monomind 1.9.16 → 1.10.0

package/.claude/skills/mastermind/project-workspace.md

@@ -0,0 +1,244 @@
+---
+name: mastermind-project-workspace
+description: Mastermind project-workspace — configure a project-level workspace (not an execution workspace). Manages source type, visibility, repo URL/ref, branch, cwd, setup/cleanup commands, remote provider, remote workspace ref, runtime config JSON, and shared workspace key. Mirrors ProjectWorkspaceDetail.tsx.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Project Workspace
+
+This skill is invoked by `mastermind:project-workspace` or directly via `/mastermind:project-workspace`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org the project belongs to (required)
+- `project_id`: project id (required)
+- `workspace_id`: workspace id within the project (required)
+- `action`: show | config | runtime | provision | teardown
+- `name`: display name for workspace (for config)
+- `source_type`: local_path | non_git_path | git_repo | remote_managed (for config)
+- `visibility`: default | advanced (for config)
+- `cwd`: absolute local path (for config; required if source_type is local_path/non_git_path)
+- `repo_url`: remote repository URL (for config)
+- `repo_ref`: git ref/commit (for config)
+- `default_ref`: default branch name (for config)
+- `setup_command`: command to run after workspace creation (for config)
+- `cleanup_command`: command to run before workspace teardown (for config)
+- `remote_provider`: remote provider identifier (for config; use with remote_managed)
+- `remote_workspace_ref`: remote workspace reference ID (for config; use with remote_managed)
+- `shared_workspace_key`: key to share this workspace across agents (for config)
+- `runtime_config`: JSON string with workspaceRuntime config overrides (for runtime)
+- `caller`: command | master
+
+---
+
+## Source Types
+
+| Type | Label | Required fields |
+|------|-------|----------------|
+| `local_path` | Local git checkout | `cwd` (absolute path) |
+| `non_git_path` | Local non-git path | `cwd` (absolute path) |
+| `git_repo` | Remote git repo | `repo_url` |
+| `remote_managed` | Remote-managed workspace | `remote_workspace_ref` or `repo_url` |
+
+## Visibility
+
+| Value | Description |
+|-------|-------------|
+| `default` | Shown to all agents in the project |
+| `advanced` | Hidden by default; shown only when explicitly selected |
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Workspace
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+projectsFile=".monomind/orgs/${org_name}-projects.json"
+[ ! -f "$projectsFile" ] && { echo "ERROR: No projects file for org '${org_name}'."; exit 1; }
+
+# Find project
+projDef=$(jq -r --arg pid "$project_id" '.projects[] | select(.id == $pid or .name == $pid)' "$projectsFile")
+[ -z "$projDef" ] && { echo "ERROR: Project '$project_id' not found."; exit 1; }
+
+# Load project workspaces file
+pwsFile=".monomind/orgs/${org_name}-project-workspaces.json"
+[ ! -f "$pwsFile" ] && echo '{"workspaces":[]}' > "$pwsFile"
+
+wsDef=$(jq -r --arg wid "$workspace_id" --arg pid "$project_id" \
+  '.workspaces[] | select(.id == $wid and (.project_id == $pid or .projectId == $pid))' \
+  "$pwsFile")
+```
+
+---
+
+## Step 2 — Execute Action
+
+### show (default)
+
+```bash
+echo "PROJECT WORKSPACE — $workspace_id @ $project_id ($org_name)"
+echo "────────────────────────────────────────────────────────"
+
+if [ -z "$wsDef" ]; then
+  echo "  Workspace '$workspace_id' not found in project '$project_id'."
+  echo "  List workspaces: /mastermind:workspaces --org $org_name"
+  exit 0
+fi
+
+echo "$wsDef" | jq -r '
+  "  ID:                \(.id)",
+  "  Name:              \(.name // "(unnamed)")",
+  "  Source type:       \(.sourceType // .source_type // "local_path")",
+  "  Visibility:        \(.visibility // "default")",
+  "  CWD:               \(.cwd // "(none)")",
+  "  Repo URL:          \(.repoUrl // .repo_url // "(none)")",
+  "  Repo ref:          \(.repoRef // .repo_ref // "(default)")",
+  "  Default ref:       \(.defaultRef // .default_ref // "(default branch)")",
+  "  Setup command:     \(.setupCommand // .setup_command // "(none)")",
+  "  Cleanup command:   \(.cleanupCommand // .cleanup_command // "(none)")",
+  "  Remote provider:   \(.remoteProvider // .remote_provider // "(none)")",
+  "  Remote ws ref:     \(.remoteWorkspaceRef // .remote_workspace_ref // "(none)")",
+  "  Shared key:        \(.sharedWorkspaceKey // .shared_workspace_key // "(none)")"
+'
+
+rtConfig=$(echo "$wsDef" | jq -r '.runtimeConfig.workspaceRuntime // null')
+echo ""
+echo "RUNTIME CONFIG: $([ "$rtConfig" = "null" ] && echo '(none)' || echo "$rtConfig" | jq -c .)"
+```
+
+### config
+
+```bash
+if [ -z "$wsDef" ]; then
+  echo "ERROR: Workspace '$workspace_id' not found."
+  exit 1
+fi
+
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+tmp="${pwsFile}.tmp"
+jq \
+  --arg wid "$workspace_id" \
+  --arg pid "$project_id" \
+  --arg name "${name:-}" \
+  --arg st "${source_type:-}" \
+  --arg vis "${visibility:-}" \
+  --arg cwd_ "${cwd:-}" \
+  --arg repoUrl "${repo_url:-}" \
+  --arg repoRef "${repo_ref:-}" \
+  --arg defaultRef "${default_ref:-}" \
+  --arg setupCmd "${setup_command:-}" \
+  --arg cleanupCmd "${cleanup_command:-}" \
+  --arg remoteProvider "${remote_provider:-}" \
+  --arg remoteRef "${remote_workspace_ref:-}" \
+  --arg sharedKey "${shared_workspace_key:-}" \
+  --arg ts "$ts" \
+  '.workspaces = [.workspaces[] | if (.id == $wid and (.project_id == $pid or .projectId == $pid)) then
+    (if $name != "" then .name = $name else . end) |
+    (if $st != "" then .sourceType = $st else . end) |
+    (if $vis != "" then .visibility = $vis else . end) |
+    (if $cwd_ != "" then .cwd = $cwd_ else . end) |
+    (if $repoUrl != "" then .repoUrl = $repoUrl else . end) |
+    (if $repoRef != "" then .repoRef = $repoRef else . end) |
+    (if $defaultRef != "" then .defaultRef = $defaultRef else . end) |
+    (if $setupCmd != "" then .setupCommand = $setupCmd else . end) |
+    (if $cleanupCmd != "" then .cleanupCommand = $cleanupCmd else . end) |
+    (if $remoteProvider != "" then .remoteProvider = $remoteProvider else . end) |
+    (if $remoteRef != "" then .remoteWorkspaceRef = $remoteRef else . end) |
+    (if $sharedKey != "" then .sharedWorkspaceKey = $sharedKey else . end) |
+    .updatedAt = $ts
+  else . end]' \
+  "$pwsFile" > "$tmp" && mv "$tmp" "$pwsFile"
+
+echo "Project workspace '$workspace_id' config updated."
+```
+
+### runtime
+
+```bash
+[ -z "$runtime_config" ] && { echo "ERROR: --runtime-config (JSON string) required."; exit 1; }
+
+# Validate JSON
+parsed=$(echo "$runtime_config" | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d))" 2>&1) || {
+  echo "ERROR: --runtime-config must be valid JSON: $parsed"
+  exit 1
+}
+
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+tmp="${pwsFile}.tmp"
+jq --arg wid "$workspace_id" --arg pid "$project_id" --argjson rt "$parsed" --arg ts "$ts" \
+  '.workspaces = [.workspaces[] | if (.id == $wid and (.project_id == $pid or .projectId == $pid)) then
+    .runtimeConfig = {"workspaceRuntime": $rt} | .updatedAt = $ts
+  else . end]' \
+  "$pwsFile" > "$tmp" && mv "$tmp" "$pwsFile"
+
+echo "Runtime config updated for workspace '$workspace_id'."
+echo "  Keys: $(echo "$parsed" | python3 -c "import json,sys; d=json.load(sys.stdin); print(', '.join(d.keys()))")"
+```
+
+### provision
+
+```bash
+setupCmd=$(echo "$wsDef" | jq -r '.setupCommand // .setup_command // ""')
+wsPath=$(echo "$wsDef" | jq -r '.cwd // ""')
+
+echo "PROVISION — $workspace_id"
+echo "────────────────────────────────────────────────────────"
+if [ -z "$setupCmd" ]; then
+  echo "  No setup command configured."
+  echo "  Set one: --action config --setup-command 'npm install'"
+else
+  echo "  Command: $setupCmd"
+  echo "  CWD:     ${wsPath:-(none)}"
+  if [ -d "$wsPath" ] && [ -n "$setupCmd" ]; then
+    echo "  Executing…"
+    (cd "$wsPath" && eval "$setupCmd") && echo "  Provision complete." || echo "  Provision command exited with error."
+  fi
+fi
+```
+
+### teardown
+
+```bash
+cleanupCmd=$(echo "$wsDef" | jq -r '.cleanupCommand // .cleanup_command // ""')
+wsPath=$(echo "$wsDef" | jq -r '.cwd // ""')
+
+echo "TEARDOWN — $workspace_id"
+echo "────────────────────────────────────────────────────────"
+if [ -z "$cleanupCmd" ]; then
+  echo "  No cleanup command configured."
+else
+  echo "  Command: $cleanupCmd"
+  [ -d "$wsPath" ] && (cd "$wsPath" && eval "$cleanupCmd") && echo "  Teardown complete." || echo "  No path or teardown error."
+fi
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+project_id: <project_id>
+workspace_id: <workspace_id>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/projects.md

@@ -0,0 +1,164 @@
+---
+name: mastermind-projects
+description: Mastermind projects — create and manage scoped project workspaces within an org. Group tasks under named projects, assign agents to projects, and track project-level status.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Projects
+
+This skill is invoked by `mastermind:projects` or directly via `/mastermind:projects`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block
+- `org_name`: org to manage projects for
+- `action`: list | add | archive | assign | status
+- `project_name`: display name (for add)
+- `project_id`: slug (for archive/assign/status)
+- `agent_id`: role id to assign as project lead
+- `description`: project description
+- `caller`: command | master
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Projects State
+
+Projects are stored in `.monomind/orgs/<org_name>-projects.json`:
+
+```bash
+projectsFile=".monomind/orgs/${org_name}-projects.json"
+[ ! -f "$projectsFile" ] && echo '{"projects":[]}' > "$projectsFile"
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+```bash
+jq -r '
+  .projects[] |
+  "[\(.id)] \(.name)  lead=\(.lead_agent // "unassigned")  status=\(.status // "active")  tasks=\(.task_count // 0)\n  \(.description // "")"
+' "$projectsFile" 2>/dev/null || echo "No projects yet."
+```
+
+Render as:
+```
+PROJECTS — org: <org_name>
+──────────────────────────────────────────────────────
+[homepage-redesign] Homepage Redesign
+  Lead: content-writer  |  Status: active  |  Tasks: 7
+  A full redesign of the company homepage with new copy and visuals.
+
+[q2-seo-push] Q2 SEO Push
+  Lead: seo-specialist  |  Status: active  |  Tasks: 12
+  Target 10 high-volume keywords for Q2.
+```
+
+### add
+
+```bash
+project_id=$(echo "$project_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | tr -s '-')
+tmp="${projectsFile}.tmp"
+jq --arg id "$project_id" \
+   --arg name "$project_name" \
+   --arg desc "${description:-}" \
+   --arg lead "${agent_id:-}" \
+   '.projects += [{"id":$id,"name":$name,"description":$desc,"lead_agent":($lead|if .=="" then null else . end),
+     "status":"active","task_count":0,"created_at":(now|todate)}]' \
+   "$projectsFile" > "$tmp" && mv "$tmp" "$projectsFile"
+echo "Project created: $project_id"
+```
+
+Emit `org:project:created` event to dashboard.
+
+### assign
+
+Set the lead agent for a project:
+
+```bash
+tmp="${projectsFile}.tmp"
+jq --arg id "$project_id" --arg agent "$agent_id" \
+   '.projects = [.projects[] | if .id == $id then .lead_agent = $agent | .updated_at = (now|todate) else . end]' \
+   "$projectsFile" > "$tmp" && mv "$tmp" "$projectsFile"
+echo "Assigned $agent_id as lead for project $project_id"
+```
+
+### archive
+
+```bash
+tmp="${projectsFile}.tmp"
+jq --arg id "$project_id" \
+   '.projects = [.projects[] | if .id == $id then .status = "archived" | .archived_at = (now|todate) else . end]' \
+   "$projectsFile" > "$tmp" && mv "$tmp" "$projectsFile"
+echo "Project $project_id archived."
+```
+
+### status
+
+Show project summary with linked tasks from the board:
+
+```bash
+project=$(jq --arg id "$project_id" '.projects[] | select(.id == $id)' "$projectsFile")
+echo "$project" | jq .
+
+# If board exists, count tasks tagged with this project
+orgFile=".monomind/orgs/${org_name}.json"
+board_id=$(jq -r '.board_id // empty' "$orgFile")
+if [ -n "$board_id" ]; then
+  todo_col=$(jq -r '.todo_col_id // empty' "$orgFile")
+  doing_col=$(jq -r '.doing_col_id // empty' "$orgFile")
+  done_col=$(jq -r '.done_col_id // empty' "$orgFile")
+  echo "Tasks on board tagged project:$project_id:"
+  for col in "$todo_col" "$doing_col" "$done_col"; do
+    monotask card list $board_id --col $col --json 2>/dev/null | \
+      jq -r --arg p "project:$project_id" '[.[] | select((.labels // []) | index($p))] | length' 2>/dev/null
+  done
+fi
+```
+
+---
+
+## Using Projects in Task Management
+
+When creating tasks with `/mastermind:tasks`, tag them to a project:
+
+```bash
+monotask card label add $board_id $CARD_ID "project:<project_id>"
+```
+
+When running org agents, include the project context in task prompts:
+
+```
+This task belongs to project "<project_name>": <description>
+Report your output tagged with project_id: <project_id>
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+project_id: <project_id if applicable>
+projects_file: .monomind/orgs/<org_name>-projects.json
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/routine-detail.md

@@ -0,0 +1,253 @@
+---
+name: mastermind-routine-detail
+description: Mastermind routine-detail — deep inspection and management of a single routine: trigger config (schedule/webhook), variables, concurrency/catchup policies, run history, webhook rotation, and revision tracking.
+type: domain-skill
+default_mode: auto
+---
+
+# Mastermind Routine Detail
+
+This skill is invoked by `mastermind:routine-detail` or directly via `/mastermind:routine-detail`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org the routine belongs to (required)
+- `routine_id`: routine id/slug (required)
+- `action`: show | runs | config | variables | rotate-webhook | revisions
+- `days`: lookback window for run history (default 14)
+- `var_key`: variable key (for variables --set)
+- `var_value`: variable value
+- `caller`: command | master
+
+---
+
+## Trigger Types
+
+| Kind | Description |
+|------|-------------|
+| `schedule` | Cron expression — agent fires on schedule |
+| `webhook` | HTTP POST to generated endpoint; signed via signing_mode |
+
+## Signing Modes (webhook only)
+
+| Mode | Description |
+|------|-------------|
+| `none` | No signature verification |
+| `bearer` | Authorization: Bearer <token> header |
+| `hmac_sha256` | X-Hub-Signature-256 header (HMAC-SHA256 of body) |
+| `github_hmac` | GitHub-style HMAC — identical to hmac_sha256 + secret stored in mastermind:secrets |
+
+## Concurrency Policies
+
+| Policy | Behavior |
+|--------|----------|
+| `coalesce_if_active` | Skip trigger if a run is already active; record as coalesced |
+| `always_enqueue` | Always create a new run regardless of active runs |
+| `skip_if_active` | Silently discard trigger if a run is active |
+
+## Catchup Policies (schedule only)
+
+| Policy | Behavior |
+|--------|----------|
+| `skip_missed` | Missed scheduled runs are discarded |
+| `enqueue_missed_with_cap` | Enqueue missed runs up to `catchup_cap` (default 3) |
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Routine Data
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+routinesFile=".monomind/orgs/${org_name}-routines.json"
+[ ! -f "$routinesFile" ] && { echo "ERROR: No routines file for org '$org_name'. Create routines first via /mastermind:runorg."; exit 1; }
+
+routineDef=$(jq -r --arg id "$routine_id" '.routines[] | select(.id == $id)' "$routinesFile")
+[ -z "$routineDef" ] && { echo "ERROR: Routine '$routine_id' not found in org '$org_name'."; exit 1; }
+
+stateFile=".monomind/orgs/${org_name}-state.json"
+days=${days:-14}
+cutoff=$(date -u -v-${days}d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "${days} days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")
+```
+
+---
+
+## Step 2 — Execute Action
+
+### show (default)
+
+```bash
+echo "ROUTINE DETAIL — $routine_id @ $org_name"
+echo "────────────────────────────────────────────────────────"
+
+echo "$routineDef" | jq -r '
+  "  ID:              \(.id)",
+  "  Name:            \(.name // "-")",
+  "  Assigned agent:  \(.agent_id // "(any)")",
+  "  Enabled:         \(.enabled // false)",
+  "",
+  "TRIGGER",
+  "  Kind:            \(.trigger.kind // "schedule")",
+  (if (.trigger.kind // "schedule") == "schedule" then
+    "  Cron:            \(.trigger.cron // "-")",
+    "  Catchup policy:  \(.catchup_policy // "skip_missed")",
+    "  Catchup cap:     \(.catchup_cap // 3 | tostring)"
+  else
+    "  Endpoint:        \(.trigger.endpoint // "(not generated)")",
+    "  Signing mode:    \(.trigger.signing_mode // "none")"
+  end),
+  "",
+  "CONCURRENCY",
+  "  Policy:          \(.concurrency_policy // "coalesce_if_active")",
+  "",
+  "VARIABLES",
+  "  Count:           \((.variables // {}) | length | tostring)"
+'
+
+# Show last run summary from state
+lastRun=$([ -f "$stateFile" ] && jq -r --arg id "$routine_id" '.routines[$id].last_run // "-"' "$stateFile" || echo "-")
+runCount=$([ -f "$stateFile" ] && jq -r --arg id "$routine_id" '.routines[$id].run_count // 0' "$stateFile" || echo "0")
+echo ""
+echo "  Last run:   $lastRun"
+echo "  Run count:  $runCount"
+```
+
+### runs
+
+```bash
+echo "RUN HISTORY — $routine_id (last ${days} days)"
+echo "────────────────────────────────────────────────────────"
+printf "%-26s %-12s %-8s %-14s %s\n" "TIMESTAMP" "STATUS" "TOKENS" "TRIGGER KIND" "COALESCED"
+echo "────────────────────────────────────────────────────────"
+
+runsFile=".monomind/orgs/${org_name}-routine-runs.jsonl"
+found=0
+
+if [ -f "$runsFile" ]; then
+  while IFS= read -r line; do
+    rid=$(echo "$line" | jq -r '.routine_id // ""')
+    [ "$rid" != "$routine_id" ] && continue
+    ts=$(echo "$line" | jq -r '.ts // ""')
+    [ -n "$cutoff" ] && [ "$ts" \< "$cutoff" ] && continue
+    st=$(echo "$line" | jq -r '.status // "-"')
+    tok=$(echo "$line" | jq -r '.tokens // "-"')
+    tkind=$(echo "$line" | jq -r '.trigger_kind // "schedule"')
+    coal=$(echo "$line" | jq -r 'if .coalesced then "yes" else "-" end')
+    printf "%-26s %-12s %-8s %-14s %s\n" "$ts" "$st" "$tok" "$tkind" "$coal"
+    found=$((found + 1))
+  done < "$runsFile"
+fi
+
+[ "$found" -eq 0 ] && echo "  No runs in the last $days days."
+```
+
+### config
+
+```bash
+echo "FULL CONFIG — $routine_id"
+echo "────────────────────────────────────────────────────────"
+echo "$routineDef" | jq 'del(.variables)'
+echo ""
+echo "TRIGGER DETAIL"
+echo "$routineDef" | jq '.trigger'
+```
+
+### variables
+
+```bash
+echo "VARIABLES — $routine_id"
+echo "────────────────────────────────────────────────────────"
+
+vars=$(echo "$routineDef" | jq -r '.variables // {} | to_entries[] | "  \(.key) = \(.value)"')
+[ -z "$vars" ] && echo "  No variables defined." || echo "$vars"
+
+# Set a variable if var_key provided
+if [ -n "$var_key" ]; then
+  [ -z "$var_value" ] && { echo "ERROR: --var-value required when setting a variable."; exit 1; }
+  tmp="${routinesFile}.tmp"
+  jq --arg id "$routine_id" --arg k "$var_key" --arg v "$var_value" \
+    '.routines = [.routines[] | if .id == $id then .variables[$k] = $v else . end]' \
+    "$routinesFile" > "$tmp" && mv "$tmp" "$routinesFile"
+  echo ""
+  echo "Set variable: $var_key = $var_value"
+fi
+```
+
+### rotate-webhook
+
+```bash
+triggerKind=$(echo "$routineDef" | jq -r '.trigger.kind // "schedule"')
+[ "$triggerKind" != "webhook" ] && { echo "ERROR: Routine '$routine_id' is not a webhook-triggered routine."; exit 1; }
+
+newToken=$(openssl rand -hex 24 2>/dev/null || python3 -c "import secrets; print(secrets.token_hex(24))")
+newEndpoint="/api/webhook/${org_name}/${routine_id}/${newToken}"
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+tmp="${routinesFile}.tmp"
+jq --arg id "$routine_id" --arg ep "$newEndpoint" --arg ts "$ts" \
+  '.routines = [.routines[] | if .id == $id then
+     .trigger.endpoint = $ep | .trigger.rotated_at = $ts
+   else . end]' \
+  "$routinesFile" > "$tmp" && mv "$tmp" "$routinesFile"
+
+echo "Webhook rotated for '$routine_id'"
+echo "  New endpoint: $newEndpoint"
+echo "  Rotated at:   $ts"
+echo ""
+echo "Update your webhook source to use the new endpoint."
+signingMode=$(echo "$routineDef" | jq -r '.trigger.signing_mode // "none"')
+[ "$signingMode" != "none" ] && echo "  Signing mode '$signingMode' is unchanged — re-generate the signing secret if required."
+```
+
+### revisions
+
+```bash
+revisionsFile=".monomind/orgs/${org_name}-routine-revisions.jsonl"
+echo "REVISIONS — $routine_id"
+echo "────────────────────────────────────────────────────────"
+
+if [ ! -f "$revisionsFile" ]; then
+  echo "  No revision history found."
+else
+  found=0
+  while IFS= read -r line; do
+    rid=$(echo "$line" | jq -r '.routine_id // ""')
+    [ "$rid" != "$routine_id" ] && continue
+    ts=$(echo "$line" | jq -r '.ts // ""')
+    who=$(echo "$line" | jq -r '.changed_by // "system"')
+    what=$(echo "$line" | jq -r '.change_summary // "-"')
+    printf "  [%s] by %-16s  %s\n" "$ts" "$who" "$what"
+    found=$((found + 1))
+  done < "$revisionsFile"
+  [ "$found" -eq 0 ] && echo "  No revisions found for '$routine_id'."
+fi
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+routine_id: <routine_id>
+trigger_kind: <schedule|webhook>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.