owlrunkit 0.18.1 → 0.18.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.18.2
+
+- Makes `project checkpoint --help` action-specific and returns a complete,
+  shell-safe correction command when a measured checkpoint omits
+  `--completed-units`.
+- Keeps symlinked workspace roots fail-closed while reporting the canonical
+  `--workspace` path, including the macOS `/tmp` to `/private/tmp` case.
+- Returns a bounded stdout/stderr `outputSummary` at the top level of Quick
+  results without changing the receipt or weakening full-output binding.
+- Retries one transient registry transport failure while retaining the existing
+  per-attempt timeout, and distinguishes DNS, connection, timeout, HTTP,
+  authentication, and missing-version failures.
+- Aligns the packaged README with five-mode routing and existing profile
+  reconciliation instead of treating long-running, release, or production
+  labels as automatic Formal triggers.
+- Adds action-specific `quick-verify --help`, lists canonical risk-category
+  values in mode help and validation errors, and marks formatting-only profile
+  reconcile plans with `normalizationOnly: true`.
+
 ## 0.18.1
 
 - Adds read-only `mode recommend` and `mode status` commands with five

package/README.md

@@ -11,6 +11,10 @@ continuity and assurance independently. It keeps ordinary development light
 while preserving mandatory Formal routing for material safety and authority
 facts.
 
+RunKit 0.18.2 is a focused dogfood patch for clearer CLI help, actionable
+checkpoint and canonical-path errors, bounded Quick output summaries, typed
+registry diagnostics, and explicit profile normalization previews.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -25,7 +29,7 @@ separate authority boundaries.
 ## Install
 
 ```bash
-npm install --save-exact owlrunkit@0.18.1
+npm install --save-exact owlrunkit@0.18.2
 ```
 
 The `owlrunkit` bootstrap uses the project's exact locally bound CLI for
@@ -112,9 +116,10 @@ Normal users supply the one definition JSON to `init`, then use typed flags and
 values. They do not need to author request, event, receipt, or hash JSON. The
 legacy `--request <event.json>` path remains available for existing automation
 and compatibility. Multiple Agents do not make project coordination Formal by
-themselves. This flow does not make project coordination Formal by itself; the
-assurance lane follows the underlying high-risk integration,
-release, production, migration, destructive, or explicit Formal-acceptance boundary.
+themselves. Project Driver continuity does not make project coordination Formal
+by itself. The assurance lane follows actual writer and authority count,
+rollback certainty, permissions, security, funds, irreversibility, schema/data
+migration, and explicit acceptance contracts—not environment labels alone.
 
 `project verification --defer` is a small deferred-verification ledger, not a
 test scheduler. It records stable check IDs, why they were intentionally not
@@ -166,30 +171,52 @@ high-confidence candidates:
 ```bash
 owlrunkit profiles detect --workspace . --dry-run
 owlrunkit profiles detect --workspace . --apply
+owlrunkit profiles reconcile --workspace . --dry-run
+owlrunkit profiles reconcile --workspace . --apply
 owlrunkit profiles validate --workspace .
 ```
 
-`--apply` is create-only. It refuses ambiguous or low-confidence candidates,
-source drift, symlinks, and launchers that do not resolve to exact local files.
-It directly supports lock-bound npm plus exact project-installed pnpm, Yarn,
-and Bun launchers. A PATH-only package manager remains review-required. It
-never silently replaces an existing profile set.
+`profiles detect --apply` is create-only. `profiles reconcile` previews or
+atomically updates an existing profile set and leaves a migration receipt. Both
+paths refuse ambiguous or low-confidence candidates, source drift, symlinks,
+and launchers that do not resolve to exact local files. Detection directly
+supports lock-bound npm plus exact project-installed pnpm, Yarn, and Bun
+launchers. A PATH-only package manager remains review-required. A dry-run that
+only canonicalizes JSON formatting reports `normalizationOnly: true` instead of
+showing unexplained hash drift with an empty update list.
+
+## Choose auto, off, light, managed, or formal
+
+Start with the human-first read-only recommendation:
+
+```bash
+owlrunkit mode recommend --workspace .
+```
+
+- **off / No RunKit** uses neither continuity nor assurance for analysis,
+  documentation, and disposable exploration that needs no reusable evidence.
+- **light / Quick Verification** runs one exact low-risk, source-bound command.
+- **managed** adds Project Driver continuity; each WorkItem may still use no
+  assurance, Quick, or Formal according to its own facts.
+- **formal / Formal Delivery** is forced by multiple writers, permission or
+  security boundaries, funds, irreversible work, uncertain rollback,
+  schema/data migration, or an explicit Formal acceptance contract.
+- **auto** derives the preset from supplied facts and is the default.
 
-## Choose No RunKit, Quick, or Formal
+Production, release, deployment, long duration, and interruption recovery do
+not force Formal by themselves. Long or interrupted work primarily selects
+Project Driver continuity. Risk containment permits a fresh lower-assurance
+recommendation; escalation is not sticky.
 
-Route explicit risk facts before starting work:
+Machine integrations may route an explicit risk-facts document directly:
 
 ```bash
 owlrunkit assurance route --workspace . \
   --request ./scripts/runkit-contract/templates/assurance-request.json
 ```
 
-- **No RunKit** is for work that needs neither a reusable receipt nor controlled
-  writes.
-- **Quick Verification** is for one low-risk, source-bound command that needs a
-  reusable receipt but no writer lease or Formal acceptance.
-- **Formal Delivery** is for multi-writer, long-running, migration, integration,
-  release, production, funds, destructive, or formally accepted work.
+`mode recommend --help` lists every accepted `--risk-category`; an invalid
+category reports both the rejected value and the canonical allowed list.
 
 The router fails closed to Formal when required risk facts are incomplete.
 Quick receipts cannot become Formal acceptance, and Formal acceptance does not
@@ -201,6 +228,11 @@ Run Quick with:
 owlrunkit quick-verify --workspace . -- npm test
 ```
 
+The top-level Quick result includes a bounded `outputSummary` with the last
+meaningful stdout/stderr lines, so common summaries such as `155 passed` are
+visible without opening `stdout.log`. The receipt still binds the complete
+stdout and stderr artifacts; the summary is presentation only.
+
 ## Formal Delivery in three commands
 
 Given a Goal Contract and the paths this work item may write, the happy path is:

package/docs/architecture/OWLCODA_RUNKIT_USAGE_MODE_SELECTION_PRODUCT_DECISION_20260811.md

@@ -1,6 +1,6 @@
 # OwlCoda RunKit 使用模式选择：Sierac MES Dogfood 产品决议
 
-状态：**0.18.1 本地候选，未发布、未安装、未激活**
+状态：**0.18.1 已发布；本文主体保留发布前产品决议，文末追加 0.18.2 dogfood 补丁候选**
 日期：2026-08-11
 
 ## 已验证现场事实
@@ -125,8 +125,9 @@ global gate 仍正确失效。
 
 ## 不能声称的内容
 
-- 这份文档和当前 worktree 不是已发布的 0.18.1，也不是 npm、Core、Skill 或任何
-  项目的升级完成证明。
+- 本文主体形成时记录的是 0.18.1 发布前候选；0.18.1 后续发布事实以
+  `docs/PRODUCT-TRUTH.md` 和独立 release receipt 为准。本文本身不证明 npm、Core、
+  Skill 或任何项目已升级。
 - `mode recommend` 根据调用者提供的结构化事实路由；它不会自动发现所有业务、
   权限、资金或迁移风险。
 - RunKit 降低进度、证据和完成状态幻觉，不直接解决 Sierac MES 业务问答幻觉。
@@ -136,7 +137,30 @@ global gate 仍正确失效。
 
 ## 版本建议
 
-本组变更适合形成 `owlrunkit@0.18.1` 小版本候选：它保持 0.18 的 Project Driver
+本组变更当时适合形成 `owlrunkit@0.18.1` 小版本候选：它保持 0.18 的 Project Driver
 和回执合同，新增只读 CLI，并修复 dogfood 验证出的行为缺陷。候选只有在聚焦测试、
 RunKit contract/package gate、Core 身份同步、pack 内容检查和安装 smoke 都通过后
 才具备发布评审资格；发布、项目升级与运行时激活仍是之后的独立动作。
+
+## 0.18.2 dogfood 补丁追加
+
+0.18.1 发布后，Sierac MES 与 OwlChen 的项目级使用继续证明 `managed + quick` 是普通
+跨会话源码 Wave 的合适默认，Formal 只应由真实高风险事实触发。OwlChen 已读回项目
+本地 0.18.1 的 doctor、profiles、Formal、Quick、metrics 与模式选择器主路径；进程级
+共享 Skill 因另一项目存在 active execution/lease 而停止升级，这是正确的安全边界，
+不是缺陷。
+
+这些后续 dogfood 暴露的缺口适合形成 0.18.2 patch，而不是新增平台能力：
+
+- symlink workspace 拒绝时直接给出 canonical `--workspace`，包括 macOS
+  `/tmp` 到 `/private/tmp`；
+- `project checkpoint --help` 和 measured WorkItem 缺参错误给出完整命令；
+- Quick 顶层返回有界 stdout/stderr 摘要，同时完整日志继续由回执绑定；
+- doctor 对 registry transport 做一次重试、每次保留原有超时上限，并区分 DNS、连接、
+  超时、HTTP、认证和版本缺失；
+- `quick-verify --help` 可用，risk category 的帮助与错误列出同一组规范值；
+- profile 纯格式规范化计划显式返回 `normalizationOnly: true`；
+- package README 与五模式、profile reconcile 的已实现真值一致。
+
+当前这些内容只是本地 `owlrunkit@0.18.2` 候选。它不代表 commit、tag、npm 发布、
+全局 Skill 更新、OwlChen/OwlFootball 迁移或任何业务授权已经发生。

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -7,10 +7,10 @@ description: Run receipt-backed, project-owned work with OwlCoda RunKit. Use whe
 
 Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
 
-Bundled release: standalone `owlrunkit@0.18.1`, bundling Contract `0.2` and
-Core `0.18.1` with manifest
-`sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07`.
-The published `owlrunkit@0.18.0` package is the trusted prior for rollback;
+Bundled release: standalone `owlrunkit@0.18.2`, bundling Contract `0.2` and
+Core `0.18.2` with manifest
+`sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6`.
+The published `owlrunkit@0.18.1` package is the trusted prior for rollback;
 verify exact official npm registry provenance before adoption. The immutable
 rollback baseline for the prior release is `owlrunkit@0.16.1` with SHA-1
 `1bc119d24879bdd8959af16b364af55ca9d61ea9` and canonical npm tarball URL

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -2,9 +2,9 @@
   "schemaVersion": "OwlCodaRunKitConfigV2",
   "core": {
     "contractVersion": "0.2",
-    "coreVersion": "0.18.1",
-    "coreManifestSha256": "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
-    "coreSourceRef": "artifact:sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07"
+    "coreVersion": "0.18.2",
+    "coreManifestSha256": "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+    "coreSourceRef": "artifact:sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6"
   },
   "authorizationPolicy": "external_explicit_authority_required"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "owlrunkit",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Project Driver for cross-Agent project continuity and progression; execution, evidence, verification, and recovery are the underlying trust substrate.",
   "license": "GPL-3.0-or-later",
   "author": "yeemio <owlclaw@163.com>",

package/packages/attest/distribution-manifest-v1.json

@@ -36,6 +36,11 @@
     "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
   },
   "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.18.2",
+      "coreManifestSha256": "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6"
+    },
     {
       "contractVersion": "0.2",
       "coreVersion": "0.18.1",

package/packages/attest/src/quick.mjs

@@ -18,6 +18,11 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.2",
+    coreManifestSha256: "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.18.1",

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.18.1",
+  "candidateVersion": "0.18.2",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.18.0",
-    "shasum": "ab2d9c9ed81f9dcccd4c1affa519cfca1cc32032",
-    "integrity": "sha512-asi4CKofzjzQ9gGxnv6/NDCM6rZcMMqpwd4uRStfUUwDetFLYHEPDMBv1JGvYotdUwwoODxwdJ3KMGXQSYorgA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.0.tgz"
+    "version": "0.18.1",
+    "shasum": "6d35c15f90ed775c583356754b831856d1a3c0a6",
+    "integrity": "sha512-07wWnSfY6RUavcb+ZpUbZ1S0nBjN7/8VIFHyP6blOB+PIrDnnST/8f7CoLgADYpfwjZiF5gR9U6XFwXa0kgVrg==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.18.1",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.1",
+  "name": "owlrunkit-0.18.2",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.2",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.18.1",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz",
+      "versionInfo": "0.18.2",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.18.1"
+          "referenceLocator": "pkg:npm/owlrunkit@0.18.2"
         }
       ]
     }

package/scripts/runkit-contract/assurance-router.mjs

@@ -14,7 +14,7 @@ const BOOLEAN_FACTS = [
   "schemaOrDataMigration",
 ];
 
-const RISK_CATEGORIES = new Set([
+export const RUNKIT_RISK_CATEGORIES = Object.freeze([
   "backtest",
   "deployment",
   "destructive",
@@ -26,6 +26,8 @@ const RISK_CATEGORIES = new Set([
   "release",
 ]);
 
+const RISK_CATEGORIES = new Set(RUNKIT_RISK_CATEGORIES);
+
 const MATERIAL_RISK_CATEGORIES = new Set([
   "destructive",
   "foreign_write",

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.18.1";
+export const CORE_VERSION = "0.18.2";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -190,11 +190,16 @@ function parseJsonStrict(text) {
 export function resolveBoundedWorkspaceRoot(workspaceRoot) {
   const requested = path.resolve(workspaceRoot);
   const stat = lstatSync(requested);
-  if (
-    stat.isSymbolicLink()
-    || !stat.isDirectory()
-    || realpathSync(requested) !== requested
-  ) {
+  const resolved = realpathSync(requested);
+  if ((stat.isSymbolicLink() || resolved !== requested)
+    && lstatSync(resolved).isDirectory()) {
+    const quoted = `'${resolved.replaceAll("'", `'"'"'`)}'`;
+    throw new Error(
+      "workspace root must be a real directory without symlink ancestors. "
+      + `Retry with --workspace ${quoted}.`,
+    );
+  }
+  if (!stat.isDirectory()) {
     throw new Error("workspace root must be a real directory without symlink ancestors");
   }
   return requested;
@@ -317,28 +322,51 @@ export function readLocalInstallBinding({ workspaceRoot } = {}) {
   };
 }
 
+function registryTransportFailure(error) {
+  const code = error?.cause?.code ?? error?.code ?? null;
+  if (error?.name === "TimeoutError"
+    || error?.name === "AbortError"
+    || code === "ETIMEDOUT") {
+    return { issueCode: "registry_timeout", retryable: true };
+  }
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN") {
+    return { issueCode: "registry_dns_failed", retryable: true };
+  }
+  if (code === "ERR_INVALID_URL") {
+    return { issueCode: "registry_url_invalid", retryable: false };
+  }
+  return { issueCode: "registry_connection_failed", retryable: true };
+}
+
 export async function readRegistryExact({
   registryUrl,
   packageName = PACKAGE_NAME,
   version = EXPECTED_VERSION,
   timeoutMs = 1_500,
+  fetchImpl = fetch,
 } = {}) {
   const base = registryUrl.replace(/\/+$/, "");
   const url = `${base}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}`;
   let response;
-  try {
-    response = await fetch(url, {
-      headers: {
-        accept: "application/json",
-      },
-      redirect: "manual",
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-  } catch {
-    return {
-      status: "unavailable",
-      issueCodes: ["registry_dns_or_timeout"],
-    };
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      response = await fetchImpl(url, {
+        headers: {
+          accept: "application/json",
+        },
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+      break;
+    } catch (error) {
+      const failure = registryTransportFailure(error);
+      if (!failure.retryable || attempt === 1) {
+        return {
+          status: "unavailable",
+          issueCodes: [failure.issueCode],
+        };
+      }
+    }
   }
   if (response.status === 401 || response.status === 403) {
     return {

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1511,10 +1511,14 @@ export function reconcileProfilesV2({
   }
   const proposedProfilesBytes = `${JSON.stringify(merged.proposedProfiles, null, 2)}\n`;
   const proposedProfilesSha256 = sha256(proposedProfilesBytes);
+  const normalizationOnly = proposedProfilesSha256 !== currentProfilesSha256
+    && merged.addedProfileIds.length === 0
+    && merged.updatedProfiles.length === 0;
   const planBody = {
     detectionSha256: detection.detectionSha256,
     currentProfilesSha256,
     proposedProfilesSha256,
+    normalizationOnly,
     addedProfileIds: merged.addedProfileIds,
     updatedProfiles: merged.updatedProfiles,
   };

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,9 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.18.1", new Set([
+    "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
+  ])],
   ["0.18.0", new Set([
     "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e",
   ])],

package/scripts/runkit-contract/quick-receipt.mjs

@@ -16,6 +16,8 @@ import path from "node:path";
 import { sha256Bytes } from "./quick-canonical.mjs";
 
 const QUICK_ROOT = ".owlcoda/runkit/quick";
+const OUTPUT_SUMMARY_BYTES = 16 * 1024;
+const OUTPUT_SUMMARY_LINES = 3;
 
 function withinRoot(root, candidate) {
   const remainder = path.relative(root, candidate);
@@ -87,12 +89,40 @@ export function closeQuickOutputFiles(store) {
   closeSync(store.stderrFd);
 }
 
+function cleanOutputLine(line) {
+  const withoutAnsi = line.replace(/\u001b\[[0-?]*[ -/]*[@-~]/gu, "");
+  return [...withoutAnsi]
+    .filter((character) => character === "\t" || character.codePointAt(0) >= 32)
+    .join("")
+    .trim();
+}
+
+function summarizeOutputBytes(bytes) {
+  const start = Math.max(0, bytes.byteLength - OUTPUT_SUMMARY_BYTES);
+  let text = bytes.subarray(start).toString("utf8");
+  if (start > 0) {
+    const firstLineBreak = text.indexOf("\n");
+    if (firstLineBreak >= 0) text = text.slice(firstLineBreak + 1);
+  }
+  const lines = text
+    .split(/\r?\n/u)
+    .map(cleanOutputLine)
+    .filter(Boolean);
+  return {
+    lines: lines.slice(-OUTPUT_SUMMARY_LINES),
+    truncated: start > 0 || lines.length > OUTPUT_SUMMARY_LINES,
+  };
+}
+
 function outputArtifact(workspaceRoot, filePath) {
   const bytes = readFileSync(filePath);
   return {
-    path: path.relative(realpathSync(workspaceRoot), filePath).split(path.sep).join("/"),
-    sha256: sha256Bytes(bytes),
-    sizeBytes: bytes.byteLength,
+    artifact: {
+      path: path.relative(realpathSync(workspaceRoot), filePath).split(path.sep).join("/"),
+      sha256: sha256Bytes(bytes),
+      sizeBytes: bytes.byteLength,
+    },
+    summary: summarizeOutputBytes(bytes),
   };
 }
 
@@ -119,11 +149,13 @@ function validateQuickReceiptStore(workspaceRoot, store) {
 
 export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
   validateQuickReceiptStore(workspaceRoot, store);
+  const stdout = outputArtifact(workspaceRoot, store.stdoutPath);
+  const stderr = outputArtifact(workspaceRoot, store.stderrPath);
   const complete = {
     ...receipt,
     outputArtifacts: {
-      stdout: outputArtifact(workspaceRoot, store.stdoutPath),
-      stderr: outputArtifact(workspaceRoot, store.stderrPath),
+      stdout: stdout.artifact,
+      stderr: stderr.artifact,
     },
   };
   atomicWriteJson(store.receiptPath, complete);
@@ -131,6 +163,12 @@ export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
     receipt: complete,
     receiptPath: store.receiptPath,
     receiptSha256: sha256Bytes(readFileSync(store.receiptPath)),
+    outputSummary: {
+      stdoutTail: stdout.summary.lines,
+      stderrTail: stderr.summary.lines,
+      stdoutTruncated: stdout.summary.truncated,
+      stderrTruncated: stderr.summary.truncated,
+    },
   };
 }
 

package/scripts/runkit-contract/quick-verify.mjs

@@ -160,6 +160,8 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     };
   }
 
+  const { outputSummary } = persisted;
+
   if (sourceMutated) {
     const attestCommand = quickAttestCommand(root, persisted.receiptPath);
     return {
@@ -171,6 +173,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "invalidated_by_command_source_mutation",
       issueCodes,
+      outputSummary,
       attestCommand,
       issues: [],
       nextAllowedAction: "restore_source_or_run_a_new_quick_verification",
@@ -188,6 +191,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes,
+      outputSummary,
       attestCommand,
       issues: execution.launchError ? [execution.launchError] : [],
       nextAllowedAction: "inspect_output_and_rerun",
@@ -204,6 +208,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     commandExitCode: 0,
     mutationDecision: "source_unchanged",
     issueCodes,
+    outputSummary,
     attestCommand,
     issues: [],
     nextAllowedAction: attestCommand,

package/scripts/runkit-contract/runkit-cli.mjs

@@ -100,7 +100,10 @@ import {
   replaceFleetRegistry,
   rollbackFleetRegistry,
 } from "./fleet-discovery.mjs";
-import { routeRunKitAssuranceV1 } from "./assurance-router.mjs";
+import {
+  RUNKIT_RISK_CATEGORIES,
+  routeRunKitAssuranceV1,
+} from "./assurance-router.mjs";
 import {
   formatUsageModeHumanV1,
   recommendUsageModeV1,
@@ -244,7 +247,7 @@ read-only and grant no Git, release, deployment, production, or business authori
     [--irreversible] [--rollback-uncertain]
     [--permission-sensitive] [--security-sensitive] [--funds-at-risk]
     [--schema-or-data-migration] [--formal-acceptance]
-    [--risk-category <category>] [--json]
+    [--risk-category <${RUNKIT_RISK_CATEGORIES.join("|")}>] [--json]
 
 Returns one user mode plus the independent continuity and assurance selections.
 Persisted mode preferences are not part of this release.
@@ -259,6 +262,13 @@ Reads the current mode preference source without creating project state.
 
 Attests one Quick Receipt against its bound materials and current workspace.
 It never grants repository or business authority.
+`,
+  "quick-verify": `Usage:
+  owlrunkit quick-verify --workspace <directory> [--json] -- <executable> [args...]
+
+Runs one exact command, saves source-bound stdout/stderr and a Quick receipt,
+and returns a bounded output summary. Supply the exact command after --.
+Quick evidence is not Formal acceptance and grants no repository or business authority.
 `,
   fleet: `Usage:
   owlrunkit fleet register-root --fleet-root <directory>
@@ -437,6 +447,18 @@ action without granting any authority.
 Project status is derived from durable work items, Agent assignments,
 dependencies, decisions, checkpoints, integration gates, and evidence refs.
 No self-reported percentage is accepted.
+`,
+  "project checkpoint": `Usage:
+  owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
+    --assignment-id <current> --work-item <id>
+    --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
+    --summary <text> [--completed-units <nonnegative-int>]
+    [--evidence <ref> ...] [--blocker <ref> ...] [--decision <id> ...]
+    [--next <text>] [--source-fingerprint <sha256>] [--json]
+
+Measured WorkItems require --completed-units on every checkpoint. A completed
+checkpoint must use the WorkItem's declared total. Example:
+  owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
 `,
   "project status": `Usage:
   owlrunkit project status --workspace <directory> [--json]
@@ -465,6 +487,25 @@ function withHumanOutput(result, humanOutput) {
   return result;
 }
 
+function shellCommandToken(value) {
+  const text = String(value);
+  return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(text)
+    ? text
+    : `'${text.replaceAll("'", `'"'"'`)}'`;
+}
+
+function correctedCheckpointCommand(argv, completedUnits) {
+  const corrected = [...argv];
+  const jsonIndex = corrected.indexOf("--json");
+  corrected.splice(
+    jsonIndex === -1 ? corrected.length : jsonIndex,
+    0,
+    "--completed-units",
+    String(completedUnits),
+  );
+  return `owlrunkit ${corrected.map(shellCommandToken).join(" ")}`;
+}
+
 function formatTeamProjectAssignmentHuman(result) {
   const disposition = result.resumed ? "Resumed" : "Assigned";
   const nextAction = result.nextAction === null
@@ -3073,24 +3114,49 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
             event: requestedEvent,
           });
         }
+        const checkpointId = requireOption(options, "checkpoint-id");
+        const occurredAt = requireOption(options, "at");
+        const assignmentId = requireOption(options, "assignment-id");
+        const workItemId = requireOption(options, "work-item");
+        const state = requireOption(options, "state");
+        const summary = requireOption(options, "summary");
         const completedUnits = options["completed-units"] === undefined
           ? undefined
           : parseCanonicalNonnegativeSafeInteger(options["completed-units"], "completed-units");
-        const checkpointed = checkpointTeamProjectV1({
-          workspaceRoot: root,
-          checkpointId: requireOption(options, "checkpoint-id"),
-          occurredAt: requireOption(options, "at"),
-          assignmentId: requireOption(options, "assignment-id"),
-          workItemId: requireOption(options, "work-item"),
-          state: requireOption(options, "state"),
-          summary: requireOption(options, "summary"),
-          completedUnits,
-          evidenceRefs: options.evidence ?? [],
-          blockerRefs: options.blocker ?? [],
-          decisionRefs: options.decision ?? [],
-          nextAction: options.next ?? null,
-          sourceFingerprint: options["source-fingerprint"],
-        });
+        let checkpointed;
+        try {
+          checkpointed = checkpointTeamProjectV1({
+            workspaceRoot: root,
+            checkpointId,
+            occurredAt,
+            assignmentId,
+            workItemId,
+            state,
+            summary,
+            completedUnits,
+            evidenceRefs: options.evidence ?? [],
+            blockerRefs: options.blocker ?? [],
+            decisionRefs: options.decision ?? [],
+            nextAction: options.next ?? null,
+            sourceFingerprint: options["source-fingerprint"],
+          });
+        } catch (error) {
+          if (error instanceof Error
+            && error.message === "Measured work item checkpoint requires completedUnits.") {
+            const projectStatus = readTeamProjectStatusV1({ workspaceRoot: root });
+            const workItem = projectStatus.workItems.find((row) => row.workItemId === workItemId);
+            const suggestedUnits = state === "completed"
+              ? workItem?.progress.total
+              : workItem?.progress.completed;
+            if (Number.isSafeInteger(suggestedUnits)) {
+              throw new Error(
+                "Measured work item checkpoint requires --completed-units. "
+                + `Corrected command: ${correctedCheckpointCommand(argv, suggestedUnits)}`,
+              );
+            }
+          }
+          throw error;
+        }
         return options.json === true
           ? checkpointed
           : withHumanOutput(checkpointed, formatTeamProjectCheckpointHuman(checkpointed));

package/scripts/runkit-contract/schemas/profile-reconcile-plan-v1.schema.json

@@ -16,6 +16,7 @@
     "detectionSha256": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] },
     "currentProfilesSha256": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] },
     "proposedProfilesSha256": { "$ref": "#/$defs/hash" },
+    "normalizationOnly": { "type": "boolean" },
     "addedProfileIds": { "$ref": "#/$defs/strings" },
     "updatedProfiles": { "type": "array", "items": { "$ref": "#/$defs/update" } },
     "proposedProfiles": { "$ref": "#/$defs/profiles" },
@@ -81,6 +82,7 @@
     "detectionSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
     "currentProfilesSha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
     "proposedProfilesSha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "normalizationOnly": false,
     "addedProfileIds": [],
     "updatedProfiles": [{
       "profileId": "node-quality",

package/scripts/runkit-contract/usage-mode.mjs

@@ -1,3 +1,5 @@
+import { RUNKIT_RISK_CATEGORIES } from "./assurance-router.mjs";
+
 const USER_MODES = new Set(["auto", "off", "light", "managed", "formal"]);
 
 const BOOLEAN_FACTS = [
@@ -24,17 +26,7 @@ const MATERIAL_RISK_CATEGORIES = new Map([
   ["migration", "schema_or_data_migration"],
 ]);
 
-const KNOWN_RISK_CATEGORIES = new Set([
-  "backtest",
-  "deployment",
-  "destructive",
-  "foreign_write",
-  "funds",
-  "integration",
-  "migration",
-  "production",
-  "release",
-]);
+const KNOWN_RISK_CATEGORIES = new Set(RUNKIT_RISK_CATEGORIES);
 
 const AUTHORITY_BOUNDARY = Object.freeze({
   authorizationGranted: false,
@@ -65,8 +57,14 @@ function requireFacts(input) {
     || !input.riskCategories.every((value) => typeof value === "string")) {
     throw new Error("riskCategories must be an array of strings");
   }
-  if (input.riskCategories.some((value) => !KNOWN_RISK_CATEGORIES.has(value))) {
-    throw new Error("riskCategories contains an unknown category");
+  const unknownCategories = uniqueSorted(
+    input.riskCategories.filter((value) => !KNOWN_RISK_CATEGORIES.has(value)),
+  );
+  if (unknownCategories.length > 0) {
+    throw new Error(
+      `riskCategories contains an unknown category: ${unknownCategories.join(", ")}. `
+      + `Allowed: ${RUNKIT_RISK_CATEGORIES.join(", ")}`,
+    );
   }
 }