etymd 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # etymd
 
+## 0.17.0
+
+### Minor Changes
+
+- The content screen's allow file accepts a `generated <path-regex>` record: a path declared
+  as regenerated data is still read and still screened, but vocabulary-class patterns drop
+  for it — secret-class patterns and the machine-path check stay — and the exempted paths
+  are named in the output, so a clean run never reads as fully screened. Provenance
+  (reason, date, author) is required.
+
+### Patch Changes
+
+- 2bceef1: The fleet's gate-drift check now derives the pre-push audit tier the same way `etymd gates`
+  does. In a repo where no risk-tier rule can fire (no package manifest, no state doc) the
+  generator lowers the audit line to `--fail-on gap`; the drift comparison planned with the raw
+  config tier (`risk`), so its expectation permanently differed from the hook the generator
+  itself writes — a `gate-stale` finding on every repo of that shape, unclearable by the action
+  it names. The derivation now lives in `planWorkflow` itself, where the hook is built, so every
+  caller (the drift check, `etymd init`, the programmatic surface) generates identical bytes; a
+  tier the repo pinned in config is still never lowered.
+- 7221fea: The content screen's machine-path rule now fires only at a path boundary (line start,
+  whitespace, a quote, `=`, `(`, `[` or `:`). A home path inside a longer token or a URL —
+  a test fixture's temp root (`$ROOT/home/‹x›/`), a docs URL with a home segment — is not a
+  machine path, and no longer prints the same advisory line on every push. A bare
+  `/Users/<name>/…` or `/home/<name>/…` still hits.
+
+## 0.16.0
+
+### Minor Changes
+
+- dc77a1f: `contract.milestones` and `etymd fleet board` — a project declares its plan in `MILESTONES.md`
+  (`# Milestones`, then `| id | milestone | goal | status | next | effort | depends-on |`); the sweep
+  files a gap when a declared file is absent or off-shape; `fleet add` registers the file when
+  present; `fleet board --initiatives <file> --out <file>` renders every project's rows plus a ranked
+  initiatives table and totals, deterministic, guarded entries excluded, exit 1 on holes.
+- b3fb81a: The fleet manifest's second profile is now `guarded` (it had another name before), with every derived name
+  following: `guardedHosts` in the local file, `--profile guarded`, the `guarded/<name>/` persistence
+  zone beside the manifest, and the guarded-worktree wall checks. No alias for the old value: a
+  manifest still carrying it fails `fleet check` and names the entry. Prose and examples describe the
+  feature as a second, guarded workspace whose entries stay alias-only and machine-pinned.
+- 79af085: `etymd propose` — score the sweep's improvement findings and recurring classes against a
+  fleet-authored rubric file (`criterion: <weight>` labeled lines; criteria: severity, economy,
+  confidence, breadth — an unknown criterion is refused quoting the line) and emit deterministic,
+  read-only `proposal/1` records carrying score, the fired rubric lines, and an implications block
+  (projects, files, gates, reversibility) extracted from finding evidence. Guarded entries are
+  excluded from the output entire. `--manifest` (fresh read-only sweep) or `--from <fleet.json>`
+  (stored sweep), `--json`. Decision record: docs/decisions/012.
+
 ## 0.15.0
 
 ### Minor Changes
@@ -422,18 +470,18 @@ so a pack number cited in a baseline always means exactly one pack.
 
 ### Minor Changes
 
-- e265713: `fleet add --profile corp` now records the alias-to-directory mapping too, not just the entry.
+- e265713: `fleet add --profile guarded` now records the alias-to-directory mapping too, not just the entry.
 
-  A corp entry in the tracked manifest is deliberately alias-only — no path, no remote — which is
-  what keeps employer names out of a file that gets pushed. It also means the entry resolves to
-  nothing on its own. Registering wrote only that half, so every corp registration ended as a
+  A guarded entry in the tracked manifest is deliberately alias-only — no path, no remote — which is
+  what keeps guarded-side names out of a file that gets pushed. It also means the entry resolves to
+  nothing on its own. Registering wrote only that half, so every guarded registration ended as a
   dangling entry that `fleet check` reported immediately and the user had to fix by hand, in the
   one file the tool otherwise never asks anyone to hand-edit.
 
   The mapping is written `~`-relative, so the local manifest stays portable between machines, and
   merged into the existing document so hand-maintained entries survive.
 
-  Two refusals guard it, because this file is the one place real employer directory names are
+  Two refusals guard it, because this file is the one place real guarded-side directory names are
   written down. If the local manifest is not gitignored, registration refuses rather than creating
   a file git would track — a leak the tool creates is worse than a registration it declines to
   finish. If the file exists but is not valid JSON, it refuses rather than overwriting mappings
@@ -452,7 +500,7 @@ so a pack number cited in a baseline always means exactly one pack.
   It is also the field that turned a mis-profiled entry into a real disclosure. A raw remote URL
   carries the host and the internal group path; `path` carries a bare directory name. Removing a
   field no consumer reads retires that class outright, with no host-matching heuristic, and unlike
-  the corp-host guard it keeps working on a machine that has no local manifest to read corp hosts
+  the guarded-host guard it keeps working on a machine that has no local manifest to read guarded hosts
   from. The remote stays derivable from the checkout at any time, which is where it came from.
 
   Existing entries that already carry a remote are left alone — nothing reads them, and rewriting
@@ -462,20 +510,20 @@ so a pack number cited in a baseline always means exactly one pack.
 
 ### Patch Changes
 
-- 88492b5: Fix: `fleet add --profile corp` was silently ignored, registering employer repos as personal.
+- 88492b5: Fix: `fleet add --profile guarded` was silently ignored, registering guarded repos as personal.
 
   `fleet` declares its own `--profile` (the sweep filter), and commander hands a parent-declared
-  option the value even when it is typed after the subcommand. So `fleet add <dir> --profile corp`
+  option the value even when it is typed after the subcommand. So `fleet add <dir> --profile guarded`
   left the subcommand's own option undefined, the placement fell back to personal, and the
-  personal branch records `path` and the RAW `remote` — writing the employer host and its internal
+  personal branch records `path` and the RAW `remote` — writing the guarded host and its internal
   group structure into a manifest that is tracked and pushed. That is precisely the disclosure the
   alias convention exists to prevent. The same shadowing class was already fixed for `--manifest`
   and `--json`; `--profile` was missed.
 
   Two changes, because the flag alone is not enough. The CLI now reads the merged option view, so
-  the flag works. And `fleet add` refuses outright when the target's remote matches a corp host
-  declared in the local manifest while the profile is not corp — the manifest already knows which
-  hosts are the employer's and the remote has just been read, so the tool has every fact needed to
+  the flag works. And `fleet add` refuses outright when the target's remote matches a guarded host
+  declared in the local manifest while the profile is not guarded — the manifest already knows which
+  hosts are the guarded side's and the remote has just been read, so the tool has every fact needed to
   prevent this without anyone remembering a flag. It refuses rather than auto-correcting:
   placement is the user's decision, but it may not be made by omission.
 
@@ -612,7 +660,7 @@ so a pack number cited in a baseline always means exactly one pack.
   value it explains changes, because a stale reason misleads exactly where it meant to inform.
 
   **`etymd fleet add`** registers a project, prompting for what no scan can derive and refusing to
-  write an incomplete entry. Fleet manifests gain a mandatory `trust` level on non-corp entries —
+  write an incomplete entry. Fleet manifests gain a mandatory `trust` level on non-guarded entries —
   absence is a finding, never a silent default — a manifest-level `orientation.root` replacing
   per-entry links, and a gate-drift check that reports a repository missing a gate its siblings
   install.
@@ -672,9 +720,9 @@ so a pack number cited in a baseline always means exactly one pack.
 
   - New `state-freshness` truth lens: state/decisions artifacts dated by git committer dates only (never mtime); staleness is relative, so a dormant repo's old state is current; state char budget against the ~10k session-hook truncation; marker-gated decisions format checks (`Scope:`, duplicate/out-of-order `D-NNN` ids, past `Revisit:` dates as due review debt); ADR conventions (`docs/adr/`, `docs/decisions/`, `NNNN-*.md`) recognized natively.
   - New `etymd fleet` command family. The sweep runs a read-only audit per registered repo (`--manifest` required unless the cwd holds `registry.json` — no env var, no global pointer) and renders one line per project with a delta against `last.fleet.json`; detail only for new or risk findings. `fleet check` validates the manifest pair alone (dangling mappings, duplicate names, privacy leaks, machine paths). `fleet dismiss`/`fleet accept` resolve a project's finding from any cwd.
-  - The manifest loader (`src/core/fleet.ts`) resolves both the fleet registry pair (`registry.json` + gitignored `registry.local.json`) and the legacy corpus pair (`sources.json` + `sources.local.json`); corp entries are opaque aliases resolved only through the local file, and every resolution failure is disclosed, never silently skipped.
-  - Persistence invariants, pinned by tests: the sweep never creates `.etymd` anywhere; `--persist-ledgers` only persists into personal repos that already opted in; corp worktrees take zero writes under every flag combination — corp findings persist (and stay dismissible) at `<manifestDir>/corp/<name>/.etymd/`; zero corp-resolved content under the manifest repo's tracked paths.
-  - Fleet-scope wall findings (lens id `fleet-manifest`): corp contract files inside a corp worktree, unregistered corp-remote checkouts under the fleet root, tracked `/Users/` paths in the manifest's own repo, private needles inside `trust: "public-repo"` entries, corp-host commit emails on personal entries.
+  - The manifest loader (`src/core/fleet.ts`) resolves both the fleet registry pair (`registry.json` + gitignored `registry.local.json`) and the legacy corpus pair (`sources.json` + `sources.local.json`); guarded entries are opaque aliases resolved only through the local file, and every resolution failure is disclosed, never silently skipped.
+  - Persistence invariants, pinned by tests: the sweep never creates `.etymd` anywhere; `--persist-ledgers` only persists into personal repos that already opted in; guarded worktrees take zero writes under every flag combination — guarded findings persist (and stay dismissible) at `<manifestDir>/guarded/<name>/.etymd/`; zero guarded-resolved content under the manifest repo's tracked paths.
+  - Fleet-scope wall findings (lens id `fleet-manifest`): guarded contract files inside a guarded worktree, unregistered guarded-remote checkouts under the fleet root, tracked `/Users/` paths in the manifest's own repo, private needles inside `trust: "public-repo"` entries, guarded-host commit emails on personal entries.
   - Fork-aware freshness: entries with `upstream` are dated on fork-authored commits only (`HEAD --not --remotes=<upstream>`), with a disclosed fallback when the remote is absent.
 
 ## 0.1.0 — 2026-07-31

package/README.md

@@ -1,11 +1,11 @@
 # Etymd
 
 <div align="center">
-  <img src="https://raw.githubusercontent.com/triartleet/etymd/main/media/etymd-logo.png" width="520" alt="Etymd — a papyrus of written instructions, each line checked against the repository it describes">
+  <img src="https://raw.githubusercontent.com/fleetorders/etymd/main/media/etymd-logo.png" width="520" alt="Etymd — a papyrus of written instructions, each line checked against the repository it describes">
   <p>
     <a href="https://www.npmjs.com/package/etymd"><img src="https://img.shields.io/npm/v/etymd.svg?label=npm&color=cb3837" alt="npm version"></a>
-    <a href="https://github.com/triartleet/etymd/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/triartleet/etymd/ci.yml?branch=main&label=CI" alt="CI"></a>
-    <a href="https://github.com/triartleet/etymd/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="MIT license"></a>
+    <a href="https://github.com/fleetorders/etymd/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/fleetorders/etymd/ci.yml?branch=main&label=CI" alt="CI"></a>
+    <a href="https://github.com/fleetorders/etymd/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="MIT license"></a>
   </p>
 </div>
 
@@ -167,29 +167,31 @@ append race is a defect in the file's own convention, not a format opinion.
 
 **`fleet-manifest`** (via `etymd fleet`) — one truth guard across every repo you registered:
 per-repo audits plus checks on the fleet manifest itself and on the placement wall between
-personal and employer repos. See [the fleet manifest](#the-fleet-manifest-experimental) below.
+personal and guarded repos. See [the fleet manifest](#the-fleet-manifest-experimental) below.
 
 ## Commands
 
-| Command                          | What it does                                                                                                                                                                                                      |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                                                        |
-| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                                                      |
-| `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                                                        |
-| `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                                                       |
-| `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts — and from the repo's shell surface, where it has one.           |
-| `etymd screen`                   | Content screen: find text that must never be published. Four scopes — `--staged`, `--message`, `--tree`, `--dir`. Bring your own patterns; etymd ships none.                                                      |
-| `etymd scan`                     | The deterministic reckoning behind everything. `--json`.                                                                                                                                                          |
-| `etymd brief`                    | A grounded briefing your in-repo agent completes to author the semantic layer.                                                                                                                                    |
-| `etymd premise`                  | `premise "<task>"` — is this the right task? What it names, verified against the repo; a brief for what only the agent can verify. `--file` (`-` = stdin), `--json`, `--no-brief`, `--fail-on <tier>`. No ledger. |
-| `etymd approve`                  | Refresh the committed baseline non-interactively after intentional structural changes.                                                                                                                            |
-| `etymd ledger`                   | The findings memory: every tracked finding with status and history.                                                                                                                                               |
-| `etymd dismiss`                  | `dismiss <id> --reason <text>` — a dismissed finding never resurfaces without regressing.                                                                                                                         |
-| `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                                                   |
-| `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.                            |
-| `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                                                   |
-| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                          |
-| `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; corp findings persist beside the manifest, never in the corp worktree.                                                                                  |
+| Command                          | What it does                                                                                                                                                                                                                                                        |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `etymd audit`                    | Verify every claim; ranked findings (risk → gap → polish) + ledger diff. `--lens`, `--truth`, `--json`, `--no-ledger`, `--fail-on <tier>`.                                                                                                                          |
+| `etymd init`                     | Onboard: approve the committed baseline; scaffold a minimal AGENTS.md **only if missing**. Never overwrites.                                                                                                                                                        |
+| `etymd doctor`                   | Alias for `audit --truth`.                                                                                                                                                                                                                                          |
+| `etymd context`                  | The economy view: per-file always-loaded footprint + extraction candidates.                                                                                                                                                                                         |
+| `etymd gates`                    | Install local git-hook gates (pre-commit / commit-msg / pre-push, plus a publish screen where something ships) built from your own check scripts — and from the repo's shell surface, where it has one.                                                             |
+| `etymd screen`                   | Content screen: find text that must never be published. Four scopes — `--staged`, `--message`, `--tree`, `--dir`. Bring your own patterns; etymd ships none.                                                                                                        |
+| `etymd scan`                     | The deterministic reckoning behind everything. `--json`.                                                                                                                                                                                                            |
+| `etymd brief`                    | A grounded briefing your in-repo agent completes to author the semantic layer.                                                                                                                                                                                      |
+| `etymd premise`                  | `premise "<task>"` — is this the right task? What it names, verified against the repo; a brief for what only the agent can verify. `--file` (`-` = stdin), `--json`, `--no-brief`, `--fail-on <tier>`. No ledger.                                                   |
+| `etymd approve`                  | Refresh the committed baseline non-interactively after intentional structural changes.                                                                                                                                                                              |
+| `etymd ledger`                   | The findings memory: every tracked finding with status and history.                                                                                                                                                                                                 |
+| `etymd dismiss`                  | `dismiss <id> --reason <text>` — a dismissed finding never resurfaces without regressing.                                                                                                                                                                           |
+| `etymd accept`                   | `accept <id>` — record a finding as accepted reality; visible in the ledger, out of the report.                                                                                                                                                                     |
+| `etymd fleet`                    | Sweep every project in a fleet manifest: read-only per-repo audits + manifest/wall checks. `--manifest`, `--only`, `--profile`, `--truth`, `--persist-ledgers`, `--json`, `--fail-on`.                                                                              |
+| `etymd fleet check`              | Validate the manifest pair alone (no lenses): dangling mappings, duplicate names, privacy leaks, undeclared trust, machine paths. Non-zero exit on any finding.                                                                                                     |
+| `etymd fleet add`                | `add <dir>` — register a project: scans it, asks for what no scan can derive, and refuses to write an entry missing a mandatory field. `--name`, `--kind`, `--profile`, `--trust`, `-y`.                                                                            |
+| `etymd fleet board`              | Render the fleet board: every project's `MILESTONES.md` (contract key `milestones`, shape-checked by the sweep) plus a ranked initiatives table on one page. `--initiatives <file>`, `--out <file>`, `--json`.                                                      |
+| `etymd propose`                  | Score the sweep's improvement findings + recurring classes against a fleet-authored rubric — stable `proposal/1` records, read-only, deterministic, guarded entries excluded. `--rubric <file>` (required), `--manifest <file>` or `--from <fleet.json>`, `--json`. |
+| `etymd fleet dismiss` / `accept` | `<name> <id>` — resolve a project's finding from any cwd; guarded findings persist beside the manifest, never in the guarded worktree.                                                                                                                              |
 
 `--cwd <dir>` targets another directory. Read-only probing of any repo leaves **zero trace**
 (`audit --no-ledger` writes nothing).
@@ -324,7 +326,7 @@ the generated pre-push now carries a `shellcheck` step. Three properties are del
 ### The content screen (`etymd screen`)
 
 A separate question from "are the instructions true?": **does this repo carry text that must
-never be published?** Absolute home paths, an employer's name, an internal hostname, an account
+never be published?** Absolute home paths, an organisation's name, an internal hostname, an account
 identifier — permanent the moment they are committed, because publishing exposes all history,
 not the current tree.
 
@@ -358,7 +360,7 @@ inline marker would not survive into the artifact. Those live in `.etymd-screen-
 repo root — one labeled line per field, so the pattern is never delimited:
 
 ```
-pattern ^AcmeCorp|BetaCorp$
+pattern ^AcmeInc|BetaInc$
 reason fixture proving the detector fires on either name
 date 2026-08-15
 author someone
@@ -373,6 +375,24 @@ missing a field is reported and does not apply: an exemption is a hole in the ga
 nobody signed cannot be audited later. The file is read from the repo being screened, never a
 shared location, and it screens itself out (it necessarily contains every string it exempts).
 
+The file carries a second record kind, for paths rather than lines:
+
+```
+generated ^src/data/corpus\.json$
+reason public-domain corpus, regenerated by scripts/corpus each January
+date 2026-09-04
+author someone
+```
+
+A `generated` path is data a pipeline rebuilds — a public-domain corpus, generated fixtures —
+and period English trips credential vocabulary (`passkey`, `secret`) on a schedule, training
+exactly the `--no-verify` habit the screen exists to prevent. The file is still read and still
+screened: only vocabulary-class patterns drop for it, while secret-class patterns and the
+machine-path check stay — a generated file is precisely where a real credential would be least
+visible. Provenance is unconditional (a path is never the repo naming itself), and the paths
+that took the exemption are named in the output, so a clean run never reads as fully screened
+where it was screened narrower.
+
 ### The commit subject, if you ask for it
 
 Off unless you turn it on:
@@ -418,10 +438,10 @@ steps:
 `etymd fleet` extends the one objective across every repository you work in — your fleet of
 **repositories**, not a fleet of agents. The manifest, `registry.json`, is itself an
 agent-context file: claims about your fleet (what exists, where, under which **profile** — the
-side of the wall an entry belongs to, `personal` or `corp`; the **wall** is the placement
-boundary between personal and employer content that the sweep polices). It rots like any
+side of the wall an entry belongs to, `personal` or `guarded`; the **wall** is the placement
+boundary between personal and guarded content that the sweep polices). It rots like any
 AGENTS.md does, and `etymd fleet` keeps it true. Decision record:
-[`docs/decisions/004-fleet-truth-guard.md`](https://github.com/triartleet/etymd/blob/main/docs/decisions/004-fleet-truth-guard.md). Both the
+[`docs/decisions/004-fleet-truth-guard.md`](https://github.com/fleetorders/etymd/blob/main/docs/decisions/004-fleet-truth-guard.md). Both the
 registry schema and the fleet `--json` schema are **experimental through 0.2.x**.
 
 Two files beside each other — the split is the privacy model:
@@ -446,7 +466,7 @@ Two files beside each other — the split is the privacy model:
       "kind": "docs",
       "profile": "personal",
       "path": "notes",
-      "trust": "private", // mandatory on every non-corp entry — see below
+      "trust": "private", // mandatory on every non-guarded entry — see below
       "staleAfterDays": 45, // per-entry freshness window
       "contract": { "state": "STATUS.md" }, // native conventions register, never migrate
     },
@@ -458,8 +478,14 @@ Two files beside each other — the split is the privacy model:
       "upstream": "origin", // freshness measured on fork-authored commits only
       "trust": "public-repo", // hygiene needles apply (see below)
     },
-    // Corp entries: opaque alias, private, NO path — real dirs live only in the local file.
-    { "name": "c-one", "kind": "repo", "profile": "corp", "private": true, "staleAfterDays": 45 },
+    // Guarded entries: opaque alias, private, NO path — real dirs live only in the local file.
+    {
+      "name": "c-one",
+      "kind": "repo",
+      "profile": "guarded",
+      "private": true,
+      "staleAfterDays": 45,
+    },
   ],
 }
 ```
@@ -468,23 +494,23 @@ Two files beside each other — the split is the privacy model:
 
 ```jsonc
 {
-  "machineProfile": "corp", // which profile this machine resolves; "personal" resolves corp entries disclosed-absent
+  "machineProfile": "guarded", // which profile this machine resolves; "personal" resolves guarded entries disclosed-absent
   "root": "~/projects", // optional per-machine root override
-  "dirs": { "c-one": "~/projects/real-corp-dir" },
-  "labels": { "c-one": "real-corp-dir" },
-  "corpHosts": ["git.example-corp.com"],
+  "dirs": { "c-one": "~/projects/real-guarded-dir" },
+  "labels": { "c-one": "real-guarded-dir" },
+  "guardedHosts": ["git.example-guarded.com"],
 }
 ```
 
 Two fields the scan can never derive, so the manifest must declare them:
 
-- **`trust` — mandatory on every non-corp entry** (`public-repo` | `public-bound` | `private`).
+- **`trust` — mandatory on every non-guarded entry** (`public-repo` | `public-bound` | `private`).
   It is a _safety predicate_, not a label: it decides whether content screening applies, so an
   absent value is reported (`fleet check` flags it), never read as a silent `private`.
   `public-bound` means private today, plausibly public later — screened exactly as hard as
   public, because publishing exposes _all_ history: the scrub has to precede the first commit,
   not the visibility flip. A value outside the vocabulary is flagged rather than coerced, so a
-  typo can never quietly disable screening. Corp entries omit it — `profile: "corp"` already
+  typo can never quietly disable screening. Guarded entries omit it — `profile: "guarded"` already
   implies the answer.
 - **`orientation.root` — optional, declared once.** Names the one entry every other entry is
   guided by. Declared at the manifest level rather than repeated per entry, because a per-entry
@@ -499,10 +525,10 @@ CI) must pass every mandatory value as a flag — there is deliberately no defau
 How the sweep behaves:
 
 - **Read-only by default, everywhere.** The sweep never creates `.etymd` anywhere.
-  `--persist-ledgers` persists only into personal repos that already opted in, and a **corp
+  `--persist-ledgers` persists only into personal repos that already opted in, and a **guarded
   worktree is never written** — regardless of flags, even if a stray `.etymd` exists inside it
-  (pinned by test). Corp findings stay dismissible: their ledger lives at
-  `<manifest-dir>/corp/<name>/.etymd/`, beside the manifest.
+  (pinned by test). Guarded findings stay dismissible: their ledger lives at
+  `<manifest-dir>/guarded/<name>/.etymd/`, beside the manifest.
 - **Deltas.** Each sweep compares against `last.fleet.json` stored beside the manifest and
   renders `Δ +new −resolved` per project. Add `*.fleet.json` to the manifest repo's
   `.gitignore` — sweep output is local-only and never tracked.
@@ -514,17 +540,64 @@ How the sweep behaves:
   that instruction files are legitimately absent in that project — the sweep drops its
   missing-contract finding instead of re-reporting a decision every run. Absence disclosed on
   purpose is a state, not a gap.
-- **Wall checks.** Corp contract files found inside a corp worktree, unregistered checkouts
-  under the fleet root whose remotes match `corpHosts`, tracked `/Users/` paths in the manifest
+- **Wall checks.** Guarded contract files found inside a guarded worktree, unregistered checkouts
+  under the fleet root whose remotes match `guardedHosts`, tracked `/Users/` paths in the manifest
   repo, private **needles** — the identifiers the local file holds (labels, dir names, hosts) —
-  inside `trust: "public-repo"` entries, and corp-host commit emails on personal entries — each
+  inside `trust: "public-repo"` entries, and guarded-host commit emails on personal entries — each
   a risk finding; each check that cannot run is disclosed.
 - **No global pointer.** `--manifest` is required unless the cwd holds `registry.json` — there
   is deliberately no env var and no home-directory pointer.
+- **Milestones and the fleet board.** A project declares its plan in one file — `MILESTONES.md`,
+  registered as `"contract": { "milestones": "MILESTONES.md" }` (`fleet add` registers it when the
+  file is present; `"none"` declares a project deliberately carries no plan). The file has a fixed
+  shape so the fleet can read every plan without an agent: a `# Milestones` heading, then a table
+  `| id | milestone | goal | status | next | effort | depends-on |` — `id` is `M<n>`, `goal` is 1, 2
+  or 3 (your fleet's own ordered goals, declared outside this tool), `status` is planned | active |
+  blocked | done, `next` is the one concrete next step, `effort` the S | M | L remaining,
+  `depends-on` a list of ids or `—`. Prose after the table is free. The sweep files a gap when a
+  declared file is absent or off-shape. `etymd fleet board --initiatives <file> --out <file>`
+  renders every project's rows, a ranked initiatives table (`| rank | id | initiative | goal |
+status | next | effort | projects | depends-on |`, the one hand-edited fleet-level surface), and
+  totals; guarded entries never appear on it. Day-precision stamp, deterministic output, exit code 1
+  when any project is missing or invalid — a board with holes still renders, and says so.
 
 Formatter interop for the `.etymd` state the sweep resolves: same rule as everywhere — see
 [the files Etymd keeps](#the-files-etymd-keeps).
 
+### Rubric-scored proposals (`etymd propose`)
+
+The sweep already gives every improvement finding an action, an effort and a confidence, and
+names the classes open in two or more projects. `etymd propose` adds the scoring step — against
+a rubric **your fleet authors**, because what is worth doing is your call, not the tool's:
+
+```
+severity: 2      # risk=3 · gap=2 · polish=1
+economy: 3       # S=3 · M=2 · L=1
+confidence: 1    # high=3 · medium=2 · low=1
+breadth: 4       # projects carrying it, capped at 3
+```
+
+One criterion per line (`#` comments and blanks ignored). Those four criteria are the whole
+vocabulary — each is computed from finding facts, so a score is arithmetic, not an opinion; a
+line naming anything else is refused quoting the line. `score` is Σ weight × value; a line
+**fires** (listed in `matched`) when the subject reads at/above the criterion's midpoint.
+
+```bash
+etymd propose --manifest registry.json --rubric opportunity.rubric --json
+# or, without re-sweeping: --from <fleet.json> (a stored `etymd fleet --json` output)
+```
+
+Subjects are every `kind: improvement` finding from personal projects plus every recurring
+class, recomputed over personal projects only — **guarded entries are excluded from the output
+entire, by name**. A class is scored conservatively (worst tier, dearest effort, weakest
+confidence). Each `proposal/1` record carries id, class, projects, action, effort, confidence,
+score, the fired rubric lines, and an `implications` block (projects, files, gates,
+reversibility) extracted from the findings' evidence — files are path-shaped evidence tokens,
+and `undetermined` reversibility says so rather than guessing. Read-only and deterministic: no
+timestamps, nothing written, identical input → identical bytes, so a filed proposal can be
+re-derived and compared. Decision record:
+[`docs/decisions/012-propose-rubric-scored-proposals.md`](https://github.com/fleetorders/etymd/blob/main/docs/decisions/012-propose-rubric-scored-proposals.md).
+
 ## Programmatic use
 
 ```ts
@@ -537,7 +610,7 @@ console.log(audit.findings) // one schema: claim · evidence · why · action ·
 ## The corpus (how this is validated)
 
 Etymd is developed against a corpus of real sibling repos rather than fixtures alone —
-[`sources.json`](https://github.com/triartleet/etymd/blob/main/sources.json) lists them by shape. Every heuristic here exists because a real
+[`sources.json`](https://github.com/fleetorders/etymd/blob/main/sources.json) lists them by shape. Every heuristic here exists because a real
 repo proved the previous one wrong, and each skip class in the truth lens is a false positive that
 a corpus run caught.
 
@@ -555,11 +628,12 @@ Without it — on a fresh clone or in CI — those suites skip cleanly and the r
 
 ## Decision record & roadmap
 
-[`docs/decisions/`](https://github.com/triartleet/etymd/tree/main/docs/decisions) — 001 founding · 002 foundation re-lock · **003 the truth-guard
+[`docs/decisions/`](https://github.com/fleetorders/etymd/tree/main/docs/decisions) — 001 founding · 002 foundation re-lock · **003 the truth-guard
 pivot** (the current identity; includes the state-of-the-field investigation it rests on) ·
 **004 fleet mode** (the truth guard across your repositories) · 005 declared rules (design only) ·
-**006 local gate provenance** (what the tool may read, and what it may rewrite).
-[`ROADMAP.md`](https://github.com/triartleet/etymd/blob/main/ROADMAP.md) — what's now / next / later, and the accepted heuristic
+**006 local gate provenance** (what the tool may read, and what it may rewrite) · 011 milestones
+& the fleet board · 012 `etymd propose` (rubric-scored proposals).
+[`ROADMAP.md`](https://github.com/fleetorders/etymd/blob/main/ROADMAP.md) — what's now / next / later, and the accepted heuristic
 trade-offs.
 
 ## License

package/dist/{approve-MA4Z3TBT.js → approve-VN4EDBR5.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-Y6RZRED3.js';
-import { VERSION } from './chunk-DBWDMIYO.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import { VERSION } from './chunk-BUMOGHQA.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-P6ATKV2R.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{audit-YSALDC2L.js → audit-PHAK5HEW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-export { run } from './chunk-CEO3BXQB.js';
-import './chunk-2RNQ6OLV.js';
-import './chunk-IWG77WV3.js';
+export { run } from './chunk-ANFNXFRI.js';
+import './chunk-WKP7M2B3.js';
+import './chunk-FNA4R5KT.js';
 import './chunk-3E2IPCRY.js';
 import './chunk-HI7NWPRA.js';
-import './chunk-Y6RZRED3.js';
-import './chunk-DBWDMIYO.js';
+import './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{brief-DPZYSAMC.js → brief-7MWP35UI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-Y6RZRED3.js';
-import './chunk-DBWDMIYO.js';
+import { scanProject } from './chunk-446EZNAQ.js';
+import './chunk-BUMOGHQA.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import './chunk-YQZDYDAK.js';
 import './chunk-4VPBP6K6.js';

package/dist/{chunk-Y6RZRED3.js → chunk-446EZNAQ.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-DBWDMIYO.js';
+import { VERSION } from './chunk-BUMOGHQA.js';
 import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-4VPBP6K6.js';
 import path from 'path';

package/dist/{chunk-CEO3BXQB.js → chunk-ANFNXFRI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-2RNQ6OLV.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-IWG77WV3.js';
+import { runAudit } from './chunk-WKP7M2B3.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-FNA4R5KT.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-HI7NWPRA.js';
 
 // src/commands/audit.ts

package/dist/{chunk-DBWDMIYO.js → chunk-BUMOGHQA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.15.0"};
+  version: "0.17.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-IWG77WV3.js → chunk-FNA4R5KT.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { expandFileGlobs } from './chunk-Y6RZRED3.js';
+import { expandFileGlobs } from './chunk-446EZNAQ.js';
 import { DEFAULT_CONFIG, CONFIG_FILE } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, matchesAnyGlob, normalizeRelPath, readJson, pathExists, git } from './chunk-4VPBP6K6.js';
 import path3 from 'path';
@@ -448,6 +448,13 @@ var PLACEHOLDER_PREFIX_RE = /^(?:my|your)-/i;
 function isPlaceholderClaim(token) {
   return token.split("/").some((seg) => PLACEHOLDER_PREFIX_RE.test(seg) || PLACEHOLDER_SEGMENTS.has(seg.toLowerCase()));
 }
+var NAMESPACE_IDENT = "[A-Za-z][A-Za-z0-9-]{0,15}";
+var NAMESPACE_STOP = new Set(
+  "note notes see warning caution caveat caveats example examples ex eg ie nb ps re per file files path paths hint tip tips todo fixme step steps rule rules ref refs fact facts output outputs input inputs result results summary status overview next prev then thus hence plus goal goals spec specs context".split(" ")
+);
+function isNamespace(ident) {
+  return Boolean(ident) && !NAMESPACE_STOP.has(ident.toLowerCase());
+}
 function claimContext(text, index) {
   const start = text.lastIndexOf("\n", index) + 1;
   const endRaw = text.indexOf("\n", index);
@@ -467,8 +474,9 @@ ${line}`;
   }
   return line;
 }
-function extractPathClaims(text) {
+function extractPathClaims(text, opts = {}) {
   const prospectiveOnly = /* @__PURE__ */ new Map();
+  const namespacedOnly = /* @__PURE__ */ new Map();
   const placeholder = /* @__PURE__ */ new Set();
   for (const m of text.matchAll(/`([^`\n]+)`/g)) {
     const token = m[1].trim();
@@ -490,14 +498,21 @@ function extractPathClaims(text) {
     }
     const prospective2 = CREATION_CONTEXT_RE.test(claimContext(text, m.index ?? 0));
     prospectiveOnly.set(claim, (prospectiveOnly.get(claim) ?? true) && prospective2);
+    if (opts.namespaces) {
+      const nsLead = new RegExp(`(${NAMESPACE_IDENT}):[ \\t]*$`).exec(text.slice(0, m.index ?? 0));
+      const prefixed = isNamespace(nsLead?.[1]);
+      namespacedOnly.set(claim, (namespacedOnly.get(claim) ?? true) && prefixed);
+    }
   }
   const paths = [];
   const prospective = [];
+  const namespaced = [];
   for (const [claim, only] of prospectiveOnly) {
     if (only) prospective.push(claim);
+    else if (namespacedOnly.get(claim)) namespaced.push(claim);
     else paths.push(claim);
   }
-  return { paths, prospective, placeholder: [...placeholder] };
+  return { paths, prospective, namespaced, placeholder: [...placeholder] };
 }
 var LOCAL_REF_LEADINS = new Set(
   "decision decisions entry entries ruling rulings record records ledger id ids item items see per in of on at by to as is was are were the a an and or but not with under over from via vs than after before since between through against latest newest earliest only also still now supersedes superseded superseding amends amended extends extended cites cited citing adds added adding wrote written writes locked locks closed closes opened opens resolves resolved reopened recorded number numbers".split(" ")
@@ -604,7 +619,9 @@ function emptyCounters() {
     prospectiveSkipped: 0,
     placeholderSkipped: 0,
     qualifiedRefsSkipped: 0,
-    unresolvableRefs: 0
+    unresolvableRefs: 0,
+    namespacedSkipped: 0,
+    outsideRepoSkipped: 0
   };
 }
 async function checkTextClaims(env, file, opts, counters) {
@@ -642,9 +659,12 @@ async function checkTextClaims(env, file, opts, counters) {
       confidence: "high"
     });
   }
-  const { paths, prospective, placeholder } = extractPathClaims(file.text);
+  const { paths, prospective, placeholder, namespaced } = extractPathClaims(file.text, {
+    namespaces: opts.treatNamespacedPrefixes
+  });
   counters.prospectiveSkipped += prospective.length;
   counters.placeholderSkipped += placeholder.length;
+  counters.namespacedSkipped += namespaced.length;
   const missing = [];
   for (const claim of paths) {
     if (await env.pathResolves(claim)) examined.push({ kind: "path", value: claim, exists: true });
@@ -654,6 +674,11 @@ async function checkTextClaims(env, file, opts, counters) {
   const gitignored = new Set((ignoredOut ?? "").split("\n").filter(Boolean));
   let pathFindings = 0;
   for (const claim of missing) {
+    if (opts.rootedFirstSegments && !opts.rootedFirstSegments.has(claim.split("/")[0] ?? claim)) {
+      counters.outsideRepoSkipped += 1;
+      examined.push({ kind: "path", value: claim, exists: null });
+      continue;
+    }
     if (gitignored.has(claim)) {
       counters.gitignoredSkipped += 1;
       examined.push({ kind: "path", value: claim, exists: null });
@@ -755,4 +780,4 @@ function checkDecisionRefs(file, ledger, opts, counters) {
   return { findings, examined };
 }
 
-export { KNOWN_EXTENSIONS, PATH_TOKEN_RE, buildTruthEnv, checkDecisionRefs, checkDocRefs, checkTextClaims, emptyCounters, listInstructionFiles, listStateDocuments, loadDecisionLedger, meetsFailOn, packageManagerUsage, parseFailOnTier, rankFindings, stateFreshnessLens };
+export { KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP, PATH_TOKEN_RE, buildTruthEnv, checkDecisionRefs, checkDocRefs, checkTextClaims, emptyCounters, listInstructionFiles, listStateDocuments, loadDecisionLedger, meetsFailOn, packageManagerUsage, parseFailOnTier, rankFindings, stateFreshnessLens };