etymd 0.14.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # etymd
 
+## 0.16.0
+
+### Minor Changes
+
+- dc77a1f: `contract.milestones` and `etymd fleet board` — a project declares its plan in `MILESTONES.md`
+  (`# Milestones`, then `| id | milestone | goal | status | next | effort | depends-on |`); the sweep
+  files a gap when a declared file is absent or off-shape; `fleet add` registers the file when
+  present; `fleet board --initiatives <file> --out <file>` renders every project's rows plus a ranked
+  initiatives table and totals, deterministic, guarded entries excluded, exit 1 on holes.
+- b3fb81a: The fleet manifest's second profile is now `guarded` (it had another name before), with every derived name
+  following: `guardedHosts` in the local file, `--profile guarded`, the `guarded/<name>/` persistence
+  zone beside the manifest, and the guarded-worktree wall checks. No alias for the old value: a
+  manifest still carrying it fails `fleet check` and names the entry. Prose and examples describe the
+  feature as a second, guarded workspace whose entries stay alias-only and machine-pinned.
+- 79af085: `etymd propose` — score the sweep's improvement findings and recurring classes against a
+  fleet-authored rubric file (`criterion: <weight>` labeled lines; criteria: severity, economy,
+  confidence, breadth — an unknown criterion is refused quoting the line) and emit deterministic,
+  read-only `proposal/1` records carrying score, the fired rubric lines, and an implications block
+  (projects, files, gates, reversibility) extracted from finding evidence. Guarded entries are
+  excluded from the output entire. `--manifest` (fresh read-only sweep) or `--from <fleet.json>`
+  (stored sweep), `--json`. Decision record: docs/decisions/012.
+
+## 0.15.0
+
+### Minor Changes
+
+- 6f40a7d: `etymd premise "<task>"` — the task you hand an agent is an instruction too. Every path, script,
+  well-known doc and decision id the task names is verified against the repo (a missing thing the
+  task is _about_ ranks as risk), and a brief hands the agent the premises only it can verify.
+  `--file <path>` (`-` reads stdin), `--json` (schema `premise/1`), `--no-brief`, `--fail-on <tier>`.
+  Zero trace in a repo that never opted in; no ledger. Prose is read with stricter rules than a code
+  span (a script needs the `run` form, a directory claim needs a first segment that exists, a host
+  name is a URL) and every class left as prose is disclosed. The command/path/doc-reference/
+  decision-reference truth checks are now one shared implementation used by `instruction-truth` and
+  `premise` alike — ids, tiers and disclosures of existing findings are unchanged.
+
 ## 0.14.0
 
 Knowledge pack **v8 → v12**: every generated hook and script is regenerated by `etymd gates`.
@@ -408,18 +444,18 @@ so a pack number cited in a baseline always means exactly one pack.
 
 ### Minor Changes
 
-- e265713: `fleet add --profile corp` now records the alias-to-directory mapping too, not just the entry.
+- e265713: `fleet add --profile guarded` now records the alias-to-directory mapping too, not just the entry.
 
-  A corp entry in the tracked manifest is deliberately alias-only — no path, no remote — which is
-  what keeps employer names out of a file that gets pushed. It also means the entry resolves to
-  nothing on its own. Registering wrote only that half, so every corp registration ended as a
+  A guarded entry in the tracked manifest is deliberately alias-only — no path, no remote — which is
+  what keeps guarded-side names out of a file that gets pushed. It also means the entry resolves to
+  nothing on its own. Registering wrote only that half, so every guarded registration ended as a
   dangling entry that `fleet check` reported immediately and the user had to fix by hand, in the
   one file the tool otherwise never asks anyone to hand-edit.
 
   The mapping is written `~`-relative, so the local manifest stays portable between machines, and
   merged into the existing document so hand-maintained entries survive.
 
-  Two refusals guard it, because this file is the one place real employer directory names are
+  Two refusals guard it, because this file is the one place real guarded-side directory names are
   written down. If the local manifest is not gitignored, registration refuses rather than creating
   a file git would track — a leak the tool creates is worse than a registration it declines to
   finish. If the file exists but is not valid JSON, it refuses rather than overwriting mappings
@@ -438,7 +474,7 @@ so a pack number cited in a baseline always means exactly one pack.
   It is also the field that turned a mis-profiled entry into a real disclosure. A raw remote URL
   carries the host and the internal group path; `path` carries a bare directory name. Removing a
   field no consumer reads retires that class outright, with no host-matching heuristic, and unlike
-  the corp-host guard it keeps working on a machine that has no local manifest to read corp hosts
+  the guarded-host guard it keeps working on a machine that has no local manifest to read guarded hosts
   from. The remote stays derivable from the checkout at any time, which is where it came from.
 
   Existing entries that already carry a remote are left alone — nothing reads them, and rewriting
@@ -448,20 +484,20 @@ so a pack number cited in a baseline always means exactly one pack.
 
 ### Patch Changes
 
-- 88492b5: Fix: `fleet add --profile corp` was silently ignored, registering employer repos as personal.
+- 88492b5: Fix: `fleet add --profile guarded` was silently ignored, registering guarded repos as personal.
 
   `fleet` declares its own `--profile` (the sweep filter), and commander hands a parent-declared
-  option the value even when it is typed after the subcommand. So `fleet add <dir> --profile corp`
+  option the value even when it is typed after the subcommand. So `fleet add <dir> --profile guarded`
   left the subcommand's own option undefined, the placement fell back to personal, and the
-  personal branch records `path` and the RAW `remote` — writing the employer host and its internal
+  personal branch records `path` and the RAW `remote` — writing the guarded host and its internal
   group structure into a manifest that is tracked and pushed. That is precisely the disclosure the
   alias convention exists to prevent. The same shadowing class was already fixed for `--manifest`
   and `--json`; `--profile` was missed.
 
   Two changes, because the flag alone is not enough. The CLI now reads the merged option view, so
-  the flag works. And `fleet add` refuses outright when the target's remote matches a corp host
-  declared in the local manifest while the profile is not corp — the manifest already knows which
-  hosts are the employer's and the remote has just been read, so the tool has every fact needed to
+  the flag works. And `fleet add` refuses outright when the target's remote matches a guarded host
+  declared in the local manifest while the profile is not guarded — the manifest already knows which
+  hosts are the guarded side's and the remote has just been read, so the tool has every fact needed to
   prevent this without anyone remembering a flag. It refuses rather than auto-correcting:
   placement is the user's decision, but it may not be made by omission.
 
@@ -598,7 +634,7 @@ so a pack number cited in a baseline always means exactly one pack.
   value it explains changes, because a stale reason misleads exactly where it meant to inform.
 
   **`etymd fleet add`** registers a project, prompting for what no scan can derive and refusing to
-  write an incomplete entry. Fleet manifests gain a mandatory `trust` level on non-corp entries —
+  write an incomplete entry. Fleet manifests gain a mandatory `trust` level on non-guarded entries —
   absence is a finding, never a silent default — a manifest-level `orientation.root` replacing
   per-entry links, and a gate-drift check that reports a repository missing a gate its siblings
   install.
@@ -658,9 +694,9 @@ so a pack number cited in a baseline always means exactly one pack.
 
   - New `state-freshness` truth lens: state/decisions artifacts dated by git committer dates only (never mtime); staleness is relative, so a dormant repo's old state is current; state char budget against the ~10k session-hook truncation; marker-gated decisions format checks (`Scope:`, duplicate/out-of-order `D-NNN` ids, past `Revisit:` dates as due review debt); ADR conventions (`docs/adr/`, `docs/decisions/`, `NNNN-*.md`) recognized natively.
   - New `etymd fleet` command family. The sweep runs a read-only audit per registered repo (`--manifest` required unless the cwd holds `registry.json` — no env var, no global pointer) and renders one line per project with a delta against `last.fleet.json`; detail only for new or risk findings. `fleet check` validates the manifest pair alone (dangling mappings, duplicate names, privacy leaks, machine paths). `fleet dismiss`/`fleet accept` resolve a project's finding from any cwd.
-  - The manifest loader (`src/core/fleet.ts`) resolves both the fleet registry pair (`registry.json` + gitignored `registry.local.json`) and the legacy corpus pair (`sources.json` + `sources.local.json`); corp entries are opaque aliases resolved only through the local file, and every resolution failure is disclosed, never silently skipped.
-  - Persistence invariants, pinned by tests: the sweep never creates `.etymd` anywhere; `--persist-ledgers` only persists into personal repos that already opted in; corp worktrees take zero writes under every flag combination — corp findings persist (and stay dismissible) at `<manifestDir>/corp/<name>/.etymd/`; zero corp-resolved content under the manifest repo's tracked paths.
-  - Fleet-scope wall findings (lens id `fleet-manifest`): corp contract files inside a corp worktree, unregistered corp-remote checkouts under the fleet root, tracked `/Users/` paths in the manifest's own repo, private needles inside `trust: "public-repo"` entries, corp-host commit emails on personal entries.
+  - The manifest loader (`src/core/fleet.ts`) resolves both the fleet registry pair (`registry.json` + gitignored `registry.local.json`) and the legacy corpus pair (`sources.json` + `sources.local.json`); guarded entries are opaque aliases resolved only through the local file, and every resolution failure is disclosed, never silently skipped.
+  - Persistence invariants, pinned by tests: the sweep never creates `.etymd` anywhere; `--persist-ledgers` only persists into personal repos that already opted in; guarded worktrees take zero writes under every flag combination — guarded findings persist (and stay dismissible) at `<manifestDir>/guarded/<name>/.etymd/`; zero guarded-resolved content under the manifest repo's tracked paths.
+  - Fleet-scope wall findings (lens id `fleet-manifest`): guarded contract files inside a guarded worktree, unregistered guarded-remote checkouts under the fleet root, tracked `/Users/` paths in the manifest's own repo, private needles inside `trust: "public-repo"` entries, guarded-host commit emails on personal entries.
   - Fork-aware freshness: entries with `upstream` are dated on fork-authored commits only (`HEAD --not --remotes=<upstream>`), with a disclosed fallback when the remote is absent.
 
 ## 0.1.0 — 2026-07-31

package/README.md

@@ -1,11 +1,11 @@
 # Etymd
 
 <div align="center">
-  <img src="https://raw.githubusercontent.com/triartleet/etymd/main/media/etymd-logo.png" width="520" alt="Etymd — a papyrus of written instructions, each line checked against the repository it describes">
+  <img src="https://raw.githubusercontent.com/fleetorders/etymd/main/media/etymd-logo.png" width="520" alt="Etymd — a papyrus of written instructions, each line checked against the repository it describes">
   <p>
     <a href="https://www.npmjs.com/package/etymd"><img src="https://img.shields.io/npm/v/etymd.svg?label=npm&color=cb3837" alt="npm version"></a>
-    <a href="https://github.com/triartleet/etymd/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/triartleet/etymd/ci.yml?branch=main&label=CI" alt="CI"></a>
-    <a href="https://github.com/triartleet/etymd/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="MIT license"></a>
+    <a href="https://github.com/fleetorders/etymd/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/fleetorders/etymd/ci.yml?branch=main&label=CI" alt="CI"></a>
+    <a href="https://github.com/fleetorders/etymd/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="MIT license"></a>
   </p>
 </div>
 
@@ -15,7 +15,8 @@ You wrote rules for your AI months ago. Since then a script got renamed, a folde
 changed — and the AI still trusts every word. The file never complains when it goes stale; it just
 keeps instructing, confidently, and you live with the results.
 
-Etymd reads those instruction files and checks every claim in them against your actual project.
+Etymd reads those instruction files — and, when you ask, the task you are about to hand an agent —
+and checks every claim against your actual project.
 
 One command, run in your project's folder (needs Node ≥ 18.17, nothing else): `npx etymd audit`.
 Here it is on a small demo project whose AGENTS.md still tells the AI to run `npm run start` and
@@ -110,6 +111,7 @@ cd your-project
 npx etymd audit         # verify every instruction claim against the repo
 npx etymd init          # opt in to drift: approve the baseline (+ scaffold AGENTS.md only if you have none)
 npx etymd audit --fail-on risk   # the CI gate
+npx etymd premise "fix the flaky test in src/legacy/foo.test.ts"   # is this the right task?
 ```
 
 `audit` needs no setup — without `init` you get the full findings report and lose only drift
@@ -132,6 +134,14 @@ gate into a pipeline, see [In CI](#in-ci).
 - **Drift vs baseline** — documented commands/artifacts/layout that existed at approval and are
   now gone.
 
+**`premise`** (via `etymd premise`) — the task itself is an instruction. Before an agent acts on
+it, every path, script, well-known doc and decision id the task names is checked with the same
+rules instruction files get. A path the task is _about_ and that does not exist ranks as **risk**:
+the task would solve the wrong problem precisely. What cannot be read from files — that the named
+things are the ones meant, that the mechanism the task assumes actually runs, that the state it
+assumes holds — is handed to the agent in a brief, never guessed at. Nothing is remembered between
+runs.
+
 **`gate-integrity`** — a CI config is a claim too: checks enforced only in CI (failures surface a
 slow pipeline after the agent finished — `etymd gates` generates the local mirror), checks only in
 skippable local hooks, latent gaps (coverage collected but nothing gates on it; commitlint
@@ -157,28 +167,31 @@ append race is a defect in the file's own convention, not a format opinion.
 
 **`fleet-manifest`** (via `etymd fleet`) — one truth guard across every repo you registered:
 per-repo audits plus checks on the fleet manifest itself and on the placement wall between
-personal and employer repos. See [the fleet manifest](#the-fleet-manifest-experimental) below.
+personal and guarded repos. See [the fleet manifest](#the-fleet-manifest-experimental) below.
 
 ## Commands
 
-| Command                          | What it does                                                                                                                                                                                            |
-| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                                              |
-| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                                            |
-| `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                                              |
-| `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                                             |
-| `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts — and from the repo's shell surface, where it has one. |
-| `etymd screen`                   | Content screen: find text that must never be published. Four scopes — `--staged`, `--message`, `--tree`, `--dir`. Bring your own patterns; etymd ships none.                                            |
-| `etymd scan`                     | The deterministic reckoning behind everything. `--json`.                                                                                                                                                |
-| `etymd brief`                    | A grounded briefing your in-repo agent completes to author the semantic layer.                                                                                                                          |
-| `etymd approve`                  | Refresh the committed baseline non-interactively after intentional structural changes.                                                                                                                  |
-| `etymd ledger`                   | The findings memory: every tracked finding with status and history.                                                                                                                                     |
-| `etymd dismiss`                  | `dismiss <id> --reason <text>` — a dismissed finding never resurfaces without regressing.                                                                                                               |
-| `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                                         |
-| `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.                  |
-| `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                                         |
-| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                |
-| `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; corp findings persist beside the manifest, never in the corp worktree.                                                                        |
+| Command                          | What it does                                                                                                                                                                                                                                                        |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                                                                                                          |
+| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                                                                                                        |
+| `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                                                                                                          |
+| `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                                                                                                         |
+| `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts — and from the repo's shell surface, where it has one.                                                             |
+| `etymd screen`                   | Content screen: find text that must never be published. Four scopes — `--staged`, `--message`, `--tree`, `--dir`. Bring your own patterns; etymd ships none.                                                                                                        |
+| `etymd scan`                     | The deterministic reckoning behind everything. `--json`.                                                                                                                                                                                                            |
+| `etymd brief`                    | A grounded briefing your in-repo agent completes to author the semantic layer.                                                                                                                                                                                      |
+| `etymd premise`                  | `premise "<task>"` — is this the right task? What it names, verified against the repo; a brief for what only the agent can verify. `--file` (`-` = stdin), `--json`, `--no-brief`, `--fail-on <tier>`. No ledger.                                                   |
+| `etymd approve`                  | Refresh the committed baseline non-interactively after intentional structural changes.                                                                                                                                                                              |
+| `etymd ledger`                   | The findings memory: every tracked finding with status and history.                                                                                                                                                                                                 |
+| `etymd dismiss`                  | `dismiss <id> --reason <text>` — a dismissed finding never resurfaces without regressing.                                                                                                                                                                           |
+| `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                                                                                                     |
+| `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.                                                                              |
+| `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                                                                                                     |
+| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                                                                            |
+| `etymd fleet board`              | Render the fleet board: every project's `MILESTONES.md` (contract key `milestones`, shape-checked by the sweep) plus a ranked initiatives table on one page. `--initiatives <file>`, `--out <file>`, `--json`.                                                      |
+| `etymd propose`                  | Score the sweep's improvement findings + recurring classes against a fleet-authored rubric — stable `proposal/1` records, read-only, deterministic, guarded entries excluded. `--rubric <file>` (required), `--manifest <file>` or `--from <fleet.json>`, `--json`. |
+| `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; guarded findings persist beside the manifest, never in the guarded worktree.                                                                                                                              |
 
 `--cwd <dir>` targets another directory. Read-only probing of any repo leaves **zero trace**
 (`audit --no-ledger` writes nothing).
@@ -313,7 +326,7 @@ the generated pre-push now carries a `shellcheck` step. Three properties are del
 ### The content screen (`etymd screen`)
 
 A separate question from "are the instructions true?": **does this repo carry text that must
-never be published?** Absolute home paths, an employer's name, an internal hostname, an account
+never be published?** Absolute home paths, an organisation's name, an internal hostname, an account
 identifier — permanent the moment they are committed, because publishing exposes all history,
 not the current tree.
 
@@ -347,7 +360,7 @@ inline marker would not survive into the artifact. Those live in `.etymd-screen-
 repo root — one labeled line per field, so the pattern is never delimited:
 
 ```
-pattern ^AcmeCorp|BetaCorp$
+pattern ^AcmeInc|BetaInc$
 reason fixture proving the detector fires on either name
 date 2026-08-15
 author someone
@@ -407,10 +420,10 @@ steps:
 `etymd fleet` extends the one objective across every repository you work in — your fleet of
 **repositories**, not a fleet of agents. The manifest, `registry.json`, is itself an
 agent-context file: claims about your fleet (what exists, where, under which **profile** — the
-side of the wall an entry belongs to, `personal` or `corp`; the **wall** is the placement
-boundary between personal and employer content that the sweep polices). It rots like any
+side of the wall an entry belongs to, `personal` or `guarded`; the **wall** is the placement
+boundary between personal and guarded content that the sweep polices). It rots like any
 AGENTS.md does, and `etymd fleet` keeps it true. Decision record:
-[`docs/decisions/004-fleet-truth-guard.md`](https://github.com/triartleet/etymd/blob/main/docs/decisions/004-fleet-truth-guard.md). Both the
+[`docs/decisions/004-fleet-truth-guard.md`](https://github.com/fleetorders/etymd/blob/main/docs/decisions/004-fleet-truth-guard.md). Both the
 registry schema and the fleet `--json` schema are **experimental through 0.2.x**.
 
 Two files beside each other — the split is the privacy model:
@@ -435,7 +448,7 @@ Two files beside each other — the split is the privacy model:
       "kind": "docs",
       "profile": "personal",
       "path": "notes",
-      "trust": "private", // mandatory on every non-corp entry — see below
+      "trust": "private", // mandatory on every non-guarded entry — see below
       "staleAfterDays": 45, // per-entry freshness window
       "contract": { "state": "STATUS.md" }, // native conventions register, never migrate
     },
@@ -447,8 +460,14 @@ Two files beside each other — the split is the privacy model:
       "upstream": "origin", // freshness measured on fork-authored commits only
       "trust": "public-repo", // hygiene needles apply (see below)
     },
-    // Corp entries: opaque alias, private, NO path — real dirs live only in the local file.
-    { "name": "c-one", "kind": "repo", "profile": "corp", "private": true, "staleAfterDays": 45 },
+    // Guarded entries: opaque alias, private, NO path — real dirs live only in the local file.
+    {
+      "name": "c-one",
+      "kind": "repo",
+      "profile": "guarded",
+      "private": true,
+      "staleAfterDays": 45,
+    },
   ],
 }
 ```
@@ -457,23 +476,23 @@ Two files beside each other — the split is the privacy model:
 
 ```jsonc
 {
-  "machineProfile": "corp", // which profile this machine resolves; "personal" resolves corp entries disclosed-absent
+  "machineProfile": "guarded", // which profile this machine resolves; "personal" resolves guarded entries disclosed-absent
   "root": "~/projects", // optional per-machine root override
-  "dirs": { "c-one": "~/projects/real-corp-dir" },
-  "labels": { "c-one": "real-corp-dir" },
-  "corpHosts": ["git.example-corp.com"],
+  "dirs": { "c-one": "~/projects/real-guarded-dir" },
+  "labels": { "c-one": "real-guarded-dir" },
+  "guardedHosts": ["git.example-guarded.com"],
 }
 ```
 
 Two fields the scan can never derive, so the manifest must declare them:
 
-- **`trust` — mandatory on every non-corp entry** (`public-repo` | `public-bound` | `private`).
+- **`trust` — mandatory on every non-guarded entry** (`public-repo` | `public-bound` | `private`).
   It is a _safety predicate_, not a label: it decides whether content screening applies, so an
   absent value is reported (`fleet check` flags it), never read as a silent `private`.
   `public-bound` means private today, plausibly public later — screened exactly as hard as
   public, because publishing exposes _all_ history: the scrub has to precede the first commit,
   not the visibility flip. A value outside the vocabulary is flagged rather than coerced, so a
-  typo can never quietly disable screening. Corp entries omit it — `profile: "corp"` already
+  typo can never quietly disable screening. Guarded entries omit it — `profile: "guarded"` already
   implies the answer.
 - **`orientation.root` — optional, declared once.** Names the one entry every other entry is
   guided by. Declared at the manifest level rather than repeated per entry, because a per-entry
@@ -488,10 +507,10 @@ CI) must pass every mandatory value as a flag — there is deliberately no defau
 How the sweep behaves:
 
 - **Read-only by default, everywhere.** The sweep never creates `.etymd` anywhere.
-  `--persist-ledgers` persists only into personal repos that already opted in, and a **corp
+  `--persist-ledgers` persists only into personal repos that already opted in, and a **guarded
   worktree is never written** — regardless of flags, even if a stray `.etymd` exists inside it
-  (pinned by test). Corp findings stay dismissible: their ledger lives at
-  `<manifest-dir>/corp/<name>/.etymd/`, beside the manifest.
+  (pinned by test). Guarded findings stay dismissible: their ledger lives at
+  `<manifest-dir>/guarded/<name>/.etymd/`, beside the manifest.
 - **Deltas.** Each sweep compares against `last.fleet.json` stored beside the manifest and
   renders `Δ +new −resolved` per project. Add `*.fleet.json` to the manifest repo's
   `.gitignore` — sweep output is local-only and never tracked.
@@ -503,17 +522,64 @@ How the sweep behaves:
   that instruction files are legitimately absent in that project — the sweep drops its
   missing-contract finding instead of re-reporting a decision every run. Absence disclosed on
   purpose is a state, not a gap.
-- **Wall checks.** Corp contract files found inside a corp worktree, unregistered checkouts
-  under the fleet root whose remotes match `corpHosts`, tracked `/Users/` paths in the manifest
+- **Wall checks.** Guarded contract files found inside a guarded worktree, unregistered checkouts
+  under the fleet root whose remotes match `guardedHosts`, tracked `/Users/` paths in the manifest
   repo, private **needles** — the identifiers the local file holds (labels, dir names, hosts) —
-  inside `trust: "public-repo"` entries, and corp-host commit emails on personal entries — each
+  inside `trust: "public-repo"` entries, and guarded-host commit emails on personal entries — each
   a risk finding; each check that cannot run is disclosed.
 - **No global pointer.** `--manifest` is required unless the cwd holds `registry.json` — there
   is deliberately no env var and no home-directory pointer.
+- **Milestones and the fleet board.** A project declares its plan in one file — `MILESTONES.md`,
+  registered as `"contract": { "milestones": "MILESTONES.md" }` (`fleet add` registers it when the
+  file is present; `"none"` declares a project deliberately carries no plan). The file has a fixed
+  shape so the fleet can read every plan without an agent: a `# Milestones` heading, then a table
+  `| id | milestone | goal | status | next | effort | depends-on |` — `id` is `M<n>`, `goal` is 1, 2
+  or 3 (your fleet's own ordered goals, declared outside this tool), `status` is planned | active |
+  blocked | done, `next` is the one concrete next step, `effort` the S | M | L remaining,
+  `depends-on` a list of ids or `—`. Prose after the table is free. The sweep files a gap when a
+  declared file is absent or off-shape. `etymd fleet board --initiatives <file> --out <file>`
+  renders every project's rows, a ranked initiatives table (`| rank | id | initiative | goal |
+status | next | effort | projects | depends-on |`, the one hand-edited fleet-level surface), and
+  totals; guarded entries never appear on it. Day-precision stamp, deterministic output, exit code 1
+  when any project is missing or invalid — a board with holes still renders, and says so.
 
 Formatter interop for the `.etymd` state the sweep resolves: same rule as everywhere — see
 [the files Etymd keeps](#the-files-etymd-keeps).
 
+### Rubric-scored proposals (`etymd propose`)
+
+The sweep already gives every improvement finding an action, an effort and a confidence, and
+names the classes open in two or more projects. `etymd propose` adds the scoring step — against
+a rubric **your fleet authors**, because what is worth doing is your call, not the tool's:
+
+```
+severity: 2      # risk=3 · gap=2 · polish=1
+economy: 3       # S=3 · M=2 · L=1
+confidence: 1    # high=3 · medium=2 · low=1
+breadth: 4       # projects carrying it, capped at 3
+```
+
+One criterion per line (`#` comments and blanks ignored). Those four criteria are the whole
+vocabulary — each is computed from finding facts, so a score is arithmetic, not an opinion; a
+line naming anything else is refused quoting the line. `score` is Σ weight × value; a line
+**fires** (listed in `matched`) when the subject reads at/above the criterion's midpoint.
+
+```bash
+etymd propose --manifest registry.json --rubric opportunity.rubric --json
+# or, without re-sweeping: --from <fleet.json> (a stored `etymd fleet --json` output)
+```
+
+Subjects are every `kind: improvement` finding from personal projects plus every recurring
+class, recomputed over personal projects only — **guarded entries are excluded from the output
+entire, by name**. A class is scored conservatively (worst tier, dearest effort, weakest
+confidence). Each `proposal/1` record carries id, class, projects, action, effort, confidence,
+score, the fired rubric lines, and an `implications` block (projects, files, gates,
+reversibility) extracted from the findings' evidence — files are path-shaped evidence tokens,
+and `undetermined` reversibility says so rather than guessing. Read-only and deterministic: no
+timestamps, nothing written, identical input → identical bytes, so a filed proposal can be
+re-derived and compared. Decision record:
+[`docs/decisions/012-propose-rubric-scored-proposals.md`](https://github.com/fleetorders/etymd/blob/main/docs/decisions/012-propose-rubric-scored-proposals.md).
+
 ## Programmatic use
 
 ```ts
@@ -526,7 +592,7 @@ console.log(audit.findings) // one schema: claim · evidence · why · action ·
 ## The corpus (how this is validated)
 
 Etymd is developed against a corpus of real sibling repos rather than fixtures alone —
-[`sources.json`](https://github.com/triartleet/etymd/blob/main/sources.json) lists them by shape. Every heuristic here exists because a real
+[`sources.json`](https://github.com/fleetorders/etymd/blob/main/sources.json) lists them by shape. Every heuristic here exists because a real
 repo proved the previous one wrong, and each skip class in the truth lens is a false positive that
 a corpus run caught.
 
@@ -544,11 +610,12 @@ Without it — on a fresh clone or in CI — those suites skip cleanly and the r
 
 ## Decision record & roadmap
 
-[`docs/decisions/`](https://github.com/triartleet/etymd/tree/main/docs/decisions) — 001 founding · 002 foundation re-lock · **003 the truth-guard
+[`docs/decisions/`](https://github.com/fleetorders/etymd/tree/main/docs/decisions) — 001 founding · 002 foundation re-lock · **003 the truth-guard
 pivot** (the current identity; includes the state-of-the-field investigation it rests on) ·
 **004 fleet mode** (the truth guard across your repositories) · 005 declared rules (design only) ·
-**006 local gate provenance** (what the tool may read, and what it may rewrite).
-[`ROADMAP.md`](https://github.com/triartleet/etymd/blob/main/ROADMAP.md) — what's now / next / later, and the accepted heuristic
+**006 local gate provenance** (what the tool may read, and what it may rewrite) · 011 milestones
+& the fleet board · 012 `etymd propose` (rubric-scored proposals).
+[`ROADMAP.md`](https://github.com/fleetorders/etymd/blob/main/ROADMAP.md) — what's now / next / later, and the accepted heuristic
 trade-offs.
 
 ## License

package/dist/{approve-QDOH2E7V.js → approve-K5FFTPA4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-HWC6PKJM.js';
-import { VERSION } from './chunk-623W6KVC.js';
+import { scanProject } from './chunk-EJM47PIF.js';
+import { VERSION } from './chunk-UYCGP5BS.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-P6ATKV2R.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{audit-42OHF7ON.js → audit-HBNXNGD6.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-export { run } from './chunk-PAMWS665.js';
-import './chunk-LT7JMVV3.js';
+export { run } from './chunk-FKDT4RBP.js';
+import './chunk-UV3YIBDW.js';
+import './chunk-Y4E6ERCM.js';
 import './chunk-3E2IPCRY.js';
 import './chunk-HI7NWPRA.js';
-import './chunk-HWC6PKJM.js';
-import './chunk-623W6KVC.js';
+import './chunk-EJM47PIF.js';
+import './chunk-UYCGP5BS.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{brief-ZUQK3CFL.js → brief-DOQ2DQEG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-HWC6PKJM.js';
-import './chunk-623W6KVC.js';
+import { scanProject } from './chunk-EJM47PIF.js';
+import './chunk-UYCGP5BS.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';