openplanr 2.2641.1 → 2.2641.2

package/lib/host-packages/claude/openplanr/references/agents/shared/modes/spec-driven/backend.md

@@ -1,12 +1,11 @@
-<!-- ${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/spec-driven/backend.md: spec-driven-mode-only content for backend-agent (DEV Tech tasks only). Loaded by agents/backend-agent.md when MODE=spec-driven. -->
+<!-- Spec-driven paths for planr-backend. Loaded when the caller passes MODE=spec-driven and SPEC_DIR. -->
 
-> **Mode:** spec-driven
-> **Loaded by:** `agents/backend-agent.md` when the orchestrator passes `MODE=spec-driven` and `SPEC_DIR`.
+> **Mode:** spec-driven (`SPEC_DIR` supplied).
 
 ## Path Resolution
 
-The orchestrator (`/ship`) passes the absolute task file path,
-`MODE=spec-driven`, and `SPEC_DIR`. Use that exact task path first.
+Ship passes the absolute task file path, `MODE=spec-driven`, and `SPEC_DIR`.
+Use that exact task path first.
 
 - Spec directory: `.planr/specs/SPEC-NNN-{slug}/`.
 - Task: `<SPEC_DIR>/tasks/T-NNN-{slug}.md`.
@@ -25,57 +24,21 @@ directory and use it only when unique. Follow
 `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/task-context-resolution.md` after resolving
 the file.
 
-**Step 0.2 entity scaffold** (`output/db/schema.json` → `output/src/`): use **`agents/entity-scaffold-agent.md`** — not this file.
+## Mode inputs
 
----
+- The parent story, its optional Gherkin sidecar, and the enclosing
+  specification.
+- `input/tech/stack.md` when present, with every `ActiveStackFiles` entry
+  resolved through the installed stack root and the project-local
+  `.planr/stacks` overlay.
+- Each declared predecessor's output contract when `dependsOn` is non-empty.
+- `output/db/schema.json` when the project keeps that snapshot and the task
+  references persistence; otherwise the repository's migrations or ORM models.
+  Validate table and column names before implementing them.
 
-## Inputs (Dev Mode — Step 3)
-
-| Input | Source | Required |
-|-------|--------|----------|
-| `<SPEC_DIR>/tasks/T-NNN-{slug}.md` (Type=Tech) | Specification Agent | Yes |
-| `input/tech/stack.md` | Tech Lead | Yes |
-| `output/db/schema.json` | DB Agent | When referencing the DB |
-| Existing codebase (read context) | Dev environment | Read-only |
-
----
-
-## Outputs (Dev Mode — Step 3)
-
-All files listed under `### Create` and `### Modify` in the task file (`<SPEC_DIR>/tasks/T-NNN-{slug}.md`).
-
----
-
-## Implementation guidance
-
-```
-1. Load `<SPEC_DIR>/tasks/T-NNN-{slug}.md` and extract frontmatter,
-   Create/Modify/Preserve, Objective, Implementation or Technical Spec,
-   Verification, and Done When. Follow `storyId` to the story, load its optional
-   Gherkin sidecar when present, then load the enclosing specification.
-2. Load `input/tech/stack.md`. Resolve every `ActiveStackFiles` entry through the
-   installed stack root and the project-local `.planr/stacks` overlay as
-   defined by the shared task-context guidance.
-3. Read each declared predecessor's output contract when `dependsOn` is non-empty.
-   Load `output/db/schema.json` when the task references persistence, and validate
-   table and column names before implementing them.
-4. Read the listed files and enough connected source to understand established
-   interfaces and project patterns.
-5. Implement the requested backend behavior completely using established project
-   patterns. Add meaningful unit and integration coverage where it improves
-   confidence.
-6. Treat Create/Modify as expected scope. A directly required companion test,
-   declaration, migration, fixture, generated file, or configuration change is
-   valid when it serves acceptance criteria, stays within backend ownership, and
-   remains outside Preserve. Disclose it in the result.
-7. Keep Preserve paths unchanged. If the requested outcome conflicts with one,
-   find a safe in-scope alternative or report the conflict clearly.
-8. Apply `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/verification-and-recovery-backend.md` for
-   adaptive verification and recovery.
-9. Return the shared implementation-result format.
-```
-
----
+Apply `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/verification-and-recovery-backend.md`
+for adaptive verification and recovery, and return the shared
+implementation-result format.
 
 ## Error Handling (mode-specific paths)
 
@@ -84,13 +47,7 @@ All files listed under `### Create` and `### Modify` in the task file (`<SPEC_DI
 | SPEC_DIR or Ship task path missing/ambiguous | Report the selector, searched directory, and candidates; do not guess |
 | Parent story or spec missing | Continue from the task and source when sufficient; list the missing path under Issues |
 | Active stack file missing | Report the logical path and both lookup locations; use the installed default when available |
-| schema.json missing for DB work | Identify the affected requirement and avoid inventing tables or columns; continue unaffected work |
-| DB table or column absent from schema | Report the exact reference and the smallest schema or task correction needed |
+| No schema source for DB work | Identify the affected requirement and avoid inventing tables or columns; continue unaffected work |
+| DB table or column absent from the schema source | Report the exact reference and the smallest schema or task correction needed |
 | `dependsOn` output unavailable | Name the dependency and required interface; continue independent work and report the blocked portion |
 | Preserve path changed | Restore it, use another implementation approach, and report a conflict only if no safe approach remains |
-
----
-
-*Reads: task · spec/story/Gherkin · dependency outputs · stack overlays · schema · source*
-*Writes: backend layer files only*
-*Runs in parallel with: Frontend Agent (UI task)*

package/lib/host-packages/claude/openplanr/references/agents/shared/modes/spec-driven/designer.md

@@ -1,7 +1,6 @@
-<!-- ${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/spec-driven/designer.md: spec-driven-mode-only content for designer-agent. Loaded by agents/designer-agent.md when MODE=spec-driven. T-002 of SPEC-002. -->
+<!-- Spec-driven paths for planr-designer. Loaded when the caller passes MODE=spec-driven and SPEC_DIR. -->
 
-> **Mode:** spec-driven
-> **Loaded by:** `agents/designer-agent.md` when the orchestrator passes `MODE=spec-driven` and `SPEC_DIR`.
+> **Mode:** spec-driven (`SPEC_DIR` supplied).
 
 ## Path Resolution
 
@@ -80,4 +79,4 @@ If all sources are empty: skip silently (do not write design-spec.md, do not err
 
 *Reads: `<SPEC_DIR>/design/*.png` · `input/tech/stack.md`*
 *Writes: `<SPEC_DIR>/design/design-spec.md`*
-*Chained to: specification-agent*
+*Read by: planr-specification*

package/lib/host-packages/claude/openplanr/references/agents/shared/modes/spec-driven/devops.md

@@ -1,7 +1,6 @@
-<!-- ${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/spec-driven/devops.md: spec-driven-mode-only content for devops-agent. Loaded by agents/devops-agent.md when MODE=spec-driven. T-002 of SPEC-002. -->
+<!-- Spec-driven context for planr-devops. Loaded when the caller passes MODE=spec-driven and SPEC_DIR. -->
 
-> **Mode:** spec-driven
-> **Loaded by:** `agents/devops-agent.md` when the orchestrator passes `MODE=spec-driven` and `SPEC_DIR`.
+> **Mode:** spec-driven (`SPEC_DIR` supplied).
 
 ## Context locations
 

package/lib/host-packages/claude/openplanr/references/agents/shared/modes/spec-driven/doc-gen.md

@@ -1,7 +1,6 @@
-<!-- ${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/spec-driven/doc-gen.md: spec-driven-mode-only content for doc-gen-agent. Loaded by agents/doc-gen-agent.md when MODE=spec-driven. T-002 of SPEC-002. -->
+<!-- Spec-driven context for planr-documentation. Loaded when the caller passes MODE=spec-driven and SPEC_DIR. -->
 
-> **Mode:** spec-driven
-> **Loaded by:** `agents/doc-gen-agent.md` when the orchestrator passes `MODE=spec-driven` and `SPEC_DIR`.
+> **Mode:** spec-driven (`SPEC_DIR` supplied).
 
 ## Path Resolution
 

package/lib/host-packages/claude/openplanr/references/agents/shared/modes/spec-driven/frontend.md

@@ -1,12 +1,11 @@
-<!-- ${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/spec-driven/frontend.md: spec-driven-mode-only content for frontend-agent. Loaded by agents/frontend-agent.md when MODE=spec-driven. T-002 of SPEC-002. -->
+<!-- Spec-driven paths for planr-frontend. Loaded when the caller passes MODE=spec-driven and SPEC_DIR. -->
 
-> **Mode:** spec-driven
-> **Loaded by:** `agents/frontend-agent.md` when the orchestrator passes `MODE=spec-driven` and `SPEC_DIR`.
+> **Mode:** spec-driven (`SPEC_DIR` supplied).
 
 ## Path Resolution
 
-The orchestrator (`/ship`) passes the absolute task file path,
-`MODE=spec-driven`, and `SPEC_DIR`. Use that exact task path first.
+Ship passes the absolute task file path, `MODE=spec-driven`, and `SPEC_DIR`.
+Use that exact task path first.
 
 - Spec directory: `.planr/specs/SPEC-NNN-{slug}/`.
 - Task: `<SPEC_DIR>/tasks/T-NNN-{slug}.md`.
@@ -26,56 +25,20 @@ directory and use it only when unique. Follow
 `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/task-context-resolution.md` after resolving
 the file. Task content is schema-identical in both modes; only paths differ.
 
----
+## Mode inputs
 
-## Inputs
+- The parent story, its optional Gherkin sidecar, and the enclosing
+  specification.
+- `<SPEC_DIR>/design/design-spec.md` when it exists, plus the reusable UI and
+  design-system implementation already in the repository.
+- `input/tech/stack.md` when present, with every `ActiveStackFiles` entry
+  resolved through the installed stack root and the project-local
+  `.planr/stacks` overlay.
+- Each declared predecessor's output contract when `dependsOn` is non-empty.
 
-| Input | Source | Required |
-|-------|--------|----------|
-| `<SPEC_DIR>/tasks/T-NNN-{slug}.md` (Type=UI) | Specification Agent | Yes |
-| `<SPEC_DIR>/design/design-spec.md` | Designer Agent | If exists |
-| `input/tech/stack.md` | Tech Lead | Yes |
-| Existing codebase files (for context) | Dev environment | Read-only for context |
-
----
-
-## Outputs
-
-All files listed under `### Create` and `### Modify` in the task file (`<SPEC_DIR>/tasks/T-NNN-{slug}.md`).
-
----
-
-## Implementation guidance
-
-```
-1. Load `<SPEC_DIR>/tasks/T-NNN-{slug}.md` and extract frontmatter,
-   Create/Modify/Preserve, Objective, Implementation or Technical Spec,
-   Verification, and Done When. Follow `storyId` to the story, load its optional
-   Gherkin sidecar when present, then load the enclosing specification.
-2. Load `input/tech/stack.md`. Resolve every `ActiveStackFiles` entry through the
-   installed stack root and the project-local `.planr/stacks` overlay as
-   defined by the shared task-context guidance.
-3. Read each declared predecessor's output contract when `dependsOn` is non-empty.
-   Load `<SPEC_DIR>/design/design-spec.md` when it exists.
-4. Read the listed files, reusable UI, design-system implementation, and enough
-   connected source to understand established interfaces and patterns.
-5. Implement the requested UI behavior completely using established project and
-   design-system patterns. Cover material loading, empty, error, success, and
-   accessibility behavior.
-6. Add meaningful component, interaction, and browser coverage where it improves
-   confidence.
-7. Treat Create/Modify as expected scope. A directly required companion test,
-   story, fixture, route registration, generated file, or configuration change is
-   valid when it serves acceptance criteria, stays within frontend ownership, and
-   remains outside Preserve. Disclose it in the result.
-8. Keep Preserve paths unchanged. If the requested outcome conflicts with one,
-   find a safe in-scope alternative or report the conflict clearly.
-9. Apply `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/verification-and-recovery-frontend.md` for
-   adaptive verification and recovery.
-10. Return the shared implementation-result format.
-```
-
----
+Apply `${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/shared/verification-and-recovery-frontend.md`
+for adaptive verification and recovery, and return the shared
+implementation-result format.
 
 ## Error Handling (mode-specific paths)
 
@@ -88,9 +51,3 @@ All files listed under `### Create` and `### Modify` in the task file (`<SPEC_DI
 | Component library unavailable | Report the import/package and affected UI; use an established project alternative when one exists |
 | `dependsOn` output unavailable | Name the dependency and required interface; continue independent work and report the blocked portion |
 | Preserve path changed | Restore it, use another implementation approach, and report a conflict only if no safe approach remains |
-
----
-
-*Reads: task · spec/story/Gherkin · dependency outputs · stack overlays · design · source*
-*Writes: UI layer files only*
-*Runs in parallel with: Backend Agent (Tech task)*

package/lib/host-packages/claude/openplanr/references/agents/shared/modes/spec-driven/specification.md

@@ -1,7 +1,6 @@
-<!-- ${CLAUDE_PLUGIN_ROOT}/references/agents/shared/modes/spec-driven/specification.md: spec-driven-mode-only content for specification-agent. Loaded by agents/specification-agent.md when MODE=spec-driven. T-002 of SPEC-002. -->
+<!-- Spec-driven paths for planr-specification. Loaded when the caller passes MODE=spec-driven and SPEC_DIR. -->
 
-> **Mode:** spec-driven
-> **Loaded by:** `agents/specification-agent.md` when the orchestrator passes `MODE=spec-driven` and `SPEC_DIR`.
+> **Mode:** spec-driven (`SPEC_DIR` supplied).
 
 ## Path Resolution
 
@@ -69,14 +68,13 @@ The flat `tasks/` directory is intentional — `storyId` frontmatter on each tas
 5. Decompose the source into independently valuable User Stories and write each
    story to `<SPEC_DIR>/stories/US-NNN-{slug}.md`. Use `specId: "SPEC-NNN"` and
    allocate story IDs from the project-global sequence.
-6. Apply R2 to each story while assigning the next task IDs under the flat
-   `<SPEC_DIR>/tasks/` directory:
-   a. `has_design = true`: write one `type: "UI"` /
-      `agent: "frontend-agent"` task and one `type: "Tech"` /
-      `agent: "backend-agent"` task;
-   b. `has_design = false`: write one `type: "Tech"` /
-      `agent: "backend-agent"` task;
-   c. never write a third task for the story.
+6. Apply R2 to each story (coherent, independently verifiable tasks split by
+   ownership) while assigning the next task IDs under the flat
+   `<SPEC_DIR>/tasks/` directory: UI work is a `type: "UI"` /
+   `agent: "frontend-agent"` task and server or data work is a `type: "Tech"` /
+   `agent: "backend-agent"` task. Most stories get one Tech task, plus one UI
+   task when `has_design = true`; add a task only for a real output dependency,
+   a distinct verification surface, or reviewable size.
 7. Populate every task with its required schema fields, `storyId`, mode parent
    `specId`, 1–3 sentence `rationale`, concrete Create/Modify paths,
    verification, and `preserve` block maps with exact `repositoryKey` and `path`

package/lib/host-packages/claude/openplanr/references/pipeline/stacks/database/mongodb.md

@@ -36,12 +36,12 @@ DB_HOST: "${MONGO_HOST}"             # e.g. cluster0.mongodb.net or localhost
 DB_PORT: "${MONGO_PORT}"             # 27017 default
 DB_NAME: "${MONGO_DB}"
 DB_USER: "${MONGO_USER}"
-DB_PASSWORD: "${MONGO_PASSWORD}"
-
-# Connection string assembled by the application:
-# mongodb+srv://USER:PASS@HOST/DB?retryWrites=true&w=majority
 ```
 
+The application reads its full connection string from its own runtime environment
+(`DATABASE_URL`), as the Prisma variant below does. Generated code never assembles,
+logs or commits credentials.
+
 ---
 
 ## Naming Conventions

package/lib/host-packages/claude/openplanr/runtime/design/scripts/design-review.mjs

@@ -424,8 +424,12 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 var here = dirname(fileURLToPath(new URL("./runtime/packages/artifact/lib/artifact/review-server.mjs", import.meta.url).href));
 var STAGE_RUNTIME_PATH = join(here, "..", "..", "templates", "artifact-review-stage.js");
-var ARTIFACT_REVIEW_SERVER_VERSION = 2;
+var ARTIFACT_REVIEW_SERVER_VERSION = 3;
 var ARTIFACT_REVIEW_SERVER_KIND = "artifact-review";
+var CONTROL_HEADER = "x-openplanr-control";
+var CONTROLLABLE_SERVER_VERSIONS = /* @__PURE__ */ new Set([2, ARTIFACT_REVIEW_SERVER_VERSION]);
+var EXPORT_ONLY_SERVER_VERSIONS = /* @__PURE__ */ new Set([1]);
+var AUTHORIZATION_CONTROL_VERSIONS = /* @__PURE__ */ new Set([1, 2]);
 var CONTROL_WINDOW_BYTES = 64 * 1024 * 1024;
 var ARTIFACT_REVIEW_MAX_CONTROL_BYTES = Math.ceil((MAX_ARTIFACT_HTML_BYTES * 2 + ARTIFACT_REVIEW_MAX_STATE_BYTES) / CONTROL_WINDOW_BYTES) * CONTROL_WINDOW_BYTES;
 var ARTIFACT_REVIEW_MAX_STATE_BYTES2 = ARTIFACT_REVIEW_MAX_STATE_BYTES;
@@ -481,6 +485,12 @@ var PERMISSIONS_POLICY = [
 function artifactError(code, message, fix = "", details) {
   return new PipelineError(code, message, fix, details);
 }
+function artifactReviewControlHeaders(controlToken) {
+  return { [CONTROL_HEADER]: controlToken };
+}
+function stateControlHeaders(state) {
+  return AUTHORIZATION_CONTROL_VERSIONS.has(state.serverVersion) ? { authorization: `Bearer ${state.controlToken}` } : artifactReviewControlHeaders(state.controlToken);
+}
 function reviewStateDir(env = process.env) {
   return join(planrHome(env), "artifact-daemon");
 }
@@ -563,9 +573,9 @@ function parseRequestPath(rawUrl) {
   });
   return { segments, trailingSlash };
 }
-function bearerToken(req) {
-  const value = req.headers?.authorization;
-  return typeof value === "string" && value.startsWith("Bearer ") ? value.slice(7) : "";
+function presentedControlToken(req) {
+  const value = req.headers?.[CONTROL_HEADER];
+  return typeof value === "string" ? value : "";
 }
 function cloneAndValidateEnvelope(envelope) {
   let cloned;
@@ -875,7 +885,7 @@ function createArtifactReviewServer({
         return;
       }
       if (internal) {
-        if (!timingSafeTokenEqual(bearerToken(req), controlToken)) {
+        if (!timingSafeTokenEqual(presentedControlToken(req), controlToken)) {
           sendJson(res, 403, { ok: false, error: "forbidden" });
           return;
         }
@@ -1449,7 +1459,7 @@ function createArtifactReviewServer({
   return controller;
 }
 function validState(value, requestedPort, { allowLegacy = false } = {}) {
-  return value?.schemaVersion === "1.0.0" && value.kind === ARTIFACT_REVIEW_SERVER_KIND && (value.serverVersion === ARTIFACT_REVIEW_SERVER_VERSION || allowLegacy && value.serverVersion === 1) && Number.isInteger(value.pid) && value.pid > 0 && Number.isInteger(value.port) && value.port > 0 && value.port <= 65535 && (requestedPort === 0 || value.port === requestedPort) && isCapabilityToken(value.instanceId, { bytes: SESSION_ID_BYTES }) && isCapabilityToken(value.controlToken, { bytes: CONTROL_TOKEN_BYTES });
+  return value?.schemaVersion === "1.0.0" && value.kind === ARTIFACT_REVIEW_SERVER_KIND && (CONTROLLABLE_SERVER_VERSIONS.has(value.serverVersion) || allowLegacy && EXPORT_ONLY_SERVER_VERSIONS.has(value.serverVersion)) && Number.isInteger(value.pid) && value.pid > 0 && Number.isInteger(value.port) && value.port > 0 && value.port <= 65535 && (requestedPort === 0 || value.port === requestedPort) && isCapabilityToken(value.instanceId, { bytes: SESSION_ID_BYTES }) && isCapabilityToken(value.controlToken, { bytes: CONTROL_TOKEN_BYTES });
 }
 function readReviewServerState(path) {
   try {
@@ -1473,7 +1483,7 @@ async function controlRequest(descriptor, path, { method, body, fetchImpl } = {}
   const response = await fetchImpl(`http://${LOOPBACK_HOST}:${descriptor.state.port}${path}`, {
     method,
     headers: {
-      authorization: `Bearer ${descriptor.state.controlToken}`,
+      ...stateControlHeaders(descriptor.state),
       ...body === void 0 ? {} : { "content-type": "application/json" }
     },
     ...body === void 0 ? {} : { body: JSON.stringify(body) },
@@ -2852,7 +2862,12 @@ async function startDesignReviewUnlocked(file, {
   server = createArtifactReviewServer({
     env,
     serverMetadata: { kind: "design", projectRoot: current.root },
-    prepareSource: (options) => prepareArtifactDocument({ ...options, allowLocalForms: true }),
+    prepareSource: (options) => prepareArtifactDocument({
+      ...options,
+      allowLocalForms: true,
+      prototypeState: true,
+      screenId: current.entries.find((entry) => entry.artifactId === options.artifactId)?.screenId ?? options.artifactId
+    }),
     async refreshSession(session) {
       current = currentDesign(file);
       if (session.designRevision === current.revision) return;
@@ -3214,7 +3229,7 @@ ${renderArtifactParentRuntime({ ...options, adapterRuntimeUrl: `${base}api/desig
     const registered = await fetchImpl(`${origin}/internal/v1/sessions`, {
       method: "POST",
       headers: {
-        authorization: `Bearer ${server.controlToken}`,
+        ...artifactReviewControlHeaders(server.controlToken),
         "content-type": "application/json"
       },
       body: JSON.stringify({

package/lib/host-packages/claude/openplanr/runtime/design/scripts/design-share.mjs

@@ -92,7 +92,7 @@ ${current.document.id}`);
   const within = relative(project, root);
   if ((!allowMissing || existsSync(path)) && (within === "" || !within.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && within !== ".." && !isAbsolute(within)))
     throw new Error(
-      "Design owner credentials must be stored outside the project. Set PLANR_HOME to a private user-level directory."
+      "Design owner keys must be stored outside the project. Set PLANR_HOME to a private user-level directory."
     );
   const legacyPath = !options.custodyRoot && !configuredPlanrHome(env) ? join(realpathSync(env.HOME || homedir()), ".openplanr", "design-shares", `${key}.json`) : null;
   return { root, path, current, legacyPath };
@@ -1785,10 +1785,10 @@ async function importDesignShareRecovery(file, { input, ...options } = {}) {
       throw new Error("Recovery belongs to a different design.");
     if (record && (record.custody.id !== custody.id || JSON.stringify(record.custody.ownerPublicKey) !== JSON.stringify(custody.ownerPublicKey)))
       throw new Error(
-        "This design already has different owner credentials. Recovery will not overwrite them."
+        "This design already has different owner keys. Recovery will not overwrite them."
       );
     if (record && record.custody.version > custody.version)
-      throw new Error("This recovery file is older than the locally saved owner credentials.");
+      throw new Error("This recovery file is older than the locally saved owner keys.");
     if (!custody.pendingCreate && !recovered.deleted && !recovered.revoked) {
       await getWorkspace(custody, { fetchImpl: options.fetchImpl });
       const bundle = await decryptWorkspaceRevision(custody, custody.currentRevision, {

package/lib/host-packages/claude/openplanr/runtime/design/scripts/runtime/packages/design/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openplanr/design",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "private": true,
   "type": "module",
   "description": "Canonical OpenPlanr design helpers and design-loop engine",
@@ -46,8 +46,8 @@
     "node": ">=20.19.0"
   },
   "dependencies": {
-    "@openplanr/artifact": "0.6.4",
-    "@openplanr/protocol": "0.10.2"
+    "@openplanr/artifact": "0.6.5",
+    "@openplanr/protocol": "0.10.3"
   },
   "scripts": {
     "test": "node --test --test-concurrency=2 tests/*.test.mjs",

package/lib/host-packages/claude/openplanr/runtime/design/scripts/runtime/packages/design/templates/studio/share.js

@@ -1,4 +1,4 @@
-/* Trusted local adapter. Owner credentials never enter this runtime. */
+/* Trusted local adapter. Owner keys never enter this runtime. */
 (() => {
   'use strict';
   const options = globalThis.__OPENPLANR_DESIGN_STUDIO_OPTIONS__ || {};

package/lib/host-packages/claude/openplanr/runtime/design/scripts/runtime/packages/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openplanr/protocol",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "type": "module",
   "description": "Canonical OpenPlanr schemas, registries, typed errors, and portable contract validation",
   "license": "MIT",

package/lib/host-packages/claude/openplanr/runtime/plan/scripts/design.mjs

@@ -2551,7 +2551,7 @@ ${current.document.id}`);
   const within = relative3(project, root);
   if ((!allowMissing || existsSync4(path)) && (within === "" || !within.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && within !== ".." && !isAbsolute3(within)))
     throw new Error(
-      "Design owner credentials must be stored outside the project. Set PLANR_HOME to a private user-level directory."
+      "Design owner keys must be stored outside the project. Set PLANR_HOME to a private user-level directory."
     );
   const legacyPath = !options.custodyRoot && !configuredPlanrHome(env) ? join7(realpathSync4(env.HOME || homedir3()), ".openplanr", "design-shares", `${key}.json`) : null;
   return { root, path, current, legacyPath };

package/lib/host-packages/claude/openplanr/runtime/plan/scripts/runtime/packages/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openplanr/protocol",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "type": "module",
   "description": "Canonical OpenPlanr schemas, registries, typed errors, and portable contract validation",
   "license": "MIT",

package/lib/host-packages/claude/openplanr/skills/artifact/SKILL.md

@@ -30,7 +30,7 @@ relaunch the active coding agent from inside this skill.
    preserve existing guidance and never invent requirements. Render and inspect
    the updated context before sharing. For a design document this creates a permanent encrypted
    design review with a stable URL and a separately entered generated access
-   token. Owner credentials save privately outside the project; copy the reviewer
+   token. Owner keys save privately outside the project; copy the reviewer
    token through the studio's Share dialog, never put it in a URL or ordinary
    command output. Publish an explicitly requested update with
    `openplanr artifact publish <design-document.json>`; synchronize reviewer feedback
@@ -67,7 +67,7 @@ separate permissions and storage from encrypted token shares.
 
 Lead with what was opened, shared, imported or exported and the confirmed revision
 or session. Link the actual review URL or exported file; never print capability
-tokens or private owner credentials. Distinguish successful service operations
+tokens or private owner keys. Distinguish successful service operations
 from preparation and browser verification from validation alone. For partial or
 blocked work, name the remaining step and exact retry or recovery action, retaining
 the useful local result. Keep detailed diagnostics in their existing records;

package/lib/host-packages/claude/openplanr/skills/artifact/references/diagram-sharing.md

@@ -13,7 +13,7 @@ review. Preview the exact diagram title, source revision, elements, connections,
 destination and retention before creating it. Use `--yes` only when the user has
 already authorized that publication. The stable URL and generated access token
 are separate; copy the token through the local studio's **Share diagram** dialog,
-never into a URL, prompt, ordinary output or repository file. Owner credentials
+never into a URL, prompt, ordinary output or repository file. Owner keys
 are saved privately outside the project. The review remains available until the
 owner revokes or deletes it and works while the local studio is stopped.
 

package/lib/host-packages/claude/openplanr/skills/ceo-review/SKILL.md

@@ -2,7 +2,6 @@
 name: ceo-review
 description: "Produce a grounded strategy and finance review for an Operate cycle. Use when direction, runway, margin, investment, or cost of delay needs a CEO lens."
 license: MIT
-allowed-tools: "Read, Grep, Glob, Edit(./.planr/operate/**)"
 ---
 
 # OpenPlanr CEO Review

package/lib/host-packages/claude/openplanr/skills/ceo-review/references/operate-advisor-contract.md

@@ -1,8 +1,8 @@
 # Shared Operate advisor contract
 
-This contract supplies the common context method and output shape for the five executive advisor
-skills. The invoking skill supplies the lens, review questions, useful sources, and decision
-standard. Follow both.
+This contract supplies the common context method and output shape for the executive advisor
+skills (CEO, CTO, CPO, CMO, and COO). The invoking skill supplies the lens, review questions,
+useful sources, and decision standard. Follow both.
 
 ## Outcome
 
@@ -21,7 +21,28 @@ not the whole context boundary. Inspect relevant original repository and Git sou
 drawing conclusions. If an input is unavailable, report the exact problem and continue when the
 remaining context still supports a useful note.
 
-Write the review only to `<output-path>`.
+Write the review only to `<output-path>`. Writes follow the host's normal permission rules; this
+skill pre-approves nothing.
+
+### Running without `planr-operate`
+
+When no `<output-path>` was supplied, this lens creates the cycle itself, in the layout
+`planr-operate` uses, under the repository root:
+
+```text
+.planr/operate/<YYYY-MM-DD>-<subject-slug>/
+  cycle.md          the request wording, the effective scope, and a one-lens roster
+  brief.md          compact orientation for this lens only, including what was searched for and not found
+  <lens>.md         this note: ceo.md, cto.md, cpo.md, cmo.md, or coo.md
+  board-report.md   an unsynthesized lens summary
+```
+
+Take the subject, window, and requested decision from the request. Use the first unused directory
+name; append `-02`, `-03`, and so on when the base name exists. In `board-report.md`, use the
+`planr-operate` report sections, mark this lens `reported` and every other lens `omitted by scope`
+under Review coverage, and write `No decision-ready proposal was established.` and
+`No proposed actions.` unless this note states a directly supported proposal. Write nothing outside
+that cycle directory. The dashboard lists a cycle only when `board-report.md` exists.
 
 ## Grounding
 

package/lib/host-packages/claude/openplanr/skills/chair-review/SKILL.md

@@ -2,7 +2,6 @@
 name: chair-review
 description: "Synthesize an Operate cycle into a prioritized decision queue and action plan. Use after specialist reviews when leadership needs one coherent brief."
 license: MIT
-allowed-tools: "Read, Grep, Glob, Edit(./.planr/operate/**)"
 ---
 
 # OpenPlanr Chair Review
@@ -18,7 +17,12 @@ and its decision impact; continue when the remaining notes still support useful
 selected roster from the scope or brief and label an intentionally unselected lens `omitted by
 scope`; do not turn that omission into an issue or decision-changing gap.
 
-Write only `<output-path>`.
+Write only `<output-path>`. Writes follow the host's normal permission rules; this skill
+pre-approves nothing.
+
+Invoked without `<cycle-dir>`, offer the most recent cycle under `.planr/operate/` that holds
+advisor notes and use its `chair.md` as the output path. When there is none, say so and point to
+`planr-operate`; never create an empty cycle.
 
 ## Synthesis standard
 

package/lib/host-packages/claude/openplanr/skills/challenger-review/SKILL.md

@@ -2,7 +2,6 @@
 name: challenger-review
 description: "Challenge an Operate cycle's claims, alternatives, downside, and confidence. Use when assumptions or executive consensus need an independent stress test."
 license: MIT
-allowed-tools: "Read, Grep, Glob, Edit(./.planr/operate/**)"
 ---
 
 # OpenPlanr Challenger Review
@@ -18,7 +17,12 @@ Use `<cycle-dir>`, `<brief-path>`, `<output-path>`, and `<scope>`. Inspect the a
 is `omitted by scope`, not unavailable, and creates no gap by itself. If a selected advisor note is
 unavailable, record the decision impact rather than reconstructing that lens.
 
-Write only `<output-path>`.
+Write only `<output-path>`. Writes follow the host's normal permission rules; this skill
+pre-approves nothing.
+
+Invoked without `<cycle-dir>`, offer the most recent cycle under `.planr/operate/` that holds
+advisor notes and use its `challenger.md` as the output path. When there is none, say so and point
+to `planr-operate`; never create an empty cycle.
 
 ## Material exceptions
 

package/lib/host-packages/claude/openplanr/skills/cmo-review/SKILL.md

@@ -2,7 +2,6 @@
 name: cmo-review
 description: "Produce a grounded market and growth review for an Operate cycle. Use when acquisition, positioning, demand, retention, or missing measurement needs a CMO lens."
 license: MIT
-allowed-tools: "Read, Grep, Glob, Edit(./.planr/operate/**)"
 ---
 
 # OpenPlanr CMO Review

package/lib/host-packages/claude/openplanr/skills/cmo-review/references/operate-advisor-contract.md

@@ -1,8 +1,8 @@
 # Shared Operate advisor contract
 
-This contract supplies the common context method and output shape for the five executive advisor
-skills. The invoking skill supplies the lens, review questions, useful sources, and decision
-standard. Follow both.
+This contract supplies the common context method and output shape for the executive advisor
+skills (CEO, CTO, CPO, CMO, and COO). The invoking skill supplies the lens, review questions,
+useful sources, and decision standard. Follow both.
 
 ## Outcome
 
@@ -21,7 +21,28 @@ not the whole context boundary. Inspect relevant original repository and Git sou
 drawing conclusions. If an input is unavailable, report the exact problem and continue when the
 remaining context still supports a useful note.
 
-Write the review only to `<output-path>`.
+Write the review only to `<output-path>`. Writes follow the host's normal permission rules; this
+skill pre-approves nothing.
+
+### Running without `planr-operate`
+
+When no `<output-path>` was supplied, this lens creates the cycle itself, in the layout
+`planr-operate` uses, under the repository root:
+
+```text
+.planr/operate/<YYYY-MM-DD>-<subject-slug>/
+  cycle.md          the request wording, the effective scope, and a one-lens roster
+  brief.md          compact orientation for this lens only, including what was searched for and not found
+  <lens>.md         this note: ceo.md, cto.md, cpo.md, cmo.md, or coo.md
+  board-report.md   an unsynthesized lens summary
+```
+
+Take the subject, window, and requested decision from the request. Use the first unused directory
+name; append `-02`, `-03`, and so on when the base name exists. In `board-report.md`, use the
+`planr-operate` report sections, mark this lens `reported` and every other lens `omitted by scope`
+under Review coverage, and write `No decision-ready proposal was established.` and
+`No proposed actions.` unless this note states a directly supported proposal. Write nothing outside
+that cycle directory. The dashboard lists a cycle only when `board-report.md` exists.
 
 ## Grounding