [options] <remediation-id> <status>  Set remediation V2 status\n  start-remediation [options] <remediation-id>                   Transition remediation → executing\n  complete-remediation [options] <remediation-id>                Transition remediation → succeeded (terminal)\n  fail-remediation [options] <remediation-id>                    Transition remediation → failed (terminal)\n  abort-remediation [options] <remediation-id>                   Transition remediation → aborted (terminal)\n  auto-retire-stale-playbooks                                    Bulk-flip stale playbooks → retired\n  auto-timeout-stuck-remediations                                Bulk-flip stuck executing remediations → failed\n  stats-v2 [options]                                             Show V2 AIOps stats (all-enum-key)\n  help [command]                                                 display help for command\n",
-    "orchestrate": "Usage: chainlesschain orchestrate [options] [task]\n\nOrchestrate AI coding tasks: ChainlessChain → Claude Code/Codex agents → CI/CD\n→ Notify\n\nOptions:\n  -a, --agents <n>       Max parallel agents (default: \"3\")\n  --ci <command>         CI command to run after agents complete (default: \"npm\n                         test\")\n  --no-ci                Skip CI/CD verification step\n  --source <type>        Input source:\n                         cli|sentry|github|file|wecom|dingtalk|feishu (default:\n                         \"cli\")\n  --file <path>          Read task from file (use with --source file)\n  --context <text>       Extra context for the task (e.g. stack trace)\n  --cwd <path>           Project root directory (default: current dir)\n  --provider <name>      LLM provider for decomposition\n  --model <name>         Model for decomposition LLM calls\n  --cli-tool <name>      Execution CLI: claude|codex (auto-detected)\n  --backends <list>      Agent backends: claude,codex,gemini,openai,ollama\n                         (comma-separated)\n  --strategy <name>      Agent routing:\n                         round-robin|by-type|parallel-all|primary (default:\n                         \"round-robin\")\n  --retries <n>          Max CI retry cycles (default: \"3\")\n  --timeout <sec>        Per-agent timeout in seconds (default: \"300\")\n  --no-notify            Disable notifications\n  --status               Show orchestrator and agent pool status\n  --watch                Start cron watch mode\n  --interval <min>       Cron interval in minutes (watch mode) (default: \"10\")\n  --webhook              Start HTTP webhook server for IM platform commands\n  --webhook-port <port>  Webhook server port (default: \"18820\")\n  --json                 Output as JSON\n  --verbose              Verbose output\n  -h, --help             display help for command\n",
+    "orchestrate": "Usage: chainlesschain orchestrate [options] [task]\n\nOrchestrate AI coding tasks: ChainlessChain → Claude Code/Codex agents → CI/CD\n→ Notify\n\nOptions:\n  -a, --agents <n>              Max parallel agents (default: \"3\")\n  --ci <command>                CI command to run after agents complete\n                                (default: \"npm test\")\n  --no-ci                       Skip CI/CD verification step\n  --source <type>               Input source:\n                                cli|sentry|github|file|wecom|dingtalk|feishu\n                                (default: \"cli\")\n  --file <path>                 Read task from file (use with --source file)\n  --context <text>              Extra context for the task (e.g. stack trace)\n  --cwd <path>                  Project root directory (default: current dir)\n  --provider <name>             LLM provider for decomposition\n  --model <name>                Model for decomposition LLM calls\n  --cli-tool <name>             Execution CLI: claude|codex (auto-detected)\n  --backends <list>             Agent backends:\n                                claude,codex,gemini,openai,ollama\n                                (comma-separated)\n  --strategy <name>             Agent routing:\n                                round-robin|by-type|parallel-all|primary\n                                (default: \"round-robin\")\n  --retries <n>                 Max CI retry cycles (default: \"3\")\n  --timeout <sec>               Per-agent timeout in seconds (default: \"300\")\n  --no-notify                   Disable notifications\n  --status                      Show orchestrator and agent pool status\n  --watch                       Start cron watch mode\n  --interval <min>              Cron interval in minutes (watch mode) (default:\n                                \"10\")\n  --webhook                     Start HTTP webhook server for IM platform\n                                commands\n  --webhook-port <port>         Webhook server port (default: \"18820\")\n  --webhook-secret-env <name>   Environment variable containing the webhook\n                                HMAC secret (default:\n                                \"CC_ORCHESTRATE_WEBHOOK_SECRET\")\n  --webhook-max-body-bytes <n>  Maximum authenticated webhook request body\n                                (default: \"262144\")\n  --webhook-rate-limit <n>      Maximum webhook requests per source and minute\n                                (default: \"30\")\n  --json                        Output as JSON\n  --verbose                     Verbose output\n  -h, --help                    display help for command\n",
     "orchgov": "Usage: chainlesschain orchgov [options] [command]\n\nOrchestrator V2 governance\n\nOptions:\n  -h, --help                                  display help for command\n\nCommands:\n  enums-v2\n  config-v2\n  set-max-active-v2 <n>\n  set-max-pending-v2 <n>\n  set-idle-ms-v2 <n>\n  set-stuck-ms-v2 <n>\n  register-profile-v2 [options] <id> <owner>\n  activate-profile-v2 <id>\n  pause-profile-v2 <id>\n  retire-profile-v2 <id>\n  touch-profile-v2 <id>\n  get-profile-v2 <id>\n  list-profiles-v2\n  create-task-v2 [options] <id> <profileId>\n  dispatch-task-v2 <id>\n  complete-task-v2 <id>\n  fail-task-v2 <id> [reason]\n  cancel-task-v2 <id> [reason]\n  get-task-v2 <id>\n  list-tasks-v2\n  auto-pause-idle-v2\n  auto-fail-stuck-v2\n  gov-stats-v2\n  reset-state-v2\n  help [command]                              display help for command\n",
     "org": "Usage: chainlesschain org [options] [command]\n\nOrganization, team, and approval management\n\nOptions:\n  -h, --help                                  display help for command\n\nCommands:\n  create [options] <name>                     Create a new organization\n  list [options]                              List all organizations\n  show [options] <org-id>                     Show organization details\n  delete [options] <org-id>                   Delete an organization\n  invite [options] <org-id> <user-id>         Invite a member to an organization\n  members [options] <org-id>                  List organization members\n  team-create [options] <org-id> <team-name>  Create a team\n  teams [options] <org-id>                    List teams in an organization\n  approval-submit [options] <org-id> <title>  Submit an approval request\n  approvals [options]                         List approval requests\n  approve [options] <approval-id>             Approve a request\n  reject [options] <approval-id>              Reject a request\n  maturities-v2                               List org maturity states (V2)\n  member-lifecycles-v2                        List member lifecycle states (V2)\n  stats-v2                                    Show V2 org/member stats\n  max-active-orgs-per-owner [n]               Get/set max active orgs per owner (V2)\n  max-active-members-per-org [n]              Get/set max active members per org (V2)\n  org-idle-ms [ms]                            Get/set org idle window ms (V2)\n  invite-stale-ms [ms]                        Get/set invite stale window ms (V2)\n  active-org-count-v2 <owner>                 Count active orgs for owner (V2)\n  active-member-count-v2 <orgId>              Count active members for org (V2)\n  register-org-v2 [options] <id>              Register a new provisional org (V2)\n  org-v2 <id>                                 Show org by id (V2)\n  list-orgs-v2 [options]                      List orgs (V2)\n  set-org-maturity-v2 <id> <next>             Transition org maturity (V2)\n  activate-org-v2 <id>                        Activate org (V2)\n  suspend-org-v2 <id>                         Suspend org (V2)\n  archive-org-v2 <id>                         Archive org terminally (V2)\n  touch-org-v2 <id>                           Update org lastSeenAt (V2)\n  invite-member-v2 [options] <id>             Invite a member to an org (V2)\n  member-v2 <id>                              Show member by id (V2)\n  list-members-v2 [options]                   List members (V2)\n  set-member-status-v2 <id> <next>            Transition member status (V2)\n  activate-member-v2 <id>                     Activate member (V2)\n  suspend-member-v2 <id>                      Suspend member (V2)\n  revoke-member-v2 <id>                       Revoke member terminally (V2)\n  depart-member-v2 <id>                       Depart member terminally (V2)\n  auto-archive-idle-orgs                      Auto-archive non-provisional orgs idle past window (V2)\n  auto-revoke-stale-invites                   Auto-revoke invited members stale past window (V2)\n  help [command]                              display help for command\n",
     "output-style": "Usage: chainlesschain output-style|output-styles [options] [command]\n\nList / show agent output-style personas\n\nOptions:\n  -h, --help             display help for command\n\nCommands:\n  list|ls [options]      List built-in + .claude/output-styles/*.md personas\n  show [options] <name>  Show a style's metadata and body\n  new [options] <name>   Scaffold a new style under .claude/output-styles/\n  help [command]         display help for command\n",
@@ -134,7 +134,7 @@
     "sandbox": "Usage: chainlesschain sandbox [options] [command]\n\nSecurity sandbox v2 — isolated agent execution environments\n\nOptions:\n  -h, --help                                       display help for command\n\nCommands:\n  create [options] <agent-id>                      Create a new sandbox for an agent\n  exec [options] <sandbox-id> <code>               Execute code within a sandbox\n  destroy [options] <sandbox-id>                   Destroy a sandbox\n  list [options]                                   List active sandboxes\n  audit [options] [sandbox-id]                     Show audit log for sandboxes\n  quota [options] <sandbox-id>                     Show or set sandbox quota\n  monitor [options] <sandbox-id>                   Monitor sandbox behavior and detect suspicious patterns\n  prune [options]                                  Destroy sandboxes whose ttl or idle-ttl has expired (Phase 4)\n  statuses [options]                               List sandbox lifecycle status enum values (Phase 87)\n  permission-types [options]                       List permission type enum values (Phase 87)\n  risk-levels [options]                            List risk level enum values (Phase 87)\n  quota-types [options]                            List quota type enum values (Phase 87)\n  pause [options] <id>                             Pause a running sandbox (Phase 87)\n  resume [options] <id>                            Resume a paused sandbox (Phase 87)\n  terminate [options] <id>                         Terminate a sandbox (Phase 87 canonical; more explicit than destroy)\n  set-quota-typed [options] <id> <type> <limit>    Set a single quota by type (Phase 87)\n  check-permission [options] <id> <type> <target>  Check whether a sandbox may perform a permission op (Phase 87)\n  check-quota [options] <id> <type> [amount]       Check quota availability for a type (Phase 87)\n  risk-score [options] <id>                        Compute risk score + risk level for a sandbox (Phase 87)\n  risk-level [options] <score>                     Map a risk score to a RISK_LEVEL bucket (Phase 87)\n  auto-isolate [options] <id>                      Auto-isolate a sandbox: record + terminate (Phase 87)\n  isolations [options]                             List isolation records (Phase 87)\n  audit-filter [options] [id]                      Filter audit log by event types / time range (Phase 87)\n  stats-v2 [options]                               Extended V2 stats (byStatus / auditByAction / isolations) (Phase 87)\n  help [command]                                   display help for command\n",
     "scim": "Usage: chainlesschain scim [options] [command]\n\nSCIM provisioning — user management, connectors, sync\n\nOptions:\n  -h, --help                           display help for command\n\nCommands:\n  users                                SCIM user management\n  connectors [options]                 List SCIM connectors\n  sync <connector-id>                  Trigger SCIM provisioning sync\n  status [options]                     Show SCIM provisioning status\n  identity-lifecycles-v2 [options]     List V2 identity lifecycle states\n  sync-lifecycles-v2 [options]         List V2 sync-job lifecycle states\n  stats-v2 [options]                   Show V2 SCIM stats\n  get-max-provisioned-v2               Get max provisioned identities per\n                                       connector\n  set-max-provisioned-v2 <n>           Set max provisioned identities per\n                                       connector\n  get-max-running-sync-v2              Get max running sync jobs per connector\n  set-max-running-sync-v2 <n>          Set max running sync jobs per connector\n  get-identity-idle-ms-v2              Get identity idle ms\n  set-identity-idle-ms-v2 <ms>         Set identity idle ms\n  get-sync-stuck-ms-v2                 Get sync-job stuck ms\n  set-sync-stuck-ms-v2 <ms>            Set sync-job stuck ms\n  provisioned-count-v2 <connectorId>   Count provisioned identities for\n                                       connector\n  running-sync-count-v2 <connectorId>  Count running sync jobs for connector\n  register-identity-v2 [options] <id>  Register V2 identity (initial=pending)\n  get-identity-v2 <id>                 Get V2 identity by id\n  list-identities-v2 [options]         List V2 identities\n  provision-identity-v2 <id>           Transition identity → provisioned\n  suspend-identity-v2 <id>             Transition identity → suspended\n  deprovision-identity-v2 <id>         Transition identity → deprovisioned\n                                       (terminal)\n  touch-identity-v2 <id>               Update identity lastSeenAt\n  create-sync-job-v2 [options] <id>    Create V2 sync job (initial=queued)\n  get-sync-job-v2 <id>                 Get V2 sync job by id\n  list-sync-jobs-v2 [options]          List V2 sync jobs\n  start-sync-job-v2 <id>               Transition sync job → running\n  succeed-sync-job-v2 <id>             Transition sync job → succeeded\n                                       (terminal)\n  fail-sync-job-v2 <id>                Transition sync job → failed (terminal)\n  cancel-sync-job-v2 <id>              Transition sync job → cancelled\n                                       (terminal)\n  auto-deprovision-idle-v2             Auto-deprovision idle identities; output\n                                       flipped\n  auto-fail-stuck-sync-v2              Auto-fail stuck running syncs; output\n                                       flipped\n  help [command]                       display help for command\n",
     "search": "Usage: chainlesschain search [options] <query>\n\nSearch knowledge base (BM25 + vector hybrid)\n\nArguments:\n  query            Search query\n\nOptions:\n  --mode <mode>    Search mode: bm25, vector, hybrid (default: \"hybrid\")\n  --top-k <n>      Number of results (default: \"10\")\n  --threshold <n>  Minimum score threshold (default: \"0\")\n  --json           Output as JSON\n  -h, --help       display help for command\n",
-    "serve": "Usage: chainlesschain serve [options]\n\nStart WebSocket server for remote CLI access\n\nOptions:\n  -p, --port <port>                 Port number (default: \"18800\")\n  -H, --host <host>                 Bind host (default: \"127.0.0.1\")\n  --token <token>                   Authentication token (required for remote\n                                    access)\n  --max-connections <n>             Maximum concurrent connections (default:\n                                    \"10\")\n  --timeout <ms>                    Command execution timeout in milliseconds\n                                    (default: \"30000\")\n  --allow-remote                    Allow non-localhost connections (requires\n                                    --token)\n  --project <path>                  Default project root for sessions\n  --remote-session-relay-url <url>  Signaling relay URL for Remote Session\n                                    pairing\n  --remote-session-peer-id <id>     Stable relay peer ID for this local runtime\n  --http-port <port>                Hosted HTTP port for Phase 5 envelope SSE\n                                    (disabled if unset)\n  --bundle <path>                   Agent bundle directory; may execute local\n                                    MCP commands from mcp.json\n  -h, --help                        display help for command\n",
+    "serve": "Usage: chainlesschain serve [options]\n\nStart WebSocket server for remote CLI access\n\nOptions:\n  --app-server                      Run the canonical CC App Server over stdio\n                                    instead of the legacy WebSocket server\n  --app-server-state-dir <path>     Owner-controlled rollout directory for\n                                    --app-server\n  --app-server-queue-cap <n>        Maximum queued App Server requests\n                                    (default: \"256\")\n  -p, --port <port>                 Port number (default: \"18800\")\n  -H, --host <host>                 Bind host (default: \"127.0.0.1\")\n  --token <token>                   Authentication token (required for remote\n                                    access)\n  --max-connections <n>             Maximum concurrent connections (default:\n                                    \"10\")\n  --timeout <ms>                    Command execution timeout in milliseconds\n                                    (default: \"30000\")\n  --allow-remote                    Allow non-localhost connections (requires\n                                    --token)\n  --project <path>                  Default project root for sessions\n  --remote-session-relay-url <url>  Signaling relay URL for Remote Session\n                                    pairing\n  --remote-session-peer-id <id>     Stable relay peer ID for this local runtime\n  --http-port <port>                Hosted HTTP port for Phase 5 envelope SSE\n                                    (disabled if unset)\n  --bundle <path>                   Agent bundle directory; may execute local\n                                    MCP commands from mcp.json\n  -h, --help                        display help for command\n",
     "services": "Usage: chainlesschain services [options] [command]\n\nManage Docker backend services\n\nOptions:\n  -h, --help                    display help for command\n\nCommands:\n  up [services...]              Start Docker services\n  down                          Stop Docker services\n  logs [options] [services...]  View service logs\n  pull                          Pull latest service images\n  help [command]                display help for command\n",
     "seshhook": "Usage: chainlesschain seshhook [options] [command]\n\nSession Hooks V2 governance\n\nOptions:\n  -h, --help                                       display help for command\n\nCommands:\n  enums-v2\n  config-v2\n  set-max-active-v2 <n>\n  set-max-pending-v2 <n>\n  set-idle-ms-v2 <n>\n  set-stuck-ms-v2 <n>\n  register-profile-v2 [options] <id> <owner>\n  activate-profile-v2 <id>\n  disable-profile-v2 <id>\n  retire-profile-v2 <id>\n  touch-profile-v2 <id>\n  get-profile-v2 <id>\n  list-profiles-v2\n  create-invocation-v2 [options] <id> <profileId>\n  running-invocation-v2 <id>\n  complete-invocation-v2 <id>\n  fail-invocation-v2 <id> [reason]\n  cancel-invocation-v2 <id> [reason]\n  get-invocation-v2 <id>\n  list-invocations-v2\n  auto-disable-idle-v2\n  auto-fail-stuck-v2\n  gov-stats-v2\n  reset-state-v2\n  help [command]                                   display help for command\n",
     "seshsearch": "Usage: chainlesschain seshsearch [options] [command]\n\nSession Search V2 governance\n\nOptions:\n  -h, --help                                  display help for command\n\nCommands:\n  enums-v2\n  config-v2\n  set-max-active-v2 <n>\n  set-max-pending-v2 <n>\n  set-idle-ms-v2 <n>\n  set-stuck-ms-v2 <n>\n  register-profile-v2 [options] <id> <owner>\n  activate-profile-v2 <id>\n  stale-profile-v2 <id>\n  archive-profile-v2 <id>\n  touch-profile-v2 <id>\n  get-profile-v2 <id>\n  list-profiles-v2\n  create-query-v2 [options] <id> <profileId>\n  searching-query-v2 <id>\n  complete-query-v2 <id>\n  fail-query-v2 <id> [reason]\n  cancel-query-v2 <id> [reason]\n  get-query-v2 <id>\n  list-queries-v2\n  auto-stale-idle-v2\n  auto-fail-stuck-v2\n  gov-stats-v2\n  reset-state-v2\n  help [command]                              display help for command\n",
@@ -158,7 +158,7 @@
     "subagent": "Usage: chainlesschain subagent [options] [command]\n\nSub-agent registry V2 governance\n\nOptions:\n  -h, --help                               display help for command\n\nCommands:\n  maturities-v2\n  task-lifecycle-v2\n  stats-v2\n  config-v2\n  register-profile-v2 <id> <owner> [role]\n  activate-profile-v2 <id>\n  pause-profile-v2 <id>\n  retire-profile-v2 <id>\n  touch-profile-v2 <id>\n  get-profile-v2 <id>\n  list-profiles-v2\n  create-task-v2 <id> <profileId> [desc]\n  start-task-v2 <id>\n  complete-task-v2 <id>\n  fail-task-v2 <id> [reason]\n  cancel-task-v2 <id> [reason]\n  get-task-v2 <id>\n  list-tasks-v2\n  auto-pause-idle-v2\n  auto-fail-stuck-v2\n  set-max-active-v2 <n>\n  set-max-pending-v2 <n>\n  set-idle-ms-v2 <n>\n  set-stuck-ms-v2 <n>\n  reset-state-v2\n  help [command]                           display help for command\n",
     "svccont": "Usage: chainlesschain svccont [options] [command]\n\nService Container V2 governance\n\nOptions:\n  -h, --help                                         display help for command\n\nCommands:\n  enums-v2\n  config-v2\n  set-max-active-v2 <n>\n  set-max-pending-v2 <n>\n  set-idle-ms-v2 <n>\n  set-stuck-ms-v2 <n>\n  register-container-v2 [options] <id> <owner>\n  activate-container-v2 <id>\n  degrade-container-v2 <id>\n  decommission-container-v2 <id>\n  touch-container-v2 <id>\n  get-container-v2 <id>\n  list-containers-v2\n  create-resolution-v2 [options] <id> <containerId>\n  resolving-resolution-v2 <id>\n  resolve-resolution-v2 <id>\n  fail-resolution-v2 <id> [reason]\n  cancel-resolution-v2 <id> [reason]\n  get-resolution-v2 <id>\n  list-resolutions-v2\n  auto-degrade-idle-v2\n  auto-fail-stuck-v2\n  gov-stats-v2\n  reset-state-v2\n  help [command]                                     display help for command\n",
     "sync": "Usage: chainlesschain sync [options] [command]\n\nFile and knowledge synchronization\n\nOptions:\n  -h, --help                           display help for command\n\nCommands:\n  status [options]                     Show sync status\n  push [options]                       Push local changes to remote\n  pull [options]                       Pull remote changes to local\n  conflicts [options]                  Show sync conflicts\n  resolve [options] <conflict-id>      Resolve a sync conflict\n  log [options]                        Show sync operation log\n  clear [options]                      Clear all sync data\n  resource-maturities-v2 [options]     List V2 resource maturity states\n  run-lifecycles-v2 [options]          List V2 sync-run lifecycle states\n  stats-v2 [options]                   Show V2 sync stats\n  get-max-active-resources-v2          Get max active resources per owner\n  set-max-active-resources-v2 <n>      Set max active resources per owner\n  get-max-running-runs-v2              Get max running runs per resource\n  set-max-running-runs-v2 <n>          Set max running runs per resource\n  get-resource-idle-ms-v2              Get resource idle ms\n  set-resource-idle-ms-v2 <ms>         Set resource idle ms\n  get-run-stuck-ms-v2                  Get run stuck ms\n  set-run-stuck-ms-v2 <ms>             Set run stuck ms\n  active-resource-count-v2 <owner>     Count active resources for owner\n  running-run-count-v2 <resourceId>    Count running runs for resource\n  register-resource-v2 [options] <id>  Register V2 resource (initial=pending)\n  get-resource-v2 <id>                 Get V2 resource by id\n  list-resources-v2 [options]          List V2 resources\n  activate-resource-v2 <id>            Transition resource → active\n  pause-resource-v2 <id>               Transition resource → paused\n  archive-resource-v2 <id>             Transition resource → archived\n                                       (terminal)\n  touch-resource-v2 <id>               Update resource lastSeenAt\n  create-sync-run-v2 [options] <id>    Create V2 sync run (initial=queued)\n  get-sync-run-v2 <id>                 Get V2 sync run by id\n  list-sync-runs-v2 [options]          List V2 sync runs\n  start-sync-run-v2 <id>               Transition sync run → running\n  succeed-sync-run-v2 <id>             Transition sync run → succeeded\n                                       (terminal)\n  fail-sync-run-v2 <id>                Transition sync run → failed (terminal)\n  cancel-sync-run-v2 <id>              Transition sync run → cancelled\n                                       (terminal)\n  auto-archive-idle-v2                 Auto-archive idle resources; output\n                                       flipped\n  auto-fail-stuck-runs-v2              Auto-fail stuck running syncs; output\n                                       flipped\n  help [command]                       display help for command\n",
-    "team": "Usage: chainlesschain team [options] [command]\n\nRun a declared task graph across N teammates (exclusive leases + dependency\nDAG)\n\nOptions:\n  -h, --help                  display help for command\n\nCommands:\n  queue                       Coordinate durable multi-process worktree\n                              teammates\n  merge-review                Review, atomically publish, and safely roll back\n                              multi-agent branches\n  control-bindings [options]  Show state/attempt/adjudication CAS values for\n                              durable human control\n  plan [options]              Show the topological wave schedule for a task\n                              graph (no run)\n  adjudications [options]     List durable side-effect adjudication cases for a\n                              team state\n  interrupt [options]         Request durable human takeover of an active team\n                              task\n  adjudicate [options]        Apply a one-shot retry/accept/cancel decision to\n                              an ambiguous task\n  run [options]               Run a task graph with N cooperating teammates\n  help [command]              display help for command\n",
+    "team": "Usage: chainlesschain team [options] [command]\n\nRun a declared task graph across N teammates (exclusive leases + dependency\nDAG)\n\nOptions:\n  -h, --help                  display help for command\n\nCommands:\n  queue                       Coordinate durable multi-process worktree\n                              teammates\n  merge-review                Review, atomically publish, and safely roll back\n                              multi-agent branches\n  graph                       Inspect, time-travel, diff, and evaluate\n                              canonical GraphRuns\n  control-bindings [options]  Show state/attempt/adjudication CAS values for\n                              durable human control\n  plan [options]              Show the topological wave schedule for a task\n                              graph (no run)\n  adjudications [options]     List durable side-effect adjudication cases for a\n                              team state\n  interrupt [options]         Request durable human takeover of an active team\n                              task\n  adjudicate [options]        Apply a one-shot retry/accept/cancel decision to\n                              an ambiguous task\n  run [options]               Run a task graph with N cooperating teammates\n  help [command]              display help for command\n",
     "tech": "Usage: chainlesschain tech [options] [command]\n\nTech Learning Engine — stack analysis, anti-pattern detection, practice store\n\nOptions:\n  -h, --help                                                    display help for command\n\nCommands:\n  types [options]                                               List known tech types, practice levels, anti-patterns\n  analyze [options] [path]                                      Analyze tech stack of a project directory\n  profile [options] [path]                                      Show the last analyzed profile for a path\n  detect [options] <file>                                       Detect anti-patterns in a single file\n  practice [options] <tech-type> <tech-name> <pattern> <level>  Record a learned practice (tech-type: language|framework|library|database|tool|pattern)\n  practices [options]                                           List recorded practices\n  recommend [options]                                           Recommend practices based on the analyzed stack\n  profile-maturities-v2                                         List profile maturity states (V2)\n  learning-runs-v2                                              List learning run states (V2)\n  stats-v2                                                      Tech Learning V2 stats\n  max-active-profiles-per-owner [options]                       Get/set max active profiles per owner (V2)\n  max-studying-runs-per-learner [options]                       Get/set max studying runs per learner (V2)\n  profile-stale-ms [options]                                    Get/set profile stale threshold ms (V2)\n  run-stuck-ms [options]                                        Get/set run stuck threshold ms (V2)\n  active-profile-count [options]                                Count active+stale profiles for owner (V2)\n  studying-run-count [options]                                  Count studying runs for learner (V2)\n  create-profile-v2 [options] <id>                              Create a profile V2 (draft)\n  profile-v2 <id>                                               Show profile V2\n  list-profiles-v2 [options]                                    List profiles V2\n  set-profile-maturity-v2 [options] <id> <status>               Transition profile V2 to status\n  activate-profile [options] <id>                               Transition profile → active (V2)\n  mark-profile-stale [options] <id>                             Transition profile → stale (V2)\n  archive-profile [options] <id>                                Transition profile → archived (V2)\n  touch-profile <id>                                            Update lastTouchedAt (V2)\n  enqueue-run-v2 [options] <id>                                 Enqueue a learning run (V2)\n  run-v2 <id>                                                   Show learning run V2\n  list-runs-v2 [options]                                        List learning runs V2\n  set-run-status-v2 [options] <id> <status>                     Transition run V2 to status\n  start-run-v2 [options] <id>                                   Transition run → studying (V2)\n  complete-run-v2 [options] <id>                                Transition run → completed (V2)\n  fail-run-v2 [options] <id>                                    Transition run → failed (V2)\n  abandon-run-v2 [options] <id>                                 Transition run → abandoned (V2)\n  auto-mark-stale-profiles                                      Bulk auto-flip active→stale past threshold (V2)\n  auto-fail-stuck-runs                                          Bulk auto-fail studying runs past threshold (V2)\n  help [command]                                                display help for command\n",
     "tenant": "Usage: chainlesschain tenant [options] [command]\n\nMulti-tenant SaaS — tenants, usage metering, subscriptions, quotas\n\nOptions:\n  -h, --help                                                       display help for command\n\nCommands:\n  plans [options]                                                  List available subscription plans\n  metrics [options]                                                List tracked usage metrics\n  create [options] <name> <slug>                                   Create a tenant\n  configure [options] <tenant-id>                                  Update tenant config / plan / status / name\n  list [options]                                                   List tenants\n  show [options] <tenant-id>                                       Show tenant details\n  delete [options] <tenant-id>                                     Delete a tenant (soft by default; --hard cascades everything)\n  record [options] <tenant-id> <metric> <value>                    Record a usage sample\n  usage [options] <tenant-id>                                      Aggregate usage for a tenant\n  subscribe [options] <tenant-id>                                  Start a new subscription (cancels any prior active one)\n  subscription [options] <tenant-id>                               Show the active subscription for a tenant\n  cancel <tenant-id>                                               Cancel the active subscription\n  subscriptions [options]                                          List subscriptions\n  check-quota [options] <tenant-id> <metric>                       Check a tenant's quota usage against their active plan\n  stats [options]                                                  SaaS-wide statistics\n  export <tenant-id> [output-file]                                 Export tenant + subscriptions + usage as JSON\n  import <input-file>                                              Import tenant snapshot from JSON file\n  maturities-v2 [options]                                          List tenant V2 maturity states\n  subscription-lifecycles-v2 [options]                             List subscription V2 lifecycle states\n  default-max-active-tenants-per-plan                              Show default max-active-tenants-per-plan\n  max-active-tenants-per-plan                                      Show current max-active-tenants-per-plan\n  set-max-active-tenants-per-plan <n>                              Set max-active-tenants-per-plan\n  default-max-subscriptions-per-tenant                             Show default max-subscriptions-per-tenant\n  max-subscriptions-per-tenant                                     Show current max-subscriptions-per-tenant\n  set-max-subscriptions-per-tenant <n>                             Set max-subscriptions-per-tenant\n  default-tenant-idle-ms                                           Show default tenant-idle-ms\n  tenant-idle-ms                                                   Show current tenant-idle-ms\n  set-tenant-idle-ms <ms>                                          Set tenant-idle-ms\n  default-past-due-grace-ms                                        Show default past-due-grace-ms\n  past-due-grace-ms                                                Show current past-due-grace-ms\n  set-past-due-grace-ms <ms>                                       Set past-due-grace-ms\n  active-tenant-count [options]                                    Active tenant count (optionally scoped by plan)\n  open-subscription-count [options]                                Open subscription count (optionally scoped by tenant)\n  register-v2 [options] <tenant-id>                                Register a V2 tenant\n  tenant-v2 <tenant-id>                                            Get V2 tenant record\n  set-maturity-v2 [options] <tenant-id> <status>                   Set tenant V2 maturity status\n  activate [options] <tenant-id>                                   Transition tenant → active\n  suspend [options] <tenant-id>                                    Transition tenant → suspended\n  archive-v2 [options] <tenant-id>                                 Transition tenant → archived\n  cancel-tenant [options] <tenant-id>                              Transition tenant → cancelled (terminal)\n  touch-activity <tenant-id>                                       Bump lastActivityAt for a tenant\n  subscription-register-v2 [options] <subscription-id>             Register a V2 subscription\n  subscription-v2 <subscription-id>                                Get V2 subscription record\n  set-subscription-status-v2 [options] <subscription-id> <status>  Set subscription V2 status\n  activate-subscription [options] <subscription-id>                Transition subscription → active\n  mark-past-due [options] <subscription-id>                        Transition subscription → past_due\n  cancel-subscription-v2 [options] <subscription-id>               Transition subscription → cancelled (terminal)\n  expire-subscription [options] <subscription-id>                  Transition subscription → expired (terminal)\n  auto-archive-idle-tenants                                        Bulk-flip idle tenants → archived\n  auto-expire-past-due-subscriptions                               Bulk-flip past-due subscriptions past grace → expired\n  stats-v2 [options]                                               Show V2 SaaS stats (all-enum-key)\n  help [command]                                                   display help for command\n",
     "terminal-setup": "Usage: chainlesschain terminal-setup [options]\n\nBind Shift+Enter to a REPL newline (Claude-Code parity)\n\nOptions:\n  --apply     Write the keybinding (VS Code only; otherwise prints steps)\n  -h, --help  display help for command\n",

package/src/command-manifest.json

@@ -111,7 +111,7 @@
     },
     {
       "name": "agent",
-      "aliases": ["a"],
+      "aliases": ["a", "exec"],
       "module": "./commands/agent.js",
       "register": "registerAgentCommand",
       "summary": "Start an agentic AI session (reads/writes files, runs commands)",

package/src/commands/agent.js

@@ -231,7 +231,7 @@ export function resolveAgentObservabilityScope(options = {}) {
 export function registerAgentCommand(program) {
   program
     .command("agent")
-    .alias("a")
+    .aliases(["a", "exec"])
     .description(
       "Start an agentic AI session (reads/writes files, runs commands)",
     )

package/src/commands/graph.js

@@ -0,0 +1,100 @@
+import path from "node:path";
+import { JsonlRolloutStore } from "../lib/app-server/rollout-store.js";
+import {
+  GraphEventStore,
+  defaultGraphEventStoreDirectory,
+} from "../lib/graph-kernel/event-store.js";
+import {
+  diffGraphTrace,
+  locateBlockedRoot,
+  reduceGraphTrace,
+  timeTravelGraphTrace,
+} from "../lib/graph-kernel/trace-reducer.js";
+import {
+  enforceGraphEvalThresholds,
+  evaluateGraphProjection,
+} from "../lib/graph-kernel/eval.js";
+
+function store(directory) {
+  return new GraphEventStore({
+    rolloutStore: new JsonlRolloutStore({
+      directory: path.resolve(directory || defaultGraphEventStoreDirectory()),
+    }),
+  });
+}
+
+function print(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+export function registerGraphCommand(program) {
+  const graph = program
+    .command("graph")
+    .description(
+      "Inspect, time-travel, diff, and evaluate canonical GraphRuns",
+    );
+
+  graph
+    .command("inspect <runId>")
+    .description(
+      "Project a durable GraphRun into Agent/Task/Artifact/Trace views",
+    )
+    .option("--state-dir <path>", "Graph rollout directory")
+    .option("--at-seq <n>", "Time-travel through a durable event sequence")
+    .option("--blocked-root <nodeId>", "Locate a deterministic blocked root")
+    .option("--include-content", "Include message and HumanTask content")
+    .action((runId, options) => {
+      const events = store(options.stateDir).read(runId);
+      const projection = options.atSeq
+        ? timeTravelGraphTrace(events, Number(options.atSeq), {
+            includeContent: options.includeContent === true,
+          })
+        : reduceGraphTrace(events, {
+            includeContent: options.includeContent === true,
+          });
+      print(
+        options.blockedRoot
+          ? {
+              projection,
+              blockedRoot: locateBlockedRoot(projection, options.blockedRoot),
+            }
+          : projection,
+      );
+    });
+
+  graph
+    .command("diff <runId>")
+    .description("Diff two time-travel projections of one GraphRun")
+    .requiredOption("--from-seq <n>", "First durable event sequence")
+    .requiredOption("--to-seq <n>", "Second durable event sequence")
+    .option("--state-dir <path>", "Graph rollout directory")
+    .action((runId, options) => {
+      const events = store(options.stateDir).read(runId);
+      print(
+        diffGraphTrace(
+          timeTravelGraphTrace(events, Number(options.fromSeq)),
+          timeTravelGraphTrace(events, Number(options.toSeq)),
+        ),
+      );
+    });
+
+  graph
+    .command("eval <runId>")
+    .description(
+      "Evaluate a durable GraphRun and optionally enforce thresholds",
+    )
+    .option("--state-dir <path>", "Graph rollout directory")
+    .option(
+      "--thresholds <json>",
+      'Metric threshold object, e.g. \'{"deadlocked":{"max":0}}\'',
+    )
+    .action((runId, options) => {
+      const projection = reduceGraphTrace(store(options.stateDir).read(runId));
+      const report = evaluateGraphProjection(projection);
+      const gate = options.thresholds
+        ? enforceGraphEvalThresholds(report, JSON.parse(options.thresholds))
+        : null;
+      print({ report, gate });
+      if (gate && !gate.passed) process.exitCode = 2;
+    });
+}

package/src/commands/orchestrate.js

@@ -57,6 +57,21 @@ export function registerOrchestrateCommand(program) {
     .option("--interval <min>", "Cron interval in minutes (watch mode)", "10")
     .option("--webhook", "Start HTTP webhook server for IM platform commands")
     .option("--webhook-port <port>", "Webhook server port", "18820")
+    .option(
+      "--webhook-secret-env <name>",
+      "Environment variable containing the webhook HMAC secret",
+      "CC_ORCHESTRATE_WEBHOOK_SECRET",
+    )
+    .option(
+      "--webhook-max-body-bytes <n>",
+      "Maximum authenticated webhook request body",
+      "262144",
+    )
+    .option(
+      "--webhook-rate-limit <n>",
+      "Maximum webhook requests per source and minute",
+      "30",
+    )
     .option("--json", "Output as JSON")
     .option("--verbose", "Verbose output");
 
@@ -90,8 +105,7 @@ export function registerOrchestrateCommand(program) {
       return;
     }
 
-    const { Orchestrator, TASK_SOURCE, TASK_STATUS } =
-      await import("../lib/orchestrator.js");
+    const { Orchestrator } = await import("../lib/orchestrator.js");
 
     const cwd = options.cwd ? path.resolve(options.cwd) : process.cwd();
 
@@ -137,7 +151,6 @@ export function registerOrchestrateCommand(program) {
     // Build agent backends from --backends option
     let agentsConfig;
     if (options.backends) {
-      const { BACKEND_TYPE } = await import("../lib/agent-router.js");
       const backendNames = options.backends.split(",").map((s) => s.trim());
       agentsConfig = {
         backends: backendNames.map((type) => ({ type, weight: 1 })),
@@ -340,8 +353,6 @@ export function registerOrchestrateCommand(program) {
 // ─── Pretty (interactive) run ────────────────────────────────────
 
 async function _runPretty(orch, taskText, options, cwd) {
-  const { TASK_STATUS } = await import("../lib/orchestrator.js");
-
   console.log(chalk.bold.cyan("\n⚡ ChainlessChain Orchestrator\n"));
   console.log(chalk.gray(`  Task:    `) + chalk.white(taskText.slice(0, 120)));
   console.log(chalk.gray(`  CWD:     `) + chalk.white(cwd));
@@ -377,7 +388,7 @@ async function _runPretty(orch, taskText, options, cwd) {
     spinner.text = `Running CI check (attempt ${attempt + 1})...`;
   });
 
-  orch.on("ci:fail", ({ errors, attempt }) => {
+  orch.on("ci:fail", ({ attempt }) => {
     spinner.text = `CI failed (attempt ${attempt + 1}) — retrying with agents...`;
   });
 
@@ -508,11 +519,25 @@ async function _webhookMode(cwd, options) {
   const { createServer } = await import("http");
   const { parseDingTalkIncoming, parseFeishuIncoming, parseWeComIncoming } =
     await import("../lib/notifiers/index.js");
-  const { Orchestrator, TASK_SOURCE } = await import("../lib/orchestrator.js");
+  const { Orchestrator } = await import("../lib/orchestrator.js");
+  const { WebhookSecurityGate } = await import("../lib/webhook-security.js");
 
   const port = parseInt(options.webhookPort, 10) || 18820;
 
   const orch = new Orchestrator({ cwd, verbose: options.verbose });
+  const secretEnvironmentName =
+    options.webhookSecretEnv || "CC_ORCHESTRATE_WEBHOOK_SECRET";
+  if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(secretEnvironmentName)) {
+    throw new Error("--webhook-secret-env must be a valid environment name");
+  }
+  const securityGate = new WebhookSecurityGate({
+    secret: process.env[secretEnvironmentName],
+    maxRequestsPerMinute: parseInt(options.webhookRateLimit, 10) || 30,
+  });
+  const maxBodyBytes = Math.max(
+    1,
+    parseInt(options.webhookMaxBodyBytes, 10) || 262144,
+  );
 
   const server = createServer(async (req, res) => {
     if (req.method !== "POST") {
@@ -521,25 +546,71 @@ async function _webhookMode(cwd, options) {
       return;
     }
 
+    const url = req.url?.split("?")[0] || "/";
+    const channel =
+      url === "/wecom"
+        ? "wecom"
+        : url === "/dingtalk"
+          ? "dingtalk"
+          : url === "/feishu"
+            ? "feishu"
+            : null;
+    if (!channel) {
+      res.writeHead(404);
+      res.end("Not Found");
+      return;
+    }
+    if (Number(req.headers["content-length"] || 0) > maxBodyBytes) {
+      res.writeHead(413);
+      res.end("Payload Too Large");
+      req.resume();
+      return;
+    }
     const bodyChunks = [];
-    req.on("data", (chunk) => bodyChunks.push(chunk));
+    let bodyBytes = 0;
+    let bodyRejected = false;
+    req.on("data", (chunk) => {
+      if (bodyRejected) return;
+      bodyBytes += chunk.length;
+      if (bodyBytes > maxBodyBytes) {
+        bodyRejected = true;
+        res.writeHead(413);
+        res.end("Payload Too Large");
+        return;
+      }
+      bodyChunks.push(chunk);
+    });
     req.on("end", async () => {
+      if (bodyRejected) return;
       // Decode once: per-chunk toString() would corrupt a multi-byte UTF-8
       // char (e.g. Chinese IM webhook text) split across a chunk boundary.
       const body = Buffer.concat(bodyChunks).toString("utf-8");
       let taskText = null;
-      let source = TASK_SOURCE.CLI;
+      let source = `webhook:${channel}`;
+      let verified;
 
-      const url = req.url?.split("?")[0] || "/";
+      try {
+        verified = securityGate.verify({
+          channel,
+          headers: req.headers,
+          body,
+          remoteAddress: req.socket.remoteAddress || "unknown",
+        });
+      } catch (error) {
+        if (error?.retryAfterSeconds) {
+          res.setHeader("Retry-After", String(error.retryAfterSeconds));
+        }
+        res.writeHead(error?.statusCode || 401);
+        res.end("Unauthorized");
+        return;
+      }
 
       try {
         if (url === "/wecom") {
           taskText = parseWeComIncoming(body);
-          source = TASK_SOURCE.CLI;
         } else if (url === "/dingtalk") {
           const parsed = JSON.parse(body);
           taskText = parseDingTalkIncoming(parsed);
-          source = TASK_SOURCE.CLI;
         } else if (url === "/feishu") {
           const parsed = JSON.parse(body);
           // Feishu challenge verification
@@ -549,13 +620,8 @@ async function _webhookMode(cwd, options) {
             return;
           }
           taskText = parseFeishuIncoming(parsed);
-          source = TASK_SOURCE.CLI;
-        } else {
-          res.writeHead(404);
-          res.end("Not Found");
-          return;
         }
-      } catch (_err) {
+      } catch {
         res.writeHead(400);
         res.end("Bad Request");
         return;
@@ -586,6 +652,7 @@ async function _webhookMode(cwd, options) {
         .addTask(taskText, {
           source,
           cwd,
+          dataPolicy: verified.dataPolicy,
           runCI: options.ci !== false,
           notify: true,
         })

package/src/commands/serve.js

@@ -5,11 +5,25 @@
 
 import { logger } from "../lib/logger.js";
 import { createAgentRuntimeFactory } from "../runtime/runtime-factory.js";
+import path from "node:path";
 
 export function registerServeCommand(program) {
   program
     .command("serve")
     .description("Start WebSocket server for remote CLI access")
+    .option(
+      "--app-server",
+      "Run the canonical CC App Server over stdio instead of the legacy WebSocket server",
+    )
+    .option(
+      "--app-server-state-dir <path>",
+      "Owner-controlled rollout directory for --app-server",
+    )
+    .option(
+      "--app-server-queue-cap <n>",
+      "Maximum queued App Server requests",
+      "256",
+    )
     .option("-p, --port <port>", "Port number", "18800")
     .option("-H, --host <host>", "Bind host", "127.0.0.1")
     .option(
@@ -45,6 +59,31 @@ export function registerServeCommand(program) {
     )
     .action(async (opts) => {
       try {
+        if (opts.appServer) {
+          const [
+            { runStdioAppServer },
+            { JsonlRolloutStore },
+            { CliAgentKernelAdapter },
+          ] = await Promise.all([
+            import("../lib/app-server/stdio-transport.js"),
+            import("../lib/app-server/rollout-store.js"),
+            import("../lib/app-server/cli-agent-kernel-adapter.js"),
+          ]);
+          const stateDirectory = opts.appServerStateDir
+            ? path.resolve(opts.appServerStateDir)
+            : undefined;
+          await runStdioAppServer({
+            store: new JsonlRolloutStore({ directory: stateDirectory }),
+            kernel: new CliAgentKernelAdapter({
+              cwd: opts.project ? path.resolve(opts.project) : process.cwd(),
+            }),
+            maxQueuedRequests: Math.max(
+              1,
+              parseInt(opts.appServerQueueCap, 10) || 256,
+            ),
+          });
+          return;
+        }
         const runtime = createAgentRuntimeFactory().createServerRuntime({
           port: parseInt(opts.port, 10),
           host: opts.host,

package/src/commands/team.js

@@ -46,6 +46,7 @@ import { stopBackgroundAgentChildTree } from "../lib/background-agent-supervisor
 import { redactSecrets } from "../lib/secret-scan.js";
 import { tightenPermissionMode } from "../lib/subagent-contract.js";
 import { TeamRunStateLock } from "../lib/agent-team/team-run-state-lock.js";
+import { registerGraphCommand } from "./graph.js";
 import {
   computeTeamAdjudicationEvidenceDigest,
   TeamAdjudicationStore,
@@ -1453,6 +1454,7 @@ export function registerTeamCommand(program, { logger } = {}) {
     buildAgentPrompt: buildTeamAgentPrompt,
   });
   registerTeamMergeReviewCommands(team, { logger: log });
+  registerGraphCommand(team);
 
   team
     .command("control-bindings")

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.1",
+      "cliVersions": ["0.1.1", "0.2.1", "0.166.0", "0.166.1"],
+      "date": "2026-08-24",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.1 + Agent Protocol 0.1.1 + Agent SDKs 0.2.1: structured Graph execution",
+          "body": "> `chainlesschain` **0.166.0 -> 0.166.1**,\n> `@chainlesschain/agent-protocol` **0.1.0 -> 0.1.1**,\n> `@chainlesschain/agent-sdk` **0.2.0 -> 0.2.1**, and\n> `chainlesschain-agent-sdk` **0.2.0 -> 0.2.1** (release candidate,\n> 2026-08-24).\n\n- **Typed subgraphs with budget isolation**: subgraph calls now validate\n  parent/child input and output mappings before effects, reserve durable\n  per-call budget slices, prevent parallel oversubscription, and settle only\n  the child run's actual usage across completion, cancellation, and recovery.\n- **Effectful bounded loops**: loop effects receive deterministic\n  iteration-scoped idempotency keys and receipts. Compensation executes once\n  per committed iteration in reverse dependency/iteration order and resumes\n  safely after interruption or budget exhaustion.\n- **Graph migration and rollback**: the compiler includes a built-in v0-to-v1\n  upcaster, frozen minimal and typed N/N-1 corpora, immutable pre-migration\n  backups, domain-separated rollback digests, and tamper-evident restore.\n- **Cross-language delivery**: the canonical schema and generated TypeScript,\n  Python, Kotlin, and Swift bindings expose the new subgraph budget/mapping and\n  effect iteration lineage fields without adding SDK runtime dependencies.\n- **Release validation**: publication requires this exact release commit to\n  pass the complete Linux, Windows, and macOS `CLI CI`, `CLI Strict Sandbox`,\n  and Agent Protocol matrices plus Python 3.10/3.12/3.13 SDK conformance."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.0",
+      "cliVersions": ["0.2.0", "0.165.10", "0.166.0"],
+      "date": "2026-08-24",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.0 + Agent SDKs 0.2.0: canonical App Server and Graph kernels",
+          "body": "> `chainlesschain` **0.165.10 -> 0.166.0**,\n> `@chainlesschain/agent-sdk` **0.1.7 -> 0.2.0**, and\n> `chainlesschain-agent-sdk` **0.1.0 -> 0.2.0** (release candidate,\n> 2026-08-24). `@chainlesschain/agent-protocol` remains a private build-time\n> source of truth and is not a runtime dependency or public package.\n\n- **Canonical cross-language protocol**: one private schema and deterministic\n  generator now produce the TypeScript and Python App Server contracts,\n  including Python 3.10-compatible reserved-field and optional-key handling.\n- **Durable App Server**: JSON-RPC request/notification streaming, thread\n  lifecycle, subscriptions, checkpoints, compaction, replay, and forking share\n  JSONL, memory, and capability-gated SQLite rollout stores.\n- **Graph execution kernel**: durable DAG execution adds checkpointed state,\n  interrupt/resume, record/replay, event projections, evaluation hooks, and\n  observable execution evidence.\n- **Secure integrations**: signed webhook delivery rejects stale or replayed\n  requests, the Codex App adapter consumes the canonical protocol, and the\n  governed `cc exec` path is exposed without duplicating authority.\n- **Release validation**: publication requires this exact release commit to\n  pass the complete Linux, Windows, and macOS `CLI CI` and\n  `CLI Strict Sandbox` matrices, plus Python 3.10/3.12/3.13 SDK conformance,\n  before the immutable npm and PyPI tags are created."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.165.10",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Fixed - cc CLI 0.165.10: restore Docker-optional startup",
-          "body": "> `chainlesschain` **0.165.9 -> 0.165.10** and\n> `@chainlesschain/session-core` **0.3.5 -> 0.3.6** (hotfix candidate,\n> 2026-08-24). `@chainlesschain/personal-data-hub` remains **0.4.59** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Windows startup regression**: starting `cc` without an explicit container\n  sandbox no longer requires Docker or exits with configuration code 6 when\n  Docker is unavailable. Explicit `--sandbox`, `--sandbox-mode\n  workspace-write|strict`, and managed sandbox policy remain fail-closed.\n- **Session contract delivery**: publish the `runtime-claims` export added\n  after `session-core@0.3.5`, and pin the CLI to `session-core@0.3.6`, so npm\n  installs receive the same runtime contract used by the release source.\n- **Release status**: publication requires this candidate's exact commit to\n  pass the complete Linux, Windows, and macOS `CLI CI` and\n  `CLI Strict Sandbox` matrices before the immutable npm tag is created."
+          "body": "> `chainlesschain` **0.165.9 -> 0.165.10** and\n> `@chainlesschain/session-core` **0.3.5 -> 0.3.6** (hotfix candidate,\n> 2026-08-24). `@chainlesschain/personal-data-hub` remains **0.4.59** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Windows startup regression**: starting `cc` without an explicit container\n  sandbox no longer requires Docker or exits with configuration code 6 when\n  Docker is unavailable. Explicit `--sandbox`,\n  `--sandbox-mode workspace-write|strict`, and managed sandbox policy remain\n  fail-closed.\n- **Session contract delivery**: publish the `runtime-claims` export added\n  after `session-core@0.3.5`, and pin the CLI to `session-core@0.3.6`, so npm\n  installs receive the same runtime contract used by the release source.\n- **Release status**: publication requires this candidate's exact commit to\n  pass the complete Linux, Windows, and macOS `CLI CI` and\n  `CLI Strict Sandbox` matrices before the immutable npm tag is created."
         }
       ]
     },