owlrunkit 0.17.2 → 0.18.1

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -1,28 +1,35 @@
 ---
 name: owlcoda-runkit
-description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use when Codex needs to coordinate a large multi-Agent project, show per-Agent progress, manage dependencies or decisions, hand work to another Agent, recover a blank-session next action, initialize or inspect `.owlcoda/runkit/`, plan bounded work with engine pins and leases, capture exact verification evidence, close an execution, produce a ready-for-commit receipt, or perform a read-only foreign-project shadow without widening Git or release authority.
+description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use when Codex needs to coordinate a large multi-Agent project, show per-Agent progress, manage dependencies or decisions, record intentionally deferred verification without repeating covered tests, hand work to another Agent, recover a blank-session next action, initialize or inspect `.owlcoda/runkit/`, plan bounded work with engine pins and leases, capture exact verification evidence, close an execution, produce a ready-for-commit receipt, or perform a read-only foreign-project shadow without widening Git or release authority.
 ---
 
 # OwlCoda RunKit
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled release: standalone `owlrunkit@0.17.2`, bundling Contract `0.2` and
-Core `0.17.2` with manifest
-`sha256:67b883b8a763253b873fb6047c7e7e01c81123aa5250a0db5feaabd13cc4d860`.
-Publication and dist-tag state are mutable registry facts: verify the exact
-official npm registry provenance before adoption. The immutable rollback
-baseline for this release is `owlrunkit@0.16.1` with SHA-1
+Bundled release: standalone `owlrunkit@0.18.1`, bundling Contract `0.2` and
+Core `0.18.1` with manifest
+`sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07`.
+The published `owlrunkit@0.18.0` package is the trusted prior for rollback;
+verify exact official npm registry provenance before adoption. The immutable
+rollback baseline for the prior release is `owlrunkit@0.16.1` with SHA-1
 `1bc119d24879bdd8959af16b364af55ca9d61ea9` and canonical npm tarball URL
 `https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.16.1.tgz`.
 The root `owlcoda` package has a separate version lifecycle.
 
 The session is an execution interface. Project artifacts are the system of record.
 
-## Agent-native project actions
+## Project Driver actions
 
-Translate ordinary user requests into durable project actions. Do not ask the
-user to operate the CLI when the request and authority are already clear.
+Translate ordinary user requests into durable typed project actions. Do not ask
+the user to operate the CLI when the request and authority are already clear.
+
+The normal mainline is `init`, `assign`, `checkpoint`, `handoff`, `decision`,
+`verification`, `integrate`, `status`, and `takeover`. After a project
+derives completed, `successor` is the bounded lifecycle step. `init` accepts one project definition
+JSON; subsequent actions use direct typed flags. Normal users do not author
+request, event, receipt, or hash JSON. The legacy `--request <event.json>` form
+remains available for existing automation and compatibility.
 
 - "Split this large task and run it in parallel": initialize one project
   definition before dispatch, then assign a distinct WorkItem to each Agent.
@@ -35,10 +42,23 @@ user to operate the CLI when the request and authority are already clear.
   never overwrite the old assignment.
 - "Continue/take over": build `project takeover` for the current Agent and use
   its bounded next action and evidence refs.
+- "Start the next project": only after status derives `overall=completed`,
+  invoke `project successor` with a different V1 definition and explicit
+  transition ID. Preserve the content-addressed archive and journal; never
+  use handoff, takeover, install, or publication as successor authority.
 - "Capture this as data": append a data candidate only. Never call it a dataset
   member without a separate admission decision.
-- "Verify/finish": select No RunKit, Quick, or Formal from risk; bind a Formal
-  WorkItem to its actual execution and lease when applicable.
+- "Do not run that check yet": append one deferred verification with stable
+  check IDs, reason, owner, WorkItem, and due integration gate. This records an
+  unrun check; it does not execute or schedule one.
+- "That deferred check is done": close it as `verified` with evidence. If the
+  check is no longer required, first resolve an explicit project decision and
+  close it as `no_longer_required` with that decision ID. Never report the
+  second disposition as a passing test.
+- "Verify/finish": select continuity and assurance independently from the
+  underlying risk; bind a Formal WorkItem to its actual execution and lease when
+  applicable. Multi-Agent coordination, long duration, or interruption recovery
+  alone does not select Formal.
 
 For a multi-Agent project, checkpoint meaningful state changes promptly. A
 checkpoint is not a heartbeat and must not contain a guessed percentage.
@@ -47,12 +67,72 @@ state from the closeout and lease rather than trusting the Agent's claim.
 
 ```bash
 owlrunkit project init --workspace "$PROJECT_ROOT" --definition "$PROJECT_JSON"
-owlrunkit project assign --workspace "$PROJECT_ROOT" --request "$EVENT_JSON"
-owlrunkit project checkpoint --workspace "$PROJECT_ROOT" --request "$EVENT_JSON"
+owlrunkit project assign --workspace "$PROJECT_ROOT" --assignment-id "$ASSIGNMENT_ID" \
+  --at "$OCCURRED_AT" --work-item "$WORK_ITEM_ID" --agent "$AGENT_ID"
+owlrunkit project checkpoint --workspace "$PROJECT_ROOT" --checkpoint-id "$CHECKPOINT_ID" \
+  --at "$OCCURRED_AT" --assignment-id "$ASSIGNMENT_ID" --work-item "$WORK_ITEM_ID" \
+  --state active --summary "$SUMMARY" --next "$NEXT_ACTION"
+owlrunkit project handoff --workspace "$PROJECT_ROOT" --handoff-id "$HANDOFF_ID" \
+  --at "$OCCURRED_AT" --assignment-id "$ASSIGNMENT_ID" --work-item "$WORK_ITEM_ID" \
+  --from-agent "$AGENT_ID" --to-agent "$SUCCESSOR_AGENT_ID" \
+  --summary "$SUMMARY" --next "$NEXT_ACTION" --evidence "$EVIDENCE_REF"
+owlrunkit project decision --workspace "$PROJECT_ROOT" --resolve \
+  --decision-id "$DECISION_ID" --at "$OCCURRED_AT" --resolution "$RESOLUTION" \
+  --rationale "$RATIONALE" --evidence "$EVIDENCE_REF"
+owlrunkit project verification --workspace "$PROJECT_ROOT" --defer \
+  --verification-id "$VERIFICATION_ID" --at "$OCCURRED_AT" \
+  --work-item "$WORK_ITEM_ID" --owner-agent "$AGENT_ID" \
+  --check "$CHECK_ID" --reason "$REASON" --due-gate "$GATE_ID"
+owlrunkit project verification --workspace "$PROJECT_ROOT" --close \
+  --verification-id "$VERIFICATION_ID" --at "$OCCURRED_AT" \
+  --disposition verified --summary "$SUMMARY" --evidence "$EVIDENCE_REF"
+owlrunkit project integrate --workspace "$PROJECT_ROOT" --gate "$GATE_ID" \
+  --at "$OCCURRED_AT" --summary "$SUMMARY" --evidence "$EVIDENCE_REF"
 owlrunkit project status --workspace "$PROJECT_ROOT" --json
 owlrunkit project takeover --workspace "$PROJECT_ROOT" --agent "$AGENT_ID" --json
+owlrunkit project successor --workspace "$PROJECT_ROOT" \
+  --transition-id "$TRANSITION_ID" --at "$OCCURRED_AT" \
+  --definition "$NEXT_PROJECT_JSON" --reason "$SUCCESSOR_REASON" --json
 ```
 
+`project successor` accepts only a derived-completed active project and a
+different fresh V1 identity. It archives the exact prior bytes, never borrows
+old events, and resumes only an identical durable transition. Treat symlinks,
+collisions, competing transition IDs, incomplete truth, and changed truth as
+fail-closed. The archived tree is sealed against ordinary writes. Exact retry
+validates its archive bytes and seal, and each later successor validates every
+completed transition archive before changing active truth or writing its own
+journal. Do not infer a historical archive scan from `status` or `takeover`;
+those remain active-truth projections. The receipt never grants Git, release,
+publication, deployment, package-adoption, or writer authority.
+
+## Batch verification around a small explainable closure
+
+Use a verification micro-batch when two or three related changes share one
+module or contract, one writer, one worktree, one causal hypothesis, and one
+acceptance level. During implementation, run only the smallest smoke or
+falsifier needed to reject a wrong direction. After the related changes settle,
+freeze the candidate and run its focused suite once.
+
+Run typecheck, lint, build, and diff checks once at candidate closeout unless a
+later edit invalidates them. Keep broad suites, installed-package checks,
+deployment checks, production reads, and large data hashes at the actual state
+transition that needs them. Do not run them early just to make an intermediate
+packet look complete.
+
+Independent acceptance first validates candidate identity and trustworthy
+coverage, then adds fresh adversarial or boundary scenarios. It does not repeat
+the implementer's whole covered suite unless the receipt is missing, stale,
+drifted, flaky, or insufficient for the requested acceptance level.
+
+Do not defer an immediate containment, authorization, symlink/realpath,
+rollback-safety, security, money, or data-integrity falsifier. Split a batch
+when ownership, worktree, authority, hypothesis, or acceptance level differs,
+or when a failure would no longer be attributable. An open deferred
+verification remains visible in `status` and `takeover` and blocks its declared
+integration gate; it never grants permission to run the check or any later
+Git, release, deployment, or production action.
+
 ## Start safely
 
 1. Locate the project root and read its AGENTS.md chain.
@@ -165,6 +245,11 @@ node "$RUNKIT_PACKAGE_ROOT/scripts/runkit-contract/install-codex-skill.mjs" \
   --target "$RUNKIT_SKILL_TARGET" --archive "$RUNKIT_SKILL_ARCHIVE_ROOT"
 ```
 
+`inspect` checks both managed-file integrity and the Skill/config Core version
+against the package that runs the command. A `version_mismatch` result is an
+explicit upgrade diagnostic; it is not evidence that the installed Skill was
+loaded into the current session and grants no update authority.
+
 The install manifest binds every Skill, Core, contract and attest file.
 Unknown installed drift fails closed instead of being overwritten. A changed
 process-wide Skill requires a registered complete fleet. Register each coverage
@@ -253,6 +338,8 @@ owlrunkit fleet register-root --fleet-root /absolute/declared-projects
 owlrunkit fleet discover
 owlrunkit profiles detect --workspace "$PROJECT_ROOT" --dry-run
 owlrunkit profiles detect --workspace "$PROJECT_ROOT" --apply
+owlrunkit profiles reconcile --workspace "$PROJECT_ROOT" --dry-run
+owlrunkit mode recommend --workspace "$PROJECT_ROOT"
 owlrunkit assurance route --workspace "$PROJECT_ROOT" \
   --request "$ASSURANCE_REQUEST_JSON"
 owlrunkit status --workspace "$PROJECT_ROOT"
@@ -261,28 +348,45 @@ owlrunkit status --workspace "$PROJECT_ROOT"
 Fleet discovery is complete only within all registered coverage roots, an
 explicit one-off root list, or a caller-supplied frozen `--fleet-manifest`. It
 refuses unreachable roots and cannot protect projects outside registered
-coverage. `profiles detect --apply` is create-only and adopts only unambiguous
-high-confidence, project-local regular-file launchers; existing profiles and
-low-confidence candidates remain untouched. Lock-bound npm and exact
+coverage. `profiles detect --apply` creates only an absent profile set and
+adopts only unambiguous high-confidence, project-local regular-file launchers;
+`profiles reconcile` previews or atomically updates an existing profile set
+with a rollback receipt. Low-confidence candidates remain untouched. Lock-bound npm and exact
 project-installed pnpm, Yarn, and Bun launchers are supported; PATH-only
 package managers remain review-required. `assurance route`
 deterministically selects No RunKit, Quick Verification or Formal Delivery
 from explicit risk facts and fails closed to Formal when required facts are
 missing.
 
-## Choose the smallest assurance lane
+## Choose continuity and assurance independently
+
+Start with `owlrunkit mode recommend --workspace "$PROJECT_ROOT"`. The five
+user-facing modes are presets over two independent dimensions:
+
+- continuity: `none | project_driver`
+- assurance: `none | quick | formal`
 
-Choose the lane before planning. Do not create a Formal execution merely
-because this skill is available.
+Use `off` for analysis, documentation, and disposable exploration; `light` for
+one frozen low-risk candidate plus one Quick command; `managed` for Project
+Driver continuity with per-WorkItem assurance; and `formal` only at a genuine
+Formal boundary. `auto` derives those choices from facts. The selected mode is
+a workflow preference, never authorization.
 
 - Use ordinary project tools without RunKit for disposable prototypes, early
   research, visual exploration or clean short tasks that need no durable
   handoff, evidence consumption or formal acceptance.
 - Use Quick Verification for one low-risk command that needs a source-bound,
   reusable verification receipt but no writer lease or formal acceptance.
-- Use Formal Delivery for multi-writer work, long-running or interrupted work,
-  dirty parallel workspaces, migration, integration, release, production,
-  funds or another delivery requiring formal acceptance.
+- Use Project Driver for cross-session, long-running, interrupted, or durable
+  handoff needs. A managed WorkItem may still use no assurance or one Quick.
+- Use Formal Delivery for multi-writer work, permission or security boundaries,
+  funds, irreversible changes, uncertain rollback, schema/data migration, or
+  an explicit Formal-acceptance contract.
+
+Production, release, deployment, ordinary source mutation, long duration, and
+interruption labels do not force Formal by themselves. When the forcing fact is
+contained, route again and allow de-escalation. `off`, `light`, or `managed`
+cannot override a still-present mandatory Formal fact.
 
 If work crosses lanes, re-evaluate risk and authority. Moving from Quick to
 Formal requires a fresh GoalContract, exact write scope, profiles and authority;

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.17.2",
-    "coreManifestSha256": "sha256:67b883b8a763253b873fb6047c7e7e01c81123aa5250a0db5feaabd13cc4d860",
-    "coreSourceRef": "artifact:sha256:67b883b8a763253b873fb6047c7e7e01c81123aa5250a0db5feaabd13cc4d860"
+    "coreVersion": "0.18.1",
+    "coreManifestSha256": "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
+    "coreSourceRef": "artifact:sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "owlrunkit",
-  "version": "0.17.2",
-  "description": "Project-owned execution, evidence, verification, and recovery for coding agents.",
+  "version": "0.18.1",
+  "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",
   "type": "module",

package/packages/attest/distribution-manifest-v1.json

@@ -36,6 +36,16 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.18.1",
+      "coreManifestSha256": "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.18.0",
+      "coreManifestSha256": "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.17.2",

package/packages/attest/src/quick.mjs

@@ -18,6 +18,16 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.1",
+    coreManifestSha256: "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.0",
+    coreManifestSha256: "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.17.2",

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.17.2",
+  "candidateVersion": "0.18.1",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.17.1",
-    "shasum": "819a824d6df7f89fe8c0a68756e20c446fd67936",
-    "integrity": "sha512-Oget/g3MHQaWp1gs7VP/mw3DSlSD4a+vDy3a+3z/8AQ715rLvmkc0ikuz/3T/rcIa0Pw8IecBgqrJu+Lpaf/4w==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.17.1.tgz"
+    "version": "0.18.0",
+    "shasum": "ab2d9c9ed81f9dcccd4c1affa519cfca1cc32032",
+    "integrity": "sha512-asi4CKofzjzQ9gGxnv6/NDCM6rZcMMqpwd4uRStfUUwDetFLYHEPDMBv1JGvYotdUwwoODxwdJ3KMGXQSYorgA==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.0.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.17.2",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.17.2",
+  "name": "owlrunkit-0.18.1",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.1",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.17.2",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.17.2.tgz",
+      "versionInfo": "0.18.1",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.17.2"
+          "referenceLocator": "pkg:npm/owlrunkit@0.18.1"
         }
       ]
     }

package/scripts/runkit-contract/assurance-router.mjs

@@ -6,6 +6,12 @@ const BOOLEAN_FACTS = [
   "longRunning",
   "interruptionRecovery",
   "dirtyParallelWorkspace",
+  "irreversibleChange",
+  "rollbackUncertain",
+  "permissionSensitive",
+  "securitySensitive",
+  "fundsAtRisk",
+  "schemaOrDataMigration",
 ];
 
 const RISK_CATEGORIES = new Set([
@@ -20,13 +26,11 @@ const RISK_CATEGORIES = new Set([
   "release",
 ]);
 
-const FULL_RISK_CATEGORIES = new Set([
-  "deployment",
+const MATERIAL_RISK_CATEGORIES = new Set([
   "destructive",
   "foreign_write",
   "funds",
-  "production",
-  "release",
+  "migration",
 ]);
 
 function incompleteReasons(input) {
@@ -76,26 +80,21 @@ export function routeRunKitAssuranceV1(input) {
   const categories = [...new Set(input.riskCategories)].sort();
   const formalReasons = [
     ...(input.needsFormalAcceptance ? ["formal_acceptance_required"] : []),
-    ...(input.mayMutateProject ? ["project_mutation"] : []),
-    ...(input.externalSideEffects ? ["external_side_effects"] : []),
-    ...(input.longRunning ? ["long_running_execution"] : []),
-    ...(input.interruptionRecovery ? ["interruption_recovery_required"] : []),
-    ...(input.dirtyParallelWorkspace ? ["dirty_parallel_workspace"] : []),
-    ...(input.writerCount > 0 ? ["writer_scope_required"] : []),
-    ...(input.needsDurableEvidence && input.exactCommandCount === 0
-      ? ["exact_command_missing"]
-      : []),
-    ...(input.needsDurableEvidence && input.exactCommandCount > 1
-      ? ["multiple_commands"]
-      : []),
-    ...categories.map(category => `risk_${category}`),
+    ...(input.writerCount > 1 ? ["multiple_writers"] : []),
+    ...(input.permissionSensitive === true ? ["permission_sensitive"] : []),
+    ...(input.securitySensitive === true ? ["security_sensitive"] : []),
+    ...(input.fundsAtRisk === true ? ["funds_at_risk"] : []),
+    ...(input.irreversibleChange === true ? ["irreversible_change"] : []),
+    ...(input.rollbackUncertain === true ? ["rollback_uncertain"] : []),
+    ...(input.schemaOrDataMigration === true ? ["schema_or_data_migration"] : []),
+    ...categories
+      .filter(category => MATERIAL_RISK_CATEGORIES.has(category))
+      .map(category => `risk_${category}`),
   ];
   if (formalReasons.length > 0) {
-    const full = input.externalSideEffects
-      || categories.some(category => FULL_RISK_CATEGORIES.has(category));
     return result({
       lane: "formal",
-      riskMode: full ? "full" : "standard",
+      riskMode: "full",
       reasonCodes: [...new Set(formalReasons)].sort(),
       nextCommand: "owlrunkit formal start",
     });
@@ -110,6 +109,15 @@ export function routeRunKitAssuranceV1(input) {
     });
   }
 
+  if (input.exactCommandCount !== 1) {
+    return result({
+      lane: "none",
+      riskMode: "lightweight",
+      reasonCodes: ["quick_exact_command_required"],
+      nextCommand: null,
+    });
+  }
+
   return result({
     lane: "quick",
     riskMode: "lightweight",

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.17.2";
+export const CORE_VERSION = "0.18.1";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -66,7 +66,9 @@ const CORE_FILES = [
   "source-candidate.mjs",
   "source-fingerprint.mjs",
   "sync-release-identity.mjs",
+  "team-project-successor.mjs",
   "team-project.mjs",
+  "usage-mode.mjs",
   "verification-envelope.mjs",
   "verification-envelope-check.mjs",
   "verification-receipt-gate.mjs",
@@ -100,6 +102,8 @@ const CORE_FILES = [
   "schemas/owner-deployment-decision-v1.schema.json",
   "schemas/profile-apply-receipt-v1.schema.json",
   "schemas/profile-detection-v2.schema.json",
+  "schemas/profile-reconcile-plan-v1.schema.json",
+  "schemas/profile-reconcile-receipt-v1.schema.json",
   "schemas/project-config.schema.json",
   "schemas/project-config-v2.schema.json",
   "schemas/profiles.schema.json",
@@ -122,7 +126,9 @@ const CORE_FILES = [
   "schemas/verification-context-v1.schema.json",
   "schemas/team-project-definition-v1.schema.json",
   "schemas/team-project-event-v1.schema.json",
+  "schemas/team-project-successor-receipt-v1.schema.json",
   "schemas/team-project-status-v1.schema.json",
+  "schemas/usage-mode-recommendation-v1.schema.json",
   "schemas/verification-envelope-v1.schema.json",
   "schemas/verification-finalize-attempt-v1.schema.json",
   "schemas/verification-preflight-v1.schema.json",

package/scripts/runkit-contract/inspect-presentation.mjs

@@ -40,7 +40,7 @@ function closeoutDecisionCounts(inspected) {
 
 export function buildInspectSummary(
   inspected,
-  { maintenanceNextAction = null } = {},
+  { maintenanceNextAction = null, projectDriver = null } = {},
 ) {
   const humanStatus = deriveHumanStatusFromInspectV1(inspected);
   const focus = selectedFocus(inspected);
@@ -80,6 +80,21 @@ export function buildInspectSummary(
     ...(inspected.controlIssues ?? []),
     ...(selectedResource?.blockers ?? []),
   ].filter((reason, index, all) => all.indexOf(reason) === index);
+  const projectGapCode = projectDriver === null
+    ? null
+    : projectDriver.dominantGap.id === null
+      ? projectDriver.dominantGap.kind
+      : `${projectDriver.dominantGap.kind}:${projectDriver.dominantGap.id}`;
+  const projectDriverSummary = projectDriver === null
+    ? null
+    : {
+        projectId: projectDriver.projectId,
+        overall: projectDriver.overall,
+        headline: projectDriver.headline,
+        dominantGap: structuredClone(projectDriver.dominantGap),
+        nextAction: projectDriver.nextAction,
+        nextActorId: projectDriver.nextActorId,
+      };
   return {
     schemaVersion: "OwlCodaRunKitInspectSummaryV1",
     currentExecution: {
@@ -139,13 +154,22 @@ export function buildInspectSummary(
       resources: [...(selectedResource?.resources ?? [])],
     },
     dominantGap: {
-      code: humanStatus.nextAllowedAction,
-      reasons: [...reasons],
+      code: projectGapCode ?? humanStatus.nextAllowedAction,
+      reasons: projectDriver === null
+        ? [...reasons]
+        : [projectDriver.dominantGap.reason].filter(Boolean),
     },
+    ...(projectDriverSummary === null ? {} : { projectDriver: projectDriverSummary }),
     lifecycleNextAction: inspected.recovery.nextAllowedAction,
     maintenanceNextAction,
     optionalReviewAction: independentHistory ? "inspect_closed_history" : null,
     nextAllowedAction: humanStatus.nextAllowedAction,
+    ...(projectDriver === null
+      ? {}
+      : {
+          recommendedNextAction:
+            projectDriver.nextAction ?? humanStatus.nextAllowedAction,
+        }),
     authorizationGranted: false,
     gitAuthorization: false,
     releaseAuthorization: false,
@@ -192,8 +216,17 @@ function summaryLines(summary, humanStatus) {
       ? `$${summary.resourcePreflight.estimate.cost.valueUsd}`
       : "unknown"}`,
     `Receipt reuse: ${summary.resourcePreflight.receiptReuse.appliedCount}/${summary.resourcePreflight.receiptReuse.reusableCount}`,
-    `Dominant gap: ${summary.dominantGap.code}`,
-    `Next allowed action: ${summary.nextAllowedAction}`,
+    ...(summary.projectDriver
+      ? [
+          `Project dominant gap: ${summary.dominantGap.code}`,
+          `Recommended next action: ${value(summary.recommendedNextAction)}`,
+          `Execution state: ${summary.currentExecution.state}`,
+          `Execution next allowed action: ${summary.nextAllowedAction}`,
+        ]
+      : [
+          `Dominant gap: ${summary.dominantGap.code}`,
+          `Next allowed action: ${summary.nextAllowedAction}`,
+        ]),
     ...(summary.maintenanceNextAction
       ? [`Maintenance: ${summary.maintenanceNextAction}`]
       : []),

package/scripts/runkit-contract/install-codex-skill.mjs

@@ -16,6 +16,7 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 
 import {
+  currentCoreIdentity,
   initializeProjectRunKit,
   isDirectExecution,
   validateProjectConfigV2,
@@ -193,6 +194,64 @@ export async function inspectInstalledSkill({ targetRoot } = {}) {
   };
 }
 
+export async function inspectInstalledSkillCompatibility({ targetRoot } = {}) {
+  const integrity = await inspectInstalledSkill({ targetRoot });
+  if (!integrity.valid) {
+    return {
+      ...integrity,
+      integrityValid: false,
+      authorizationGranted: false,
+    };
+  }
+
+  const expectedCore = currentCoreIdentity();
+  let installedSkillVersion = null;
+  let installedConfigCore = null;
+  const issues = [];
+  try {
+    const skillText = await readFile(path.join(targetRoot, "SKILL.md"), "utf8");
+    installedSkillVersion = skillText.match(/standalone `owlrunkit@(\d+\.\d+\.\d+)`/u)?.[1] ?? null;
+    installedConfigCore = JSON.parse(await readFile(
+      path.join(targetRoot, "assets/templates/config.json"),
+      "utf8",
+    )).core ?? null;
+  } catch {
+    issues.push("installed_skill_version_declaration_invalid");
+  }
+
+  const installedConfigCoreVersion = installedConfigCore?.coreVersion ?? null;
+  if (installedSkillVersion === null || installedConfigCoreVersion === null) {
+    issues.push("installed_skill_core_version_declaration_missing");
+  } else if (
+    installedSkillVersion !== expectedCore.coreVersion
+    || installedConfigCoreVersion !== expectedCore.coreVersion
+  ) {
+    issues.push(
+      `installed_skill_core_version_mismatch:expected_${expectedCore.coreVersion}`
+      + `:skill_${installedSkillVersion}:config_${installedConfigCoreVersion}`,
+    );
+  } else if (!sameCoreIdentity(installedConfigCore, expectedCore)) {
+    issues.push(
+      `installed_skill_core_identity_mismatch:expected_${expectedCore.coreManifestSha256}`
+      + `:config_${installedConfigCore?.coreManifestSha256 ?? "missing"}`,
+    );
+  }
+
+  return {
+    ...integrity,
+    status: issues.length === 0 ? "valid" : "version_mismatch",
+    valid: issues.length === 0,
+    integrityValid: true,
+    expectedCoreVersion: expectedCore.coreVersion,
+    expectedCore,
+    installedSkillVersion,
+    installedConfigCoreVersion,
+    installedConfigCore,
+    issues,
+    authorizationGranted: false,
+  };
+}
+
 export async function inspectFleetForSkillChange({
   workspaceRoots = null,
   fleetManifestPath = null,
@@ -731,7 +790,7 @@ export async function runCli(argv = process.argv.slice(2)) {
       return { exitCode: 0, ...output };
     }
     if (command === "inspect") {
-      const output = await inspectInstalledSkill({ targetRoot: options.target });
+      const output = await inspectInstalledSkillCompatibility({ targetRoot: options.target });
       return { exitCode: output.valid ? 0 : 2, ...output };
     }
     if (command === "restore") {

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -583,6 +583,24 @@ function profilesCheck(root) {
   }
 }
 
+async function doctorProfilesCheck(root) {
+  const launcherCheck = profilesCheck(root);
+  if (launcherCheck.status === "missing") return launcherCheck;
+  const { validateProfiles } = await import("./profile-onboarding.mjs");
+  const validation = validateProfiles({ workspaceRoot: root });
+  const issues = [...new Set([
+    ...(launcherCheck.launcherIssues ?? []),
+    ...validation.issues,
+  ])].sort();
+  return {
+    ...launcherCheck,
+    status: issues.length === 0 ? "ok" : "invalid",
+    validationStatus: validation.status,
+    validationIssues: validation.issues,
+    ...(issues.length > 0 ? { issues } : {}),
+  };
+}
+
 export function readProfileLauncherReadiness({ workspaceRoot } = {}) {
   const profiles = profilesCheck(resolveBoundedWorkspaceRoot(workspaceRoot));
   const launcherWarnings = profiles.launcherWarnings ?? [];
@@ -646,7 +664,7 @@ export async function runDoctor({
       });
   const nodeOk = Number(process.versions.node.split(".")[0]) >= 20;
   const config = configCheck(root);
-  const profiles = profilesCheck(root);
+  const profiles = await doctorProfilesCheck(root);
   const adoption = adoptionCheck(root, installed);
   const runtimeIsolation = runtimeIsolationCheck(root);
   const checks = {