demobite 1.2.0 → 1.3.1

package/README.md

@@ -130,6 +130,8 @@ When your UI changes, **Retake** can refilm an existing Bite from its saved reci
 npx demobite retake <biteId> --note "Export moved to the header"
 ```
 
+**Batches of briefs.** When a pull request in DemoBites produces approved briefs, your agent claims them, films one take per brief after you approve each storyboard, and delivers each take. A delivered take becomes a Bite in DemoBites by itself; there is no second review click for these takes. Nothing is published or shared.
+
 The package also includes a DemoBites management MCP for releases and centers:
 
 ```bash
@@ -148,9 +150,8 @@ The default installer also attempts to register that MCP with Claude Code when t
 | `skill/` | Studio-connected recorder instructions, login, upload, and Retake. |
 | `scripts/` | Shared browser recording, trimming, and timing calibration. |
 | `recorder/` | Standalone skill and local video finishing tools. |
-| `aliases/` | `agentic-recorder` and `demobites` aliases for the same launcher. |
 
-Run `npx demobite@latest` again to update the installed skill. For publishing instructions, see [RELEASING.md](RELEASING.md).
+The same package is published under three names, `demobite`, `agentic-recorder` and `demobites`, always at the same version; `npx agentic-recorder@latest` and `npx demobites@latest` do exactly what `npx demobite@latest` does. Run it again to update the installed skill. For publishing instructions, see [RELEASING.md](RELEASING.md).
 
 Found something confusing or have an example to share? [Open an issue](https://github.com/demobites/agentic-recorder/issues). Include your operating system, agent, and recorder version. Remove keys, cookies, and private app data from logs or recordings before attaching them.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "demobite",
-  "version": "1.2.0",
-  "description": "The DemoBites agentic recorder \u2014 you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
+  "version": "1.3.1",
+  "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobite": "launcher/index.mjs"
   },
@@ -36,7 +36,7 @@
   "license": "MIT",
   "type": "module",
   "scripts": {
-    "check-aliases": "node scripts/check-aliases.mjs",
-    "prepublishOnly": "node scripts/check-aliases.mjs"
+    "release": "node scripts/release.mjs",
+    "prepublishOnly": "node scripts/check-release.mjs"
   }
 }

package/scripts/check-release.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// prepublishOnly guard: a bare `npm publish` ships ONE of the three names and
+// leaves the other two behind, which is exactly what the founder refused on
+// 2026-09-15. Publish through `npm run release`.
+if (process.env.DEMOBITE_RELEASE !== "1") {
+  console.error("Refusing a bare npm publish: demobite, agentic-recorder and demobites ship together. Run: npm run release");
+  process.exit(1);
+}

package/scripts/release.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// RELEASE (founder law, 2026-09-15): one package, three names, one version.
+// `demobite`, `agentic-recorder` and `demobites` on npm are the SAME full
+// package (launcher, skill, recorder, scripts), published together at the
+// same version. No aliases, no caret ranges, nothing to strand.
+//
+//   npm run release            publish package.json's version under all three names
+//   npm run release -- --dry-run
+//
+// For each name the script writes package.json with that name and a bin of
+// the same name, runs `npm publish`, and restores the original package.json
+// (also on failure). A bare `npm publish` is refused by prepublishOnly unless
+// this script set DEMOBITE_RELEASE, so nobody ships one name alone.
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+export const NAMES = ["demobite", "agentic-recorder", "demobites"];
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const pkgPath = path.join(root, "package.json");
+const original = fs.readFileSync(pkgPath, "utf8");
+const base = JSON.parse(original);
+const dryRun = process.argv.includes("--dry-run");
+if (base.name !== "demobite") { console.error(`package.json name is ${base.name}; expected demobite (a previous release did not restore it?)`); process.exit(1); }
+
+const published = [];
+try {
+  for (const name of NAMES) {
+    const pkg = { ...base, name, bin: { [name]: "launcher/index.mjs" } };
+    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+    console.log(`\n── ${name}@${base.version}${dryRun ? " (dry run)" : ""}`);
+    const r = spawnSync("npm", ["publish", "--access", "public", ...(dryRun ? ["--dry-run"] : [])], { cwd: root, stdio: "inherit", env: { ...process.env, DEMOBITE_RELEASE: "1" } });
+    if (r.status !== 0) { console.error(`\n${name}@${base.version} did not publish (exit ${r.status}). Published so far: ${published.join(", ") || "none"}. Fix and rerun; npm refuses to republish a version that already landed, so bump the patch if some names went out.`); process.exit(r.status ?? 1); }
+    published.push(name);
+  }
+} finally {
+  fs.writeFileSync(pkgPath, original);
+}
+if (dryRun) { console.log(`\nDry run ok for ${NAMES.join(", ")} at ${base.version}.`); process.exit(0); }
+console.log(`\nPublished ${NAMES.join(", ")} at ${base.version}. Verifying the registry…`);
+let bad = false;
+for (const name of NAMES) {
+  const v = spawnSync("npm", ["view", `${name}@${base.version}`, "version"], { encoding: "utf8" }).stdout.trim();
+  console.log(`  ${v.endsWith(base.version) ? "✓" : "✗"} ${name} → ${v || "(not visible yet)"}`);
+  if (!v.endsWith(base.version)) bad = true;
+}
+if (bad) console.error("Some names are not visible yet; npm can take a minute. Check again with: npm view <name> version");

package/skill/SKILL.md

@@ -9,7 +9,7 @@ You are the camera operator, the director, and the editor. You film a real brows
 
 All scripts live in `scripts/` beside this file. They are plain Node ESM. Requirements: Node 18+. `npx demobite` installs Playwright, ffmpeg and ffprobe beside the skill; every script resolves the media tools through `scripts/media-tools.mjs` (a compatible system build first, then the packaged one). Never call `ffmpeg` or `ffprobe` by bare name in a new script. Run every script from the project directory so `.recorder/` lands next to the project.
 
-Follow the phases in order. Never skip the storyboard approval. Never ingest before the human's word — for DemoBites, Approve on the in-app preview page IS the word.
+Follow the phases in order. Never skip the storyboard approval. Never ingest before the human's word — for DemoBites, Approve on the in-app preview page IS the word. For a batch of briefs the word was given twice already, on the batch and on each storyboard: a delivered take becomes a bite by itself (see Batch of briefs).
 
 ## Phase 0: Auth gate, ALWAYS FIRST — with the human's word
 
@@ -313,7 +313,9 @@ Laws for a re-take:
   with the bite's current text per step. Only remove lines whose beats you dropped.
 - **Same pacing laws apply** (intro, narrate the path, linger, cut and fade on page transitions).
 - **The human approves in-app.** The preview page says "Re-take of <bite>". Approve replaces the recording in
-  that bite; the previous recording is kept for rollback, never overwritten.
+  that bite; the previous recording is kept for rollback, never overwritten. A re-take filmed from a brief
+  (a take with an attempt) is delivered instead: the new recording replaces the current one by itself, and
+  the promoted export stays as it is until a version is published.
 
 ## Batch of briefs (GitHub PR → demos)
 
@@ -324,9 +326,9 @@ node scripts/briefs.mjs list <batchId> [--paste bundle.txt]        # the approve
 node scripts/briefs.mjs claim <batchId> <briefId>                   # mints an attempt, creates take-<briefId>-r<revision>/brief.json
 node scripts/briefs.mjs event <takeDir> planning|awaiting_storyboard_approval|recording|uploading|failed|cancelled [--note "..."]
 node scripts/briefs.mjs release <takeDir>                           # give the brief back (cancelled)
-node scripts/upload.mjs <takeDir> --stage-only --no-open            # stage with the attempt riding along, do not wait
-node scripts/status.mjs <takeDir>                                   # later: wait for the word, then for the bite
-node scripts/status.mjs --all                                       # one look at every staged take here
+node scripts/upload.mjs <takeDir> --stage-only --no-open            # deliver: the take becomes a bite by itself, do not wait
+node scripts/status.mjs <takeDir>                                   # later: wait for the bite to finish (retries a failed delivery)
+node scripts/status.mjs --all                                       # one look at every delivered take here
 ```
 
 The procedure, in order:
@@ -335,11 +337,11 @@ The procedure, in order:
 2. Claim the briefs you are about to film, one `claim` each. A claim answers "active attempt" when another agent or an earlier run holds the brief: show the human the attempt reference and its start time, and only with their word claim again with `--force`.
 3. Run `vocab.mjs` over the screens each brief visits, then write every storyboard (Phase 3) with the brief as the spec and vocab.json as the only dictionary: the flowIntent lines are the beats, the outcome is the last beat, the exclusions are things the camera never shows, and the take stays under the brief's `maxSeconds` (90). Send `event <takeDir> planning` when you start a storyboard and `event <takeDir> awaiting_storyboard_approval` when it is ready.
 4. **Show the storyboards together, get a word on each one.** One message can carry all of them, but every brief gets its own yes or no. Never take one yes as a yes for the batch. A brief the human declines gets `release`.
-5. Film sequentially, never in parallel: one Chrome on the profile. Per take: `event recording` → Phase 4 dry run → `cleanup.mjs --prep` when declared → Phase 5 take → `cleanup.mjs` (revert, checks.after) → trim, calibrate, manifest → `upload.mjs <takeDir> --stage-only --no-open`. Report, per take, what was created and what was reverted, with the before/after checks. `upload.mjs` reads `brief.json`, moves the attempt to uploading and stages with the attempt on the payload; it writes `staged.json` with the staging id.
+5. Film sequentially, never in parallel: one Chrome on the profile. Per take: `event recording` → Phase 4 dry run → `cleanup.mjs --prep` when declared → Phase 5 take → `cleanup.mjs` (revert, checks.after) → trim, calibrate, manifest → `upload.mjs <takeDir> --stage-only --no-open`. Report, per take, what was created and what was reverted, with the before/after checks. `upload.mjs` reads `brief.json`, moves the attempt to uploading, stages with the attempt on the payload, and after the two uploads calls the delivery route: the take becomes a bite in DemoBites by itself, no Approve click, and the line reads `delivered: bite <id>`. It writes `staged.json` with the staging id and the bite id.
 6. **A failed brief never stops the others.** On a failure send `event <takeDir> failed --note "<what happened>"`, keep the take directory for diagnosis, and continue with the next brief. Report every failure plainly at the end.
-7. When all takes are staged, tell the human: N takes are waiting in the review queue (the `queueUrl` printed by the last stage), one Approve or Discard each. Then `status.mjs --all` shows where each stands; `status.mjs <takeDir>` waits for one.
+7. When all takes are delivered, tell the human: N takes were delivered and are becoming bites in DemoBites by themselves, with the bite ids. `status.mjs --all` shows where each stands; `status.mjs <takeDir>` waits for one to finish and prints what landed (the Phase 6 receipt law holds: no studio link before the bite is completed). A take the server would not deliver (upload.mjs printed the error) waits in the review queue; `status.mjs <takeDir>` tries the delivery again, and on an older DemoBites waits for the word in the app as before. Deliver each take; never publish, never share, never send invitations.
 
-Resume after an interruption from what is on disk and on the server: a `take-*` directory with `brief.json` is claimed; with `raw.webm` it was filmed; with `clean.mp4` and `manifest.demobites.json` it is ready to stage; with `staged.json` it is staged (check it with `status.mjs --no-wait`). `list` shows the server's view of every attempt. Never re-claim a brief that already has your own live attempt; never re-stage one that `staged.json` says is staged unless the human asked for a new take (`upload.mjs --supersede`).
+Resume after an interruption from what is on disk and on the server: a `take-*` directory with `brief.json` is claimed; with `raw.webm` it was filmed; with `clean.mp4` and `manifest.demobites.json` it is ready to stage; with `staged.json` it is delivered or staged (check it with `status.mjs --no-wait`). `list` shows the server's view of every attempt. Never re-claim a brief that already has your own live attempt; never re-stage one that `staged.json` says is delivered or staged unless the human asked for a new take (`upload.mjs --supersede`).
 
 ## The wire manifest (fixed contract, version 2)
 
@@ -394,7 +396,12 @@ PUT <base>/api/recorder/stage  (Authorization: Bearer <api_key>)
   -> { stagingId, uploadUrl, previewUploadUrl, videoKey, previewUrl }
 
 GET <base>/api/recorder/stage?id=<stagingId>  (Authorization: Bearer <api_key>)
-  -> { status: 'pending'|'approving'|'approved'|'rejected', biteId, biteUKey, biteStatus, studioUrl }
+  -> { status: 'pending'|'approving'|'approved'|'delivered'|'rejected', biteId, biteUKey, biteStatus, studioUrl }
+
+PUT <base>/api/recorder/stage/<stagingId>/uploaded  (Authorization: Bearer <api_key>)   // DELIVERY: brief takes only, after both uploads
+  {}   // the url comes from the claim's api.uploaded ("{origin}/api/recorder/stage/{id}/uploaded"); this path is the fallback
+  -> 200 { biteId, videoId } | 202 { biteId, queued:true } | 200 { pending:true } (older server: wait for the word) | 404/409 { error }
+  // idempotent: a repeat returns the same bite
 
 GET <base>/api/recorder/status?biteId=<id>  (Authorization: Bearer <api_key>)
   -> { status, title, durationSec, narrationReady, narrationTotal, zooms }        (STARTS the pipeline, not done)
@@ -409,5 +416,5 @@ The upload zip contains exactly one file: `clean.mp4` stored as `recording.mp4`.
 
 - Anything the human sees (storyboard presentation, review page, questions) uses commas and periods only, no dashes, and real action words. Never orphan a single word on its own line in a heading.
 - Never touch credentials. Never print the api_key. Config and key files are chmod 600.
-- Never INGEST without the human's explicit word. For the DemoBites ending, staging for the in-app preview is HOW the word is asked — the take becomes a bite only when the human clicks Approve on that page.
+- Never INGEST without the human's explicit word. For the DemoBites ending, staging for the in-app preview is HOW the word is asked — the take becomes a bite only when the human clicks Approve on that page. For a batch of briefs the word was given on the batch and on each storyboard, and delivery ingests by itself. Never publish, never share, never send invitations.
 - One take directory per take, keep failed takes for diagnosis, name them `take-<slug>`, `take-<slug>2`, and so on. A take claimed from a brief is `take-<briefId>-r<revision>`.

package/skill/scripts/briefs.mjs

@@ -11,7 +11,9 @@
 //   GET /api/recorder/briefs?batch=<batchId>
 //   PUT /api/recorder/briefs/claim { briefId, revision, contentHash, idempotencyKey, force? }
 //   PUT /api/recorder/briefs/attempts/<attemptRef> { event, note? }
-// The stage call (upload.mjs) sends the attempt from <takeDir>/brief.json.
+// The stage call (upload.mjs) sends the attempt from <takeDir>/brief.json, and
+// after the uploads calls the delivery route from the claim's `api.uploaded`
+// (1.3.0): a take filmed from a brief becomes a bite by itself.
 //
 // Laws: one storyboard approval per brief, never one word for the batch.
 // Sequential takes, one Chrome on the profile. A failed brief never stops the
@@ -140,7 +142,7 @@ if (cmd === "claim") {
   const record = {
     batchId, briefId: brief.briefId, revision: brief.revision, contentHash: brief.contentHash, attemptRef: r.json.attemptRef,
     brief: r.json.brief ?? brief, target: r.json.target ?? data.batch?.target ?? null, rules: r.json.rules ?? { maxSeconds: 90 },
-    source: data.batch?.source ?? null, claimedAt: new Date().toISOString(),
+    source: data.batch?.source ?? null, api: r.json.api ?? data.api ?? null, claimedAt: new Date().toISOString(),
   };
   fs.writeFileSync(path.join(dir, "brief.json"), JSON.stringify(record, null, 2) + "\n");
   console.log(`Claimed ${brief.briefId} r${brief.revision} → ${dir}/brief.json (attempt ${r.json.attemptRef}, at most ${record.rules.maxSeconds}s)`);

package/skill/scripts/stage-wait.mjs

@@ -8,15 +8,41 @@
 // confirmed "completed".
 //
 // Returns { exitCode, status, biteId, studioUrl } and never throws.
+//
+// DELIVERY (1.3.0, founder ruling 2026-09-14): a take filmed from a brief
+// becomes a bite by itself once its ZIP is uploaded; no Approve click. The
+// server answers status "delivered" from then on, and the wait here is only
+// for the bite to finish. Free-prompt takes still wait for the word.
+
+/** PUT the delivery route for a staged take. `template` is the claim's
+ * api.uploaded ("{origin}/api/recorder/stage/{id}/uploaded", literal {id});
+ * the fallback is the same path under the configured base. Idempotent on the
+ * server: a repeat returns the same bite. Never throws. */
+export async function deliverStaged({ base, apiKey, stagingId, template }) {
+  const url = template && template.includes("{id}")
+    ? template.replace("{id}", encodeURIComponent(stagingId))
+    : `${base}/api/recorder/stage/${encodeURIComponent(stagingId)}/uploaded`;
+  let res;
+  try {
+    res = await fetch(url, { method: "PUT", headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" }, body: "{}" });
+  } catch (e) { return { delivered: false, httpStatus: 0, error: `DemoBites unreachable (${e.message})` }; }
+  const json = await res.json().catch(() => null);
+  if ((res.status === 200 || res.status === 202) && json?.biteId) {
+    return { delivered: true, biteId: json.biteId, videoId: json.videoId ?? null, queued: res.status === 202 || json.queued === true, httpStatus: res.status };
+  }
+  // An older server: { pending: true }, or no such route at all (a 404 without an error body).
+  if ((res.ok && json?.pending) || (res.status === 404 && !json?.error)) return { delivered: false, pending: true, httpStatus: res.status };
+  return { delivered: false, httpStatus: res.status, error: json?.error ? `${json.error}${json.message ? `: ${json.message}` : ""}` : `HTTP ${res.status}` };
+}
 
-export async function waitForDecision({ base, apiKey, stagingId, pageUrl, decisionTimeoutMs = 30 * 60 * 1000, pollMs = 4000 }) {
+export async function waitForDecision({ base, apiKey, stagingId, pageUrl, delivered = false, decisionTimeoutMs = 30 * 60 * 1000, pollMs = 4000 }) {
   const headers = { Authorization: `Bearer ${apiKey}` };
   const deadline = Date.now() + decisionTimeoutMs;
   let announced = false;
   let completed = false;
   let approvedBiteId = null;
   let finalStudioUrl = null;
-  process.stdout.write("Waiting for your word in the browser");
+  process.stdout.write(delivered ? "Waiting for the bite to finish" : "Waiting for your word in the browser");
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, pollMs));
     let res;
@@ -31,14 +57,14 @@ export async function waitForDecision({ base, apiKey, stagingId, pageUrl, decisi
       console.error("Discarded in the app. Adjust the storyboard and film again.");
       return { exitCode: 1, status: "rejected", biteId: null, studioUrl: null };
     }
-    if (st.status === "approved") {
+    if (st.status === "approved" || st.status === "delivered") {
       if (!announced) {
         process.stdout.write("\n");
-        console.log(`Approved — bite ${st.biteId} is being created`);
+        console.log(st.status === "delivered" ? `delivered: bite ${st.biteId} is being created` : `Approved — bite ${st.biteId} is being created`);
         announced = true;
         approvedBiteId = st.biteId;
         finalStudioUrl = st.studioUrl ? new URL(st.studioUrl, base).toString() : null;
-        process.stdout.write("Waiting for the bite to finish");
+        if (st.biteStatus !== "completed") process.stdout.write("Waiting for the bite to finish");
       }
       if (st.biteStatus === "completed") { completed = true; process.stdout.write("\n"); break; }
       if (st.biteStatus === "failed") {
@@ -51,12 +77,12 @@ export async function waitForDecision({ base, apiKey, stagingId, pageUrl, decisi
   }
   if (!announced) {
     process.stdout.write("\n");
-    console.error(`No decision yet. The preview stays available at:\n  ${pageUrl}`);
+    console.error(delivered ? `The server does not show the delivered bite yet. Look again later: ${pageUrl}` : `No decision yet. The preview stays available at:\n  ${pageUrl}`);
     return { exitCode: 1, status: "pending", biteId: null, studioUrl: null };
   }
   if (!completed) {
-    console.error("Approved, but the bite did not finish within the wait window. Do not share the link yet — poll /api/recorder/status or reload the preview page.");
-    return { exitCode: 1, status: "approved", biteId: approvedBiteId, studioUrl: null };
+    console.error(`${delivered ? "Delivered" : "Approved"}, but the bite did not finish within the wait window. Do not share the link yet — poll /api/recorder/status or reload the preview page.`);
+    return { exitCode: 1, status: delivered ? "delivered" : "approved", biteId: approvedBiteId, studioUrl: null };
   }
 
   // Final receipt via the status endpoint (same gate as before).

package/skill/scripts/status.mjs

@@ -1,8 +1,9 @@
 // Where a staged take stands, and the wait for its word.
 //
-//   node status.mjs <takeDir>            wait for the decision, then for the bite to finish (reads <takeDir>/staged.json)
+//   node status.mjs <takeDir>            wait for the decision (or, delivered, for the bite to finish); reads <takeDir>/staged.json
+//                                        a take whose delivery failed is delivered again here first (idempotent on the server)
 //   node status.mjs <stagingId>          same, by id
-//   node status.mjs <takeDir> --no-wait  one look, no waiting: pending | approved (+bite status) | rejected
+//   node status.mjs <takeDir> --no-wait  one look, no waiting: pending | delivered (+bite status) | approved (+bite status) | rejected
 //   node status.mjs --all                one look at every take-*/staged.json under the current directory
 //
 // A batch stages every take with `upload.mjs --stage-only --no-open`, then the
@@ -10,7 +11,7 @@
 // upload.mjs: no studio link before the bite is completed.
 import fs from "node:fs";
 import path from "node:path";
-import { waitForDecision, peekStaged } from "./stage-wait.mjs";
+import { waitForDecision, peekStaged, deliverStaged } from "./stage-wait.mjs";
 
 const args = process.argv.slice(2);
 const noWait = args.includes("--no-wait");
@@ -36,6 +37,7 @@ function readStaged(dir) {
 function describe(st) {
   if (!st.ok) return `unreachable (${st.httpStatus})`;
   if (st.status === "rejected") return "discarded in the app";
+  if (st.status === "delivered") return `delivered, bite ${st.biteId ?? "?"} ${st.biteStatus ?? "processing"}`;
   if (st.status === "approved") return `approved, bite ${st.biteId ?? "?"} ${st.biteStatus ?? "processing"}`;
   return "waiting for the word in the app";
 }
@@ -53,20 +55,35 @@ if (all) {
 
 let stagingId = target;
 let pageUrl = null;
+let delivered = false;
 if (fs.existsSync(target) && fs.statSync(target).isDirectory()) {
   const staged = readStaged(target);
   if (!staged?.stagingId) { console.error(`${target} has no staged.json. Stage it first: node scripts/upload.mjs ${target} --stage-only`); process.exit(1); }
   stagingId = staged.stagingId;
   pageUrl = staged.previewUrl ?? null;
+  delivered = staged.delivered === true;
+  // A brief take whose delivery failed (network, 409) is delivered again here;
+  // the server is idempotent. An older server (pending) is left alone.
+  if (staged.attemptRef && staged.delivered === false && staged.pending !== true) {
+    const d = await deliverStaged({ base, apiKey: cfg.api_key, stagingId, template: staged.api?.uploaded ?? null });
+    if (d.delivered) {
+      delivered = true;
+      console.log(`delivered: bite ${d.biteId}${d.queued ? " (ingest queued)" : ""}. It becomes a bite in DemoBites by itself.`);
+      try { fs.writeFileSync(path.join(target, "staged.json"), JSON.stringify({ ...staged, delivered: true, biteId: d.biteId, videoId: d.videoId ?? null, queued: d.queued ?? null, deliveryError: null }, null, 2) + "\n"); } catch {}
+    } else if (d.pending) {
+      try { fs.writeFileSync(path.join(target, "staged.json"), JSON.stringify({ ...staged, pending: true }, null, 2) + "\n"); } catch {}
+      console.log("This DemoBites does not deliver by itself yet; the take waits for the word in the app.");
+    } else console.error(`Not delivered: ${d.error}. The take waits in the review queue.`);
+  }
 }
 if (!pageUrl) pageUrl = `${base}/recording-preview/agentic/${encodeURIComponent(stagingId)}`;
 
 if (noWait) {
   const st = await peekStaged({ base, apiKey: cfg.api_key, stagingId });
   console.log(`${stagingId}: ${describe(st)}`);
-  if (st.ok && st.status === "approved" && st.biteStatus === "completed" && st.studioUrl) console.log(`Studio: ${new URL(st.studioUrl, base).toString()}`);
+  if (st.ok && (st.status === "approved" || st.status === "delivered") && st.biteStatus === "completed" && st.studioUrl) console.log(`Studio: ${new URL(st.studioUrl, base).toString()}`);
   process.exit(st.ok ? 0 : 1);
 }
 
-const outcome = await waitForDecision({ base, apiKey: cfg.api_key, stagingId, pageUrl });
+const outcome = await waitForDecision({ base, apiKey: cfg.api_key, stagingId, pageUrl, delivered });
 process.exit(outcome.exitCode);

package/skill/scripts/upload.mjs

@@ -47,6 +47,11 @@ const retakeNote = noteIdx >= 0 ? String(process.argv[noteIdx + 1] ?? "").trim()
 // opts out. `--stage-only` returns right after the two uploads (the batch
 // waits with status.mjs); `--supersede` replaces a stage already pinned to
 // this attempt (the server refuses a second one otherwise).
+// DELIVERY (1.3.0, founder ruling 2026-09-14): a take with an attempt becomes
+// a bite by itself. After both uploads this script PUTs the delivery route
+// (the claim's api.uploaded, fallback <base>/api/recorder/stage/<id>/uploaded)
+// and prints "delivered: bite <id>". No Approve click, no review queue for
+// brief batches. Free-prompt takes (no attempt) still stage for review.
 const stageOnly = process.argv.includes("--stage-only");
 const supersede = process.argv.includes("--supersede");
 const attemptIdx = process.argv.indexOf("--attempt");
@@ -54,11 +59,13 @@ const attemptPath = process.argv.includes("--no-attempt")
   ? null
   : attemptIdx >= 0 ? String(process.argv[attemptIdx + 1] ?? "") : path.join(dir, "brief.json");
 let attempt = null;
+let uploadedTemplate = null;
 if (attemptPath && fs.existsSync(attemptPath)) {
   try {
     const b = JSON.parse(fs.readFileSync(attemptPath, "utf8"));
     if (b.briefId && b.revision !== undefined && b.contentHash && b.attemptRef) {
       attempt = { briefId: String(b.briefId), revision: b.revision, contentHash: String(b.contentHash), attemptRef: String(b.attemptRef) };
+      uploadedTemplate = typeof b.api?.uploaded === "string" ? b.api.uploaded : null;
     } else console.error(`${attemptPath} is missing briefId/revision/contentHash/attemptRef; staging without an attempt`);
   } catch (e) { console.error(`${attemptPath} unreadable (${e.message}); staging without an attempt`); }
 } else if (attemptIdx >= 0) { console.error(`--attempt ${attemptPath} not found`); process.exit(2); }
@@ -70,6 +77,14 @@ if (!cfg.api_key || !cfg.base) {
   process.exit(1);
 }
 const base = cfg.base.replace(/\/+$/, "");
+// A delivered take is a bite already; staging it again would make a second one.
+try {
+  const prev = JSON.parse(fs.readFileSync(path.join(dir, "staged.json"), "utf8"));
+  if (prev?.delivered === true && prev.biteId && !supersede) {
+    console.error(`${dir} was already delivered as bite ${prev.biteId}. See where it stands: node scripts/status.mjs ${dir}. For a new take of it, stage again with --supersede.`);
+    process.exit(1);
+  }
+} catch { /* not staged yet */ }
 
 const cleanPath = path.join(dir, "clean.mp4");
 const wirePath = path.join(dir, "manifest.demobites.json");
@@ -178,7 +193,7 @@ if (!zipped) {
 fs.rmSync(staging, { recursive: true, force: true });
 const sizeBytes = fs.statSync(zipPath).size;
 console.log(`take.zip ready (${(sizeBytes / 1024 / 1024).toFixed(1)} MB, ${zipped ? "system zip" : "store method"})`);
-if (retakeOfBiteId) console.log(`Staging as a RE-TAKE of bite ${retakeOfBiteId} — the new recording replaces the current one inside that bite once approved.`);
+if (retakeOfBiteId) console.log(`Staging as a RE-TAKE of bite ${retakeOfBiteId} — the new recording replaces the current one inside that bite ${attempt ? "by itself once delivered" : "once approved"}.`);
 
 // ── stage ──────────────────────────────────────────────────────────────────
 const authHeaders = { Authorization: `Bearer ${cfg.api_key}`, "Content-Type": "application/json" };
@@ -247,22 +262,48 @@ async function putS3(url, contentType, filePath, label) {
 }
 await putS3(uploadUrl, "application/zip", zipPath, "ZIP");
 await putS3(previewUploadUrl, "video/mp4", cleanPath, "Preview");
+
+// ── delivery (brief batches): the take becomes a bite by itself ────────────
+// Only a take carrying an attempt is delivered. Free-prompt takes never call
+// this route, so their flow is unchanged: staged, then the word in the app.
+let delivery = null;
+if (attempt) {
+  const { deliverStaged } = await import("./stage-wait.mjs");
+  delivery = await deliverStaged({ base, apiKey: cfg.api_key, stagingId, template: uploadedTemplate });
+}
 // The staging id used to be printed only; a batch resumes from disk, so it is
-// persisted next to the take (status.mjs reads it).
+// persisted next to the take (status.mjs reads it, and retries a delivery
+// that failed).
+const pageUrl = new URL(previewUrl, base).toString();
 try {
   fs.writeFileSync(path.join(dir, "staged.json"), JSON.stringify({
-    stagingId, previewUrl: new URL(previewUrl, base).toString(), queueUrl: queueUrl ? new URL(queueUrl, base).toString() : null,
-    pendingCount: pendingCount ?? null, attemptRef: attempt?.attemptRef ?? null, briefId: attempt?.briefId ?? null, at: new Date().toISOString(),
+    stagingId, previewUrl: pageUrl, queueUrl: queueUrl ? new URL(queueUrl, base).toString() : null,
+    pendingCount: pendingCount ?? null, attemptRef: attempt?.attemptRef ?? null, briefId: attempt?.briefId ?? null,
+    delivered: delivery ? delivery.delivered : null, biteId: delivery?.biteId ?? null, videoId: delivery?.videoId ?? null,
+    queued: delivery?.queued ?? null, pending: delivery?.pending ?? null, deliveryError: delivery?.error ?? null,
+    api: uploadedTemplate ? { uploaded: uploadedTemplate } : null, at: new Date().toISOString(),
   }, null, 2) + "\n");
 } catch (e) { console.error(`staged.json not written: ${e.message}`); }
 
+if (delivery?.delivered) {
+  console.log(`delivered: bite ${delivery.biteId}${delivery.queued ? " (ingest queued)" : ""}. It becomes a bite in DemoBites by itself.\n  ${pageUrl}`);
+  if (stageOnly) { console.log(`Delivered only. Wait for the bite to finish later with: node scripts/status.mjs ${dir}`); process.exit(0); }
+  const { waitForDecision } = await import("./stage-wait.mjs");
+  const outcome = await waitForDecision({ base, apiKey: cfg.api_key, stagingId, pageUrl, delivered: true });
+  process.exit(outcome.exitCode);
+}
+if (delivery && !delivery.pending) {
+  console.error(`Staged, but not delivered: ${delivery.error}. The take waits in the review queue:\n  ${pageUrl}\nTry the delivery again later with: node scripts/status.mjs ${dir}`);
+  process.exit(1);
+}
+if (delivery?.pending) console.log("This DemoBites does not deliver by itself yet; the take waits for the word in the app.");
+
 // ── open the in-app preview — the review happens THERE ─────────────────────
 // Batch etiquette (founder, 2026-08-11): when takes are stacked for a later
 // review sprint, auto-opening a tab per take is spam. `--no-open` (or
 // config.open_preview === false) stages silently — the queue pill and the
 // printed URL carry the message. Default stays open: for a single take the
 // opened page IS the consent moment.
-const pageUrl = new URL(previewUrl, base).toString();
 console.log(`Staged. Review and approve in the browser:\n  ${pageUrl}`);
 if (typeof pendingCount === "number" && pendingCount > 1 && queueUrl) {
   console.log(`${pendingCount} takes are now waiting for review: ${new URL(queueUrl, base).toString()}`);

package/scripts/check-aliases.mjs

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-// ALIAS GUARD (founder law, 2026-09-09): `agentic-recorder` and `demobites` on
-// npm are aliases of this package. They depend on `demobite` with a caret
-// range, so minor and patch releases flow through automatically, but a MAJOR
-// bump silently strands them on the old major. This guard runs before every
-// publish of demobite (prepublishOnly) and in CI, and refuses to continue if
-// any alias's dependency range no longer covers the version about to ship.
-//
-// When it fails: bump the range in aliases/<name>/package.json (and the alias
-// version), publish each alias from the founder's own terminal, then publish
-// demobite. See RELEASING.md.
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const main = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
-const aliasesDir = path.join(root, "aliases");
-const [major] = main.version.split(".").map(Number);
-
-let failed = false;
-for (const name of fs.readdirSync(aliasesDir)) {
-  const pkgPath = path.join(aliasesDir, name, "package.json");
-  if (!fs.existsSync(pkgPath)) continue;
-  const alias = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-  const range = alias.dependencies?.demobite ?? "";
-  const m = /^\^(\d+)\./.exec(range);
-  const covered = m && Number(m[1]) === major;
-  const line = `${alias.name.padEnd(18)} depends on demobite ${range.padEnd(8)} → ${covered ? "covers" : "DOES NOT COVER"} ${main.version}`;
-  console.log((covered ? "  ✓ " : "  ✗ ") + line);
-  if (!covered) failed = true;
-  const bin = fs.readFileSync(path.join(aliasesDir, name, "index.mjs"), "utf8");
-  if (!bin.includes('import "demobite/launcher/index.mjs"')) {
-    console.log(`  ✗ ${alias.name} does not import the demobite launcher`);
-    failed = true;
-  }
-}
-if (failed) {
-  console.error("\nAlias guard failed: an npm alias would strand on the old major. Update aliases/*/package.json (range + version), publish the aliases, then publish demobite. See RELEASING.md.");
-  process.exit(1);
-}
-console.log("alias guard: ok");