copilotkit 4.9.60 → 4.10.1

package/onboarding/prompts/feature/voice/implement.md

@@ -11,18 +11,47 @@ type/test command and start the app. Confirm `/info` reports
 `audioFileTranscriptionEnabled`, but treat it as capability evidence rather than completed
 voice proof. Record changed paths and validation results.
 
-When implementation validation passes, report it:
+After validation and each repair, run:
+
+```text
+npx --yes copilotkit@4.10.1 onboard audit
+```
+
+Continue only when it starts with `Status: passed`. A path under `Authorized to change:` is
+not a finding. Carry it into the final summary with its reason.
+
+If the audit fails, never repair, reset, or revert a protected path. Compare each named path
+with the implementation subagent's `Files changed` section. If that section does not name
+the path, accept the developer's external change:
+
+```text
+npx --yes copilotkit@4.10.1 onboard protect --accept-external --path <path>
+```
+
+For an env file where the developer placed a requested credential, use
+`onboard protect --accept-credential --path <path>` instead. If the subagent names the path,
+or its report does not settle who changed it, ask the developer to allow the unplanned
+change. Only after they agree, record their answer:
+
+```text
+npx --yes copilotkit@4.10.1 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
+```
+
+Run the audit again after each accepted or authorized change. If it still fails, or starts
+with `Status: blocked`, route out and stop:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase build-validated
+npx --yes copilotkit@4.10.1 onboard read feature/stop
 ```
 
-If validation cannot pass, or this intent needs a prerequisite the app does not have, stop
-without further changes:
+When implementation validation passes, report it:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard read feature/stop
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase build-validated
 ```
 
+If validation cannot pass, or this intent needs a prerequisite the app does not have, use
+the feature stop route above without further changes.
+
 Otherwise run
-`npx --yes copilotkit@4.9.60 onboard read feature/voice/proof`.
+`npx --yes copilotkit@4.10.1 onboard read feature/voice/proof`.

package/onboarding/prompts/feature/voice/proof.md

@@ -13,15 +13,40 @@ path, agent response, app URL, and process IDs. Fix changed-file defects and rep
 Report each attempt at the proof as it ends, counting from one:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase journey-attempted --attempt 1
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase journey-attempted --attempt 1
 ```
 
 Report each repair cycle the same way, counting from one:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase repair-attempted --attempt 1
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase repair-attempted --attempt 1
 ```
 
-Then run
-`npx --yes copilotkit@4.9.60 onboard complete --visual-check <performed|skipped-no-browser-tool|failed>`
-with the actual surface outcome.
+After the final attempt, report the gate exactly once:
+
+```text
+npx --yes copilotkit@4.10.1 onboard proof --step round-trip --outcome <passed|failed|skipped>
+```
+
+Use `passed` only for proved voice input, `failed` for an attempted proof that failed, and
+`skipped` when the proof could not run. Then run `npx --yes copilotkit@4.10.1 onboard audit`.
+Continue only when it starts with `Status: passed`.
+
+If the audit fails, never repair, reset, or revert a protected path. Compare each named path
+with the proof subagent's `Files changed` section. If that section does not name the path,
+run `onboard protect --accept-external --path <path>`, or
+`onboard protect --accept-credential --path <path>` for an env file where the developer
+placed a requested credential. If the subagent names the path, or its report does not settle
+who changed it, ask the developer to allow it. Only after they agree, run
+`onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`.
+Run the audit again after each accepted or authorized change.
+
+If the audit still fails, or starts with `Status: blocked`, route out and stop:
+
+```text
+npx --yes copilotkit@4.10.1 onboard read feature/stop
+```
+
+When the audit passes, run
+`npx --yes copilotkit@4.10.1 onboard read feature/complete` with the actual surface
+outcome.

package/onboarding/prompts/feature/voice/start.md

@@ -3,17 +3,27 @@
 Treat voice as an OSS enhancement to an existing CopilotKit chat. Orchestrate with separate
 read-only, implementation, and proof subagents, each restricted to the target project.
 
+Before any subagent or project process runs, capture the developer's existing work:
+
+```text
+npx --yes copilotkit@4.10.1 onboard protect
+```
+
+Keep the exact protected path list it prints and give that list to every subagent. No
+subagent may write a protected path or an overlapping path unless this run records the
+approved authorization before implementation.
+
 Before edits, inspect the runtime route, CopilotKit provider/chat composer, current agent,
 existing provider credential variable names (presence only), package versions, browser
 permissions approach, and test/dev commands. Prove the existing OSS baseline with `/info`,
-`npx --yes copilotkit@4.9.60 verify --expect-runtime oss --round-trip --agent <agent-id> --json`,
+`npx --yes copilotkit@4.10.1 verify --expect-runtime oss --round-trip --agent <agent-id> --json`,
 and a real UI request when a browser is available. If that baseline is absent, change nothing
 and direct the developer to generic onboarding first.
 
 Wait for the inspection subagent to finish. Then report that the inspection came back:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase research-returned
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase research-returned
 ```
 
 A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
@@ -23,7 +33,7 @@ If the inspection did not prove the baseline this intent extends, stop here with
 changing files:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard read feature/stop
+npx --yes copilotkit@4.10.1 onboard read feature/stop
 ```
 
 Do not run login, select Intelligence, create a credential, read a credential value, or
@@ -36,10 +46,23 @@ stop rather than writing a placeholder.
 Show a small plan for the documented transcription service, the existing composer, focused
 tests, and a microphone/canned-transcript proof. Ask for approval separately.
 
-After approval, report the plan this run is about to implement:
+The plan must list every protected path it needs to change under `Authorization requested`,
+with one sentence explaining why. Write `None` when it needs none.
+
+After approval, record each approved path before implementation:
+
+```text
+npx --yes copilotkit@4.10.1 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
+```
+
+If an approved path changed after capture and no implementation step has run, add
+`--with-prior-change`. Continue only when every result starts with `Status: passed`. Do not
+authorize a path the approved plan did not list.
+
+Then report the plan this run is about to implement:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase plan-written
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase plan-written
 ```
 
-Then run `npx --yes copilotkit@4.9.60 onboard read feature/voice/implement`.
+Then run `npx --yes copilotkit@4.10.1 onboard read feature/voice/implement`.

package/onboarding/prompts/framework/ag2.md

@@ -31,7 +31,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the A2UI documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/agno.md

@@ -34,7 +34,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, the documented dependencies and adapter, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/built-in.md

@@ -27,7 +27,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/claude-sdk-python.md

@@ -33,7 +33,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context limit.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/claude-sdk-typescript.md

@@ -37,7 +37,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context limit.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/crewai-flows.md

@@ -54,7 +54,7 @@ variable names the repository proves or the developer named, these URLs, the ada
 shared-state limit.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/deep-agents.md

@@ -29,7 +29,7 @@ Record the selected framework, language, vendor, model, required credential vari
 names, these URLs, and each documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/google-adk.md

@@ -28,7 +28,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/langgraph-fastapi.md

@@ -24,7 +24,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/langgraph-python.md

@@ -15,7 +15,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/langgraph-typescript.md

@@ -15,7 +15,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/llamaindex.md

@@ -34,7 +34,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, the documented dependencies and adapter, and both documentation limits.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/mastra.md

@@ -45,7 +45,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/ms-agent-dotnet.md

@@ -34,7 +34,7 @@ Record the selected framework, provider, model, required credential variable nam
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/ms-agent-harness-dotnet.md

@@ -44,7 +44,7 @@ Record the selected framework, provider, model, required credential variable nam
 URLs, and the quickstart gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/ms-agent-python.md

@@ -28,7 +28,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/pydantic-ai.md

@@ -43,7 +43,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the two-step context route.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/strands-python.md

@@ -27,7 +27,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/strands-typescript.md

@@ -28,7 +28,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
+`npx --yes copilotkit@4.10.1 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/angular.md

@@ -5,7 +5,7 @@ Preserve an existing Angular frontend. Use the selected page for a new frontend.
 Use the starter shortcut only if all these facts are true: the target directory contains
 no entries, its name is a valid `init` project name, and the selected framework is ADK.
 If all three facts are true, record Angular as the selected frontend. Then run
-`npx --yes copilotkit@4.9.60 onboard read starter/clone` before you fetch documentation.
+`npx --yes copilotkit@4.10.1 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -63,7 +63,7 @@ you create or build an Angular project. If the installed version is lower, selec
 supported version first and use it for every later command in this project.
 
 If the pages support the selection, record Angular and these URLs. Then run
-`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.10.1 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, or the two version lines do not fit
-together, run `npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+together, run `npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/nextjs.md

@@ -15,7 +15,7 @@ These TypeScript options have starters: Claude Agent SDK TypeScript, LangGraph T
 Mastra, and Strands Agents TypeScript. The .NET option is Microsoft Agent Framework .NET.
 
 If all shortcut conditions are true, record Next.js as the selected frontend. Then run
-`npx --yes copilotkit@4.9.60 onboard read starter/clone` before you fetch documentation.
+`npx --yes copilotkit@4.10.1 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -27,7 +27,7 @@ agent as the default agent, which is correct only for a project that has no agen
 Do not replace the developer's existing agent with the built-in agent.
 
 If the page supports the selection, record Next.js and this URL. Then run
-`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.10.1 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/plan.md

@@ -24,11 +24,11 @@ process.
 
 Use exactly one matching internal route:
 
-1. React SPA: `npx --yes copilotkit@4.9.60 onboard read frontend/react-spa`
-2. Next.js: `npx --yes copilotkit@4.9.60 onboard read frontend/nextjs`
-3. Angular: `npx --yes copilotkit@4.9.60 onboard read frontend/angular`
-4. Vue 3: `npx --yes copilotkit@4.9.60 onboard read frontend/vue`
-5. React Native: `npx --yes copilotkit@4.9.60 onboard read frontend/react-native`
+1. React SPA: `npx --yes copilotkit@4.10.1 onboard read frontend/react-spa`
+2. Next.js: `npx --yes copilotkit@4.10.1 onboard read frontend/nextjs`
+3. Angular: `npx --yes copilotkit@4.10.1 onboard read frontend/angular`
+4. Vue 3: `npx --yes copilotkit@4.10.1 onboard read frontend/vue`
+5. React Native: `npx --yes copilotkit@4.10.1 onboard read frontend/react-native`
 
 If no listed frontend fits, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-native.md

@@ -15,7 +15,7 @@ documents `useRenderTool`, which is React Native's own hook for drawing a tool t
 already has. That is a different job and needs a tool in the agent.
 
 If the pages support the selection, record React Native and these URLs. Then run
-`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.10.1 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-spa.md

@@ -11,7 +11,7 @@ not move the agent into it.
 - https://docs.copilotkit.ai/react-spa.md
 
 If the page supports the selection, record React SPA and this URL. Then run
-`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.10.1 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/vue.md

@@ -16,7 +16,7 @@ page above. Vue has its own `useComponent`, which is not the React package. Take
 that reference page rather than from a Vue generative-UI guide, which is not published.
 
 If the pages support the selection, record Vue 3 and these URLs. Then run
-`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.10.1 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/implementation/build-and-validate.md

@@ -2,6 +2,28 @@
 
 Do not implement the plan yourself. Use the step order in the approved plan.
 
+## If you stop in this phase
+
+One rule below stops onboarding: a Learning Container create that fails for a reason other
+than the container already existing. It ends a run the developer has already approved a
+plan for. Name the exact command, id, and error code that stopped you: a report that names
+only the step cannot be acted on. Send one short report before you stop. Run the friction command without another developer question. The CLI telemetry gate decides whether the
+report is sent.
+
+```text
+npx --yes copilotkit@4.10.1 onboard friction --phase stop --category <slug>
+```
+
+Write one or two sentences to standard input: the step you stopped at and what stopped it.
+Pick the category that fits from docs-missing, docs-wrong, docs-sequential, cli-gap,
+sdk-gap, environment, port-collision, credential, validation-loop, and other. Leave
+--cost-seconds off. A run that stopped cannot separate one papercut's cost from the cost
+of the whole run, so the estimate is optional on a stop report and only there.
+Send no secrets, source code, logs, or command output. The command refuses a report that
+carries any of those, prints the reason, and exits zero. A refused report is not a failed
+step. Send the report, then stop. Reporting is not a route change and does not resume the
+run.
+
 ## Authorization requested by the plan
 
 Approving the plan is the developer agreeing to every path it listed under
@@ -9,7 +31,7 @@ Approving the plan is the developer agreeing to every path it listed under
 app directory:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
+npx --yes copilotkit@4.10.1 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
 ```
 
 Consent has to be on the record before the file moves, so a call made after the change is
@@ -21,7 +43,7 @@ No implementation step has run yet, so the change is theirs rather than this run
 consent over it by adding one flag:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
+npx --yes copilotkit@4.10.1 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
 ```
 
 The flag records their change as drift beside the consent, so the closing report names both
@@ -40,7 +62,7 @@ rather than this section.
 Run the audit from the target app directory:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard audit
+npx --yes copilotkit@4.10.1 onboard audit
 ```
 
 It compares every protected path with the digest the CLI captured for it. Its result starts
@@ -75,14 +97,14 @@ A path that no Files changed section names changed outside the run, and it is th
 developer's own file. Accept it by name:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard protect --accept-external --path <path>
+npx --yes copilotkit@4.10.1 onboard protect --accept-external --path <path>
 ```
 
 A changed env file is its own case. This run asked the developer to place a credential
 there, so it takes the credential route rather than this one:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard protect --accept-credential --path <path>
+npx --yes copilotkit@4.10.1 onboard protect --accept-credential --path <path>
 ```
 
 That route proves no recorded credential was lost, instead of taking the run's word that it
@@ -101,7 +123,7 @@ neither does a one-line fix. Never repair, reset, or revert it. Ask the develope
 the change, and record the answer they give:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
+npx --yes copilotkit@4.10.1 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
 ```
 
 Use it only for an answer a developer actually gave. It records the consent as taken
@@ -115,14 +137,43 @@ protected path as changed. Report the printed reason and use the route-out rules
 An audit that has not passed never continues the run by itself. Continue only after an
 acceptance clears it, or route out. Do not send an audit result to a repair worker.
 
+## Create the approved Learning Container
+
+Where the approved plan names a Learning Container id that the platform does not hold yet,
+create it now, from the target app directory. The developer approved the id before it was
+made, so this is the first point at which it can be created:
+
+```text
+npx --yes copilotkit@4.10.1 learning containers create --id <id> --name <name> --json
+```
+
+Pass the id the plan names. Take the name from the selected project's own display name, so
+the container reads as this project's in the dashboard. Both flags are required alongside
+`--json`: a create that leaves either one out is refused as `NON_INTERACTIVE` rather than
+prompted for, whatever terminal the run has.
+
+`LEARNING_CONTAINER_ALREADY_EXISTS` means another run already made it. That is a container
+to reuse, not a failure to repair and not a reason to pick a new id. Any other error code:
+report it and stop onboarding, so no run wires a selector to an id the platform does not
+hold.
+
+Then report that the container is settled, before any edit:
+
+```text
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase container-settled
+```
+
+Where the plan names a container the platform already held, report the same checkpoint and
+create nothing. Where the plan names no container, skip this section.
+
 Report the plan this run is about to implement:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase plan-written
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase plan-written
 ```
 
 Spawn one implementation subagent. Tell it to run
-`npx --yes copilotkit@4.9.60 onboard read subagent/implement-and-validate` first and follow
+`npx --yes copilotkit@4.10.1 onboard read subagent/implement-and-validate` first and follow
 the prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the plan, selected framework, frontend, model, exact target app
@@ -142,11 +193,11 @@ returned. Continue to proof only when that audit passes.
 After the selected implementation path passes, report it:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase build-validated
+npx --yes copilotkit@4.10.1 onboard checkpoint --phase build-validated
 ```
 
 Then run
-`npx --yes copilotkit@4.9.60 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.10.1 onboard read proof/round-trip`.
 
 ## Repair rules
 
@@ -160,8 +211,17 @@ implementation path.
 
 ## Route-out rules
 
-Route out for `Status: blocked`. Route out only when the failure is not yours to fix: the
-failure is in code this run did not write, the fix requires changing the developer's existing
-agent or frontend, the same command still fails after three repair attempts, or the
-documentation does not support the plan. In those cases run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+Route out only when the failure is not yours to fix. Two endings are open from here, and
+what failed decides which one this run takes.
+
+A run that broke takes the failure ending: the failure is in code this run did not write,
+the same command still fails after three repair attempts, or a result starts with
+`Status: blocked`. A defect in a package this run installed is not a stack CopilotKit does
+not serve, a command this run cannot get to pass is not one either, and a blocked audit
+proved nothing about the stack. In those cases run
+`npx --yes copilotkit@4.10.1 onboard read stopped/run-failed`.
+
+A plan with no path to follow takes the unsupported ending: the fix requires changing the
+developer's existing agent or frontend, or the documentation does not support the plan. In
+those cases run
+`npx --yes copilotkit@4.10.1 onboard read unsupported/no-validated-path`.