owlrunkit 0.18.3 → 0.18.4

package/scripts/runkit-contract/runkit-cli.mjs

@@ -86,9 +86,8 @@ import {
   importOfflineReceipt,
 } from "./offline-store.mjs";
 import {
-  applyDetectedProfilesV2,
-  detectProfiles,
-  detectProfilesV2,
+  applyDetectedProfilesV3,
+  detectProfilesV3,
   reconcileProfilesV2,
   resolveProfilesImpact,
   validateProfiles,
@@ -102,11 +101,11 @@ import {
 } from "./fleet-discovery.mjs";
 import {
   RUNKIT_RISK_CATEGORIES,
-  routeRunKitAssuranceV1,
+  routeRunKitAssuranceV2,
 } from "./assurance-router.mjs";
 import {
-  formatUsageModeHumanV1,
-  recommendUsageModeV1,
+  formatUsageModeHumanV2,
+  recommendUsageModeV2,
 } from "./usage-mode.mjs";
 import { deriveHumanStatusFromInspectV1 } from "./human-status.mjs";
 import {
@@ -147,17 +146,17 @@ import { OFFICIAL_NPM_REGISTRY } from "./registry-adoption-gate.mjs";
 import {
   appendTeamProjectEventV1,
   assignTeamProjectV1,
-  buildTeamProjectTakeoverV1,
+  buildTeamProjectTakeoverV2,
   checkpointTeamProjectV1,
   closeTeamProjectVerificationV1,
   deferTeamProjectVerificationV1,
-  formatTeamProjectStatusHumanV1,
-  formatTeamProjectTakeoverHumanV1,
+  formatTeamProjectStatusHumanV2,
+  formatTeamProjectTakeoverHumanV2,
   handoffTeamProjectV1,
   initializeTeamProjectV1,
   integrateTeamProjectV1,
   openTeamProjectDecisionV1,
-  readTeamProjectStatusV1,
+  readTeamProjectStatusV2,
   rejectAndReturnTeamProjectV1,
   resolveTeamProjectDecisionV1,
 } from "./team-project.mjs";
@@ -165,82 +164,86 @@ import {
   formatTeamProjectSuccessorHumanV1,
   successorTeamProjectV1,
 } from "./team-project-successor.mjs";
+import {
+  captureTargetWorkspaceSnapshotV1,
+  importExternalDeliveryV1,
+} from "./project-external-delivery.mjs";
 
 const TOP_LEVEL_HELP = `OwlRunKit ${CORE_VERSION}
 
 Usage:
-  owlrunkit <command> [options]
+  npx --no-install owlrunkit <command> [options]
 
 Start here:
-  owlrunkit mode recommend --workspace .
-  owlrunkit doctor --workspace .
-  owlrunkit profiles detect --workspace . --dry-run
-  owlrunkit profiles detect --workspace . --apply
-  owlrunkit assurance route --workspace . --request <risk-facts.json>
-  owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION}
+  npx --no-install owlrunkit mode recommend --workspace .
+  npx --no-install owlrunkit doctor --workspace .
+  npx --no-install owlrunkit profiles detect --workspace . --dry-run
+  npx --no-install owlrunkit profiles detect --workspace . --apply
+  npx --no-install owlrunkit assurance route --workspace . --request <risk-facts.json>
+  npx --no-install owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION}
 Quick Verification
-  owlrunkit quick-verify --workspace . -- <command> [args...]
+  npx --no-install owlrunkit quick-verify --workspace . -- <command> [args...]
   Low-risk, source-bound reusable evidence without writer leases or acceptance.
 
 Formal Delivery
-  owlrunkit formal <start|check|finish> --workspace . --run-id <id> [...]
+  npx --no-install owlrunkit formal <start|check|finish> --workspace . --run-id <id> [...]
   Use for multi-writer, permissions, security, funds, irreversible change,
   uncertain rollback, schema/data migration, or explicit Formal acceptance.
 
 Frozen dirty source
-  owlrunkit candidate <freeze|verify|materialize> --workspace . [...]
+  npx --no-install owlrunkit candidate <freeze|verify|materialize> --workspace . [...]
 
 Two-stage deployment
-  owlrunkit deployment prepare --workspace . --run-id <accepted-run> --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
-  owlrunkit deployment execute --workspace . [--resume] --prepare <receipt> --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json>
+  npx --no-install owlrunkit deployment prepare --workspace . --run-id <accepted-run> --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
+  npx --no-install owlrunkit deployment execute --workspace . [--resume] --prepare <receipt> --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json>
 
 Fleet and status
-  owlrunkit fleet <register-root|inspect-registry> [options]
-  owlrunkit fleet replace-registry --request <file> --receipt <file> [--dry-run]
-  owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file>
-  owlrunkit fleet discover; owlrunkit status --workspace .
+  npx --no-install owlrunkit fleet <register-root|inspect-registry> [options]
+  npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file> [--dry-run]
+  npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file>
+  npx --no-install owlrunkit fleet discover; npx --no-install owlrunkit status --workspace .
 
 Agent team projects
-  owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|capture|status|takeover|successor> [options]
+  npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|capture|target-snapshot|import-delivery|status|takeover|successor> [options]
   Durable Agent work, dependencies, decisions, gates, progress, and handoffs.
 Core successor
-  owlrunkit core-successor <plan|apply|resume> --workspace . [...]
+  npx --no-install owlrunkit core-successor <plan|apply|resume> --workspace . [...]
 
 Other onboarding commands:
-  owlrunkit profiles validate --workspace .; owlrunkit profiles impact --workspace . --changed <path>
-  owlrunkit inspect --workspace . --json
+  npx --no-install owlrunkit profiles validate --workspace .; npx --no-install owlrunkit profiles impact --workspace . --changed <path>
+  npx --no-install owlrunkit inspect --workspace . --json
 Formal accepted does not grant Git or release authority; Quick cannot become Formal.
 `;
 
 const COMMAND_HELP = Object.freeze({
   adopt: `Usage:
-  owlrunkit adopt --workspace <directory> --exact owlrunkit@${CORE_VERSION}
+  npx --no-install owlrunkit adopt --workspace <directory> --exact owlrunkit@${CORE_VERSION}
     [--registry <url>] [--timeout-ms <milliseconds>] [--json]
 
 Verifies the exact registry release against the project-local install and writes
 project-owned adoption evidence. It grants no Git or release authority.
 `,
   assurance: `Usage:
-  owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
+  npx --no-install owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
 
 Selects none, Quick, or Formal from structured risk facts. It does not grant
 repository, release, deployment, or destructive authority.
 `,
   "assurance route": `Usage:
-  owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
+  npx --no-install owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
 
 Required:
   --request <file>       Structured assurance risk facts.
 `,
   mode: `Usage:
-  owlrunkit mode recommend --workspace <directory> [risk facts]
-  owlrunkit mode status --workspace <directory> [--json]
+  npx --no-install owlrunkit mode recommend --workspace <directory> [risk facts]
+  npx --no-install owlrunkit mode status --workspace <directory> [--json]
 
 Selects continuity and assurance independently. Recommendation and status are
 read-only and grant no Git, release, deployment, production, or business authority.
 `,
   "mode recommend": `Usage:
-  owlrunkit mode recommend --workspace <directory>
+  npx --no-install owlrunkit mode recommend --workspace <directory>
     [--requested-mode auto|off|light|managed|formal]
     [--needs-evidence] [--exact-command-count <count>] [--writer-count <count>]
     [--cross-session] [--long-running] [--interruption-recovery]
@@ -254,18 +257,18 @@ Returns one user mode plus the independent continuity and assurance selections.
 Persisted mode preferences are not part of this release.
 `,
   "mode status": `Usage:
-  owlrunkit mode status --workspace <directory> [--json]
+  npx --no-install owlrunkit mode status --workspace <directory> [--json]
 
 Reads the current mode preference source without creating project state.
 `,
   "quick-attest": `Usage:
-  owlrunkit quick-attest --workspace <directory> --receipt <receipt.json> [--json]
+  npx --no-install owlrunkit quick-attest --workspace <directory> --receipt <receipt.json> [--json]
 
 Attests one Quick Receipt against its bound materials and current workspace.
 It never grants repository or business authority.
 `,
   "quick-verify": `Usage:
-  owlrunkit quick-verify --workspace <directory> [--stdin-file <file>] [--attest] [--json]
+  npx --no-install owlrunkit quick-verify --workspace <directory> [--stdin-file <file>] [--attest] [--json]
     -- <executable> [args...]
 
 Runs one exact command, saves source-bound stdout/stderr and a Quick receipt,
@@ -275,186 +278,188 @@ attests the saved receipt without merging Quick and attestation semantics.
 Quick evidence is not Formal acceptance and grants no repository or business authority.
 `,
   "quick-metrics": `Usage:
-  owlrunkit quick-metrics --workspace <directory> --local [--verbose] [--json]
+  npx --no-install owlrunkit quick-metrics --workspace <directory> [--local] [--verbose] [--json]
 
 Returns aggregate local-only Quick counts with no telemetry or network access.
 --verbose additionally lists the receipt paths used for the aggregation.
 `,
   fleet: `Usage:
-  owlrunkit fleet register-root --fleet-root <directory>
-  owlrunkit fleet inspect-registry [--registry <file>]
-  owlrunkit fleet replace-registry --request <file> --receipt <file> [--registry <file>] [--dry-run]
-  owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file> [--registry <file>]
-  owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
+  npx --no-install owlrunkit fleet register-root --fleet-root <directory>
+  npx --no-install owlrunkit fleet inspect-registry [--registry <file>]
+  npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file> [--registry <file>] [--dry-run]
+  npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file> [--registry <file>]
+  npx --no-install owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
 `,
   "fleet register-root": `Usage:
-  owlrunkit fleet register-root --fleet-root <directory>
+  npx --no-install owlrunkit fleet register-root --fleet-root <directory>
 
 Registers one durable fleet coverage root for later no-argument discovery.
 `,
   "fleet inspect-registry": `Usage:
-  owlrunkit fleet inspect-registry [--registry <file>]
+  npx --no-install owlrunkit fleet inspect-registry [--registry <file>]
 
 Reads the exact registry bytes, hashes, roots, and membership without mutation.
 `,
   "fleet replace-registry": `Usage:
-  owlrunkit fleet replace-registry --request <file> --receipt <file>
+  npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file>
     [--registry <file>] [--dry-run]
 
 Atomically replaces a registry from an exact preimage and evidence-bound fleet
 membership. Coverage reduction requires explicit exclusion evidence.
 `,
   "fleet rollback-registry": `Usage:
-  owlrunkit fleet rollback-registry --receipt <replacement-receipt.json>
+  npx --no-install owlrunkit fleet rollback-registry --receipt <replacement-receipt.json>
     --rollback-receipt <file> [--registry <file>]
 
 Restores the exact preimage recorded by a replacement receipt.
 `,
   "fleet discover": `Usage:
-  owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
+  npx --no-install owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
     [--workspace-root <directory>]
 
 With no source option, discovers the complete fleet inside registered roots.
 `,
   profiles: `Usage:
-  owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
-  owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
-  owlrunkit profiles validate --workspace <directory>
-  owlrunkit profiles impact --workspace <directory> --changed <path>
+  npx --no-install owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
+  npx --no-install owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
+  npx --no-install owlrunkit profiles validate --workspace <directory>
+  npx --no-install owlrunkit profiles impact --workspace <directory> --changed <path>
 `,
   "profiles detect": `Usage:
-  owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
+  npx --no-install owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
 
 --dry-run reports deterministic candidates. --apply atomically adopts only a
 high-confidence unambiguous profile.
 `,
   "profiles reconcile": `Usage:
-  owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
+  npx --no-install owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
 
 --dry-run previews deterministic additions and command updates without writing.
 --apply atomically updates profiles.json and writes a hash-bound migration receipt.
 `,
   formal: `Usage:
-  owlrunkit formal start --workspace <directory> --run-id <id> [...]
-  owlrunkit formal check --workspace <directory> --run-id <id> -- <command>
-  owlrunkit formal finish --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal start --workspace <directory> --run-id <id> [...]
+  npx --no-install owlrunkit formal check --workspace <directory> --run-id <id> -- <command>
+  npx --no-install owlrunkit formal finish --workspace <directory> --run-id <id>
 `,
   "formal start": `Usage:
-  owlrunkit formal start --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal start --workspace <directory> --run-id <id>
     --goal <goal.json> --work-item <id> --owned-path <path>
 
 Creates the execution and exact writer lease.
 `,
   "formal check": `Usage:
-  owlrunkit formal check --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal check --workspace <directory> --run-id <id>
     --work-item <id> --check-id <id> --envelope <verification-envelope.json>
-  owlrunkit formal check --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal check --workspace <directory> --run-id <id>
     --work-item <id> --check-id <id> --cwd <directory> -- <built-in-command> [args...]
 
 Verification Envelopes admit real project commands only when file, network,
 process, environment, output, timeout, and cleanup constraints are enforced.
 `,
   "formal finish": `Usage:
-  owlrunkit formal finish --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal finish --workspace <directory> --run-id <id>
 
 Runs the final source, evidence, permission, closeout, and lease-release path.
 `,
   candidate: `Usage:
-  owlrunkit candidate freeze --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit candidate freeze --workspace <directory> --run-id <id>
     --from-lease <id> --candidate-id <id>
-  owlrunkit candidate verify --workspace <directory> --candidate <file>
-  owlrunkit candidate materialize --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate verify --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate materialize --workspace <directory> --candidate <file>
     --target-workspace <directory>
 `,
   "candidate freeze": `Usage:
-  owlrunkit candidate freeze --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit candidate freeze --workspace <directory> --run-id <id>
     --from-lease <id> --candidate-id <id>
 
 Freezes the exact dirty source manifest, including deletions and renames.
 `,
   "candidate verify": `Usage:
-  owlrunkit candidate verify --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate verify --workspace <directory> --candidate <file>
 `,
   "candidate materialize": `Usage:
-  owlrunkit candidate materialize --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate materialize --workspace <directory> --candidate <file>
     --target-workspace <directory>
 `,
   deployment: `Usage:
-  owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
+  npx --no-install owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
     --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
-  owlrunkit deployment execute --workspace <directory> --prepare <receipt>
+  npx --no-install owlrunkit deployment execute --workspace <directory> --prepare <receipt>
     --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json> [--resume]
 `,
   "deployment prepare": `Usage:
-  owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
+  npx --no-install owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
     --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
 `,
   "deployment execute": `Usage:
-  owlrunkit deployment execute --workspace <directory> --prepare <receipt>
+  npx --no-install owlrunkit deployment execute --workspace <directory> --prepare <receipt>
     --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json> [--resume]
 
 The default happy path creates and closes the deployment child, goal, lease,
 profile, preflight, lineage, and result. --request is an advanced legacy path.
 `,
   "core-successor": `Usage:
-  owlrunkit core-successor plan --workspace <directory> --plan-id <id> [...]
-  owlrunkit core-successor apply --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor plan --workspace <directory> --plan-id <id> [...]
+  npx --no-install owlrunkit core-successor apply --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> --receipt-id <id>
-  owlrunkit core-successor resume --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor resume --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> [...]
 `,
   "core-successor plan": `Usage:
-  owlrunkit core-successor plan --workspace <directory> --plan-id <id>
+  npx --no-install owlrunkit core-successor plan --workspace <directory> --plan-id <id>
     --run-id <id> --from-lease <id> --candidate-id <id>
     [--fleet-root <directory> | --fleet-manifest <file>]
 `,
   "core-successor apply": `Usage:
-  owlrunkit core-successor apply --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor apply --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> --receipt-id <id>
 `,
   "core-successor resume": `Usage:
-  owlrunkit core-successor resume --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor resume --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> [--from-receipt <file>]
 `,
   status: `Usage:
-  owlrunkit status --workspace <directory> [--json]
+  npx --no-install owlrunkit status --workspace <directory> [--json]
 
 Shows completed milestones, current state, remaining gates, and the next allowed
 action without granting any authority.
 `,
   project: `Usage:
-  owlrunkit project init --workspace <directory> --definition <project.json>
-  owlrunkit project assign --workspace <directory> --assignment-id <id> --at <ISO-UTC> --work-item <id> --agent <id>
+  npx --no-install owlrunkit project init --workspace <directory> --definition <project.json>
+  npx --no-install owlrunkit project assign --workspace <directory> --assignment-id <id> --at <ISO-UTC> --work-item <id> --agent <id>
     [--supersedes <current-assignment-id>] [--execution-run-id <id> --execution-work-item <id>] [--json]
-  owlrunkit project handoff --workspace <directory> --handoff-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project handoff --workspace <directory> --handoff-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id> --from-agent <id> --to-agent <id>
     --summary <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
     --work-item <failed-id> --reviewer-agent <id> --to-agent <id>
     --reason <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project decision --workspace <directory> --open --decision-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project decision --workspace <directory> --open --decision-id <id> --at <ISO-UTC>
     --title <text> --question <text> --owner-agent <id>
     [--blocking-work-item <id> ...] --option <text> [--option <text> ...] [--json]
-  owlrunkit project decision --workspace <directory> --resolve --decision-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project decision --workspace <directory> --resolve --decision-id <id> --at <ISO-UTC>
     --resolution <text> --rationale <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id>
     --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
     --summary <text> [--completed-units <nonnegative-int>]
     [--evidence <ref> ...] [--blocker <ref> ...] [--decision <id> ...]
     [--next <text>] [--source-fingerprint <sha256>] [--json]
-  owlrunkit project verification --workspace <directory> --defer --verification-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project verification --workspace <directory> --defer --verification-id <id> --at <ISO-UTC>
     --work-item <id> --owner-agent <id> --check <check-id> [--check <check-id> ...]
     --reason <text> --due-gate <gate-id> [--json]
-  owlrunkit project verification --workspace <directory> --close --verification-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project verification --workspace <directory> --close --verification-id <id> --at <ISO-UTC>
     --disposition <verified|no_longer_required> --summary <text>
     [--evidence <ref> ...] [--decision <resolved-decision-id> ...] [--json]
-  owlrunkit project integrate --workspace <directory> --gate <gate-id> --at <ISO-UTC>
+  npx --no-install owlrunkit project integrate --workspace <directory> --gate <gate-id> --at <ISO-UTC>
     --summary <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project <checkpoint|handoff|decision|verification|integrate|capture> --workspace <directory> --request <event.json>
-  owlrunkit project status --workspace <directory> [--json]
-  owlrunkit project takeover --workspace <directory> --agent <id> [--json]
-  owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project <checkpoint|handoff|decision|verification|integrate|capture> --workspace <directory> --request <event.json>
+  npx --no-install owlrunkit project target-snapshot --workspace <controller> --snapshot-id <id> --at <ISO-UTC> --work-item <id> --target-workspace <frozen-worktree> --dry-run|--apply
+  npx --no-install owlrunkit project import-delivery --workspace <controller> --delivery-id <id> --at <ISO-UTC> --assignment-id <current> --work-item <id> --producer <id> --target-workspace <frozen-worktree> --packet <delivery-packet.json> --dry-run|--apply
+  npx --no-install owlrunkit project status --workspace <directory> [--json]
+  npx --no-install owlrunkit project takeover --workspace <directory> --agent <id> [--json]
+  npx --no-install owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
     --definition <project.json> --reason <text> [--json]
 
 Project status is derived from durable work items, Agent assignments,
@@ -462,7 +467,7 @@ dependencies, decisions, checkpoints, integration gates, and evidence refs.
 No self-reported percentage is accepted.
 `,
   "project checkpoint": `Usage:
-  owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id>
     --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
     --summary <text> [--completed-units <nonnegative-int>]
@@ -471,27 +476,58 @@ No self-reported percentage is accepted.
 
 Measured WorkItems require --completed-units on every checkpoint. A completed
 checkpoint must use the WorkItem's declared total. Example:
-  owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
+  npx --no-install owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
+`,
+  "project assign": `Usage:
+  npx --no-install owlrunkit project assign --workspace <directory>
+    --assignment-id <id> --at <ISO-UTC> --work-item <id> --agent <id>
+    [--supersedes <current-assignment-id>]
+    [--execution-run-id <id> --execution-work-item <id>] [--json]
+
+Assigns one current WorkItem owner without granting Git, release, deployment,
+production, business, or other authorization.
 `,
   "project reject-and-return": `Usage:
-  owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
     --work-item <failed-id> --reviewer-agent <id> --to-agent <id>
     --reason <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
 
 Atomically records the rejection and opens a new assigned rework attempt. The
 failed attempt remains immutable and evidence-linked. This action does not
 grant Git, release, deployment, production, or business authority.
+`,
+  "project target-snapshot": `Usage:
+  npx --no-install owlrunkit project target-snapshot --workspace <controller>
+    --snapshot-id <id> --at <ISO-UTC> --work-item <id>
+    --target-workspace <frozen-worktree> [--allowed-path <path> ...]
+    --dry-run|--apply [--json]
+
+Captures target HEAD and the visible dirty overlay into the controller project.
+It does not write the target worktree or grant Git, release, deployment,
+production, business, or other authorization.
+`,
+  "project import-delivery": `Usage:
+  npx --no-install owlrunkit project import-delivery --workspace <controller>
+    --delivery-id <id> --at <ISO-UTC> --assignment-id <current>
+    --work-item <id> --producer <id> --target-workspace <frozen-worktree>
+    --packet <delivery-packet.json> [--entry-snapshot <id>]
+    --dry-run|--apply [--json]
+
+Verifies the external DeliveryPacket against the read-only target and records
+candidate identity in Project Driver only with --apply. Without an entry
+snapshot it reports candidate_only and does not claim entry-to-candidate proof.
+No Git, release, deployment, production, business, or other authorization is granted.
 `,
   "project status": `Usage:
-  owlrunkit project status --workspace <directory> [--json]
+  npx --no-install owlrunkit project status --workspace <directory> [--json]
 `,
   "project takeover": `Usage:
-  owlrunkit project takeover --workspace <directory> --agent <id> [--json]
+  npx --no-install owlrunkit project takeover --workspace <directory> --agent <id> [--json]
 
 Builds a read-only blank-session recovery packet for one Agent.
 `,
   "project successor": `Usage:
-  owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
     --definition <project.json> --reason <text> [--json]
 
 Archives one derived-completed active project and installs one fresh active
@@ -525,7 +561,7 @@ function correctedCheckpointCommand(argv, completedUnits) {
     "--completed-units",
     String(completedUnits),
   );
-  return `owlrunkit ${corrected.map(shellCommandToken).join(" ")}`;
+  return `npx --no-install owlrunkit ${corrected.map(shellCommandToken).join(" ")}`;
 }
 
 function formatTeamProjectAssignmentHuman(result) {
@@ -572,6 +608,42 @@ function formatTeamProjectReworkHuman(result) {
   ].join("\n");
 }
 
+function formatTargetSnapshotHuman(result) {
+  return [
+    result.persisted
+      ? `Captured target snapshot ${result.snapshotId}.`
+      : `Previewed target snapshot ${result.snapshotId}; nothing persisted.`,
+    `Target: ${result.targetWorkspaceRef}`,
+    `HEAD: ${result.targetHead}`,
+    `Allowed paths: ${result.allowedPaths.join(", ")}`,
+    "Target write: no; authorization granted: no.",
+    "",
+  ].join("\n");
+}
+
+function formatExternalDeliveryHuman(result) {
+  if (result.status === "external_delivery_rejected") {
+    return [
+      `Rejected external delivery ${result.deliveryId}.`,
+      `Out-of-scope source: ${result.overlay?.outOfScopeSourcePaths?.join(", ") || "none"}`,
+      "Nothing was added to Project Driver; authorization granted: no.",
+      "",
+    ].join("\n");
+  }
+  return [
+    result.persisted
+      ? `Imported external delivery ${result.deliveryId}.`
+      : `Previewed external delivery ${result.deliveryId}; nothing persisted.`,
+    `Candidate: ${result.deliveryCandidateFingerprint}`,
+    `Overlay: ${result.overlay.status}`,
+    `Tool cache changes: ${result.overlay.toolCachePaths.join(", ") || "none"}`,
+    `Dependency environment changes: ${result.overlay.dependencyEnvironmentPaths.join(", ") || "none"}`,
+    `Not proven: ${result.notProven.join(" ")}`,
+    "Target write: no; authorization granted: no.",
+    "",
+  ].join("\n");
+}
+
 function formatTeamProjectDecisionHuman(result) {
   const disposition = result.resumed
     ? "Resumed"
@@ -669,18 +741,18 @@ function onboardingProjection(root, recovery = null) {
   const steps = [
     {
       id: "doctor",
-      command: "owlrunkit doctor --workspace .",
+      command: "npx --no-install owlrunkit doctor --workspace .",
     },
     ...(!profilesReady
       ? [{
           id: "profiles_detect",
-          command: "owlrunkit profiles detect --workspace . --dry-run",
+          command: "npx --no-install owlrunkit profiles detect --workspace . --dry-run",
         }]
       : []),
     ...(!adoptionReady
       ? [{
           id: "adopt_or_start",
-          command: `owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or owlrunkit start`,
+          command: `npx --no-install owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or npx --no-install owlrunkit start`,
         }]
       : []),
   ];
@@ -1378,9 +1450,9 @@ async function initialize(options) {
       `Initialized OwlRunKit ${result.core.coreVersion} in ${result.runtimeRoot}`,
       "",
       "Next:",
-      "1. owlrunkit doctor --workspace .",
-      "2. owlrunkit profiles detect --workspace . --dry-run",
-      `3. owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or owlrunkit start`,
+      "1. npx --no-install owlrunkit doctor --workspace .",
+      "2. npx --no-install owlrunkit profiles detect --workspace . --dry-run",
+      `3. npx --no-install owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or npx --no-install owlrunkit start`,
       "",
     ].join("\n"),
   );
@@ -1680,7 +1752,7 @@ function inspect(options) {
   const onboarding = onboardingProjection(root, recovery);
   const projectDefinitionPath = runtimePath(root, "project", "definition.json");
   const projectDriver = pathEntryExists(projectDefinitionPath)
-    ? readTeamProjectStatusV1({ workspaceRoot: root })
+    ? readTeamProjectStatusV2({ workspaceRoot: root })
     : null;
   const summary = buildInspectSummary(result, {
     maintenanceNextAction: onboarding.maintenanceNextAction ?? null,
@@ -1957,6 +2029,8 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           || command === "start"
           || (command === "formal" && action === "start")
           ? ["owned-path"]
+        : command === "project" && action === "target-snapshot"
+          ? ["allowed-path"]
         : command === "project" && action === "handoff"
           ? ["evidence"]
         : command === "project" && action === "reject-and-return"
@@ -2000,6 +2074,8 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["json", "defer", "close"]
         : command === "project" && new Set(["assign", "handoff", "reject-and-return", "checkpoint", "integrate", "status", "takeover", "successor"]).has(action)
           ? ["json"]
+        : command === "project" && new Set(["target-snapshot", "import-delivery"]).has(action)
+          ? ["json", "dry-run", "apply"]
           : command === "doctor" || command === "adopt" || command === "status"
             ? ["json"]
         : command === "profiles"
@@ -2050,10 +2126,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
     }
     if (command === "assurance") {
       if (action !== "route") {
-        throw new Error("Usage: owlrunkit assurance route --request <risk-facts.json>");
+        throw new Error("Usage: npx --no-install owlrunkit assurance route --request <risk-facts.json>");
       }
       const requestPath = realpathSync(requireOption(options, "request"));
-      return routeRunKitAssuranceV1(readJson(requestPath));
+      return routeRunKitAssuranceV2(readJson(requestPath));
     }
     if (command === "mode") {
       const root = workspace(options);
@@ -2080,7 +2156,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           "risk-category",
           "json",
         ]);
-        const recommendation = recommendUsageModeV1({
+        const recommendation = recommendUsageModeV2({
           workspaceRoot: root,
           requestedMode: options["requested-mode"] ?? "auto",
           needsDurableEvidence: options["needs-evidence"] === true,
@@ -2109,11 +2185,11 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         });
         return options.json === true
           ? recommendation
-          : withHumanOutput(recommendation, formatUsageModeHumanV1(recommendation));
+          : withHumanOutput(recommendation, formatUsageModeHumanV2(recommendation));
       }
       if (action === "status") {
         assertOnlyOptions(options, ["workspace", "json"]);
-        const recommendation = recommendUsageModeV1({
+        const recommendation = recommendUsageModeV2({
           workspaceRoot: root,
           requestedMode: "auto",
           needsDurableEvidence: false,
@@ -2142,9 +2218,9 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         };
         return options.json === true
           ? status
-          : withHumanOutput(status, formatUsageModeHumanV1(status));
+          : withHumanOutput(status, formatUsageModeHumanV2(status));
       }
-      throw new Error("Usage: owlrunkit mode <recommend|status> --workspace <directory>");
+      throw new Error("Usage: npx --no-install owlrunkit mode <recommend|status> --workspace <directory>");
     }
     if (command === "fleet") {
       if (action === "register-root") {
@@ -2187,7 +2263,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         };
       }
       if (action !== "discover") {
-        throw new Error("Usage: owlrunkit fleet <register-root|inspect-registry|replace-registry|rollback-registry|discover>");
+        throw new Error("Usage: npx --no-install owlrunkit fleet <register-root|inspect-registry|replace-registry|rollback-registry|discover>");
       }
       const discovered = await discoverFleet({
         fleetRoots: options["fleet-root"] ?? null,
@@ -2259,7 +2335,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         });
       }
       throw new Error(
-        "Usage: owlrunkit core-successor <plan|apply|resume> [options]",
+        "Usage: npx --no-install owlrunkit core-successor <plan|apply|resume> [options]",
       );
     }
     if (command === "deployment") {
@@ -2692,7 +2768,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           };
         }
       }
-      throw new Error("Usage: owlrunkit deployment <prepare|execute> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit deployment <prepare|execute> [options]");
     }
     if (command === "formal") {
       if (action === "start") {
@@ -2774,7 +2850,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           authorizationGranted: false,
         };
       }
-      throw new Error("Usage: owlrunkit formal <start|check|finish> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit formal <start|check|finish> [options]");
     }
     if (command === "candidate") {
       if (action === "freeze") {
@@ -2814,7 +2890,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           targetWorkspaceRoot: requireOption(options, "target-workspace"),
         });
       }
-      throw new Error("Usage: owlrunkit candidate <freeze|verify|materialize> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit candidate <freeze|verify|materialize> [options]");
     }
     if (command === "start") return startExecution(options);
     if (command === "plan") {
@@ -2874,6 +2950,15 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         ],
         integrate: ["workspace", "request", "gate", "at", "summary", "evidence", "json"],
         capture: ["workspace", "request"],
+        "target-snapshot": [
+          "workspace", "snapshot-id", "at", "work-item", "target-workspace",
+          "allowed-path", "dry-run", "apply", "json",
+        ],
+        "import-delivery": [
+          "workspace", "delivery-id", "at", "assignment-id", "work-item",
+          "producer", "target-workspace", "packet", "entry-snapshot",
+          "dry-run", "apply", "json",
+        ],
         status: ["workspace", "json"],
         takeover: ["workspace", "agent", "json"],
         successor: ["workspace", "transition-id", "at", "definition", "reason", "json"],
@@ -2888,6 +2973,43 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           definition: readJson(realpathSync(requireOption(options, "definition"))),
         });
       }
+      if (action === "target-snapshot") {
+        if ((options.apply === true) === (options["dry-run"] === true)) {
+          throw new Error("project target-snapshot requires exactly one of --dry-run or --apply.");
+        }
+        const captured = captureTargetWorkspaceSnapshotV1({
+          controllerWorkspaceRoot: root,
+          snapshotId: requireOption(options, "snapshot-id"),
+          occurredAt: requireOption(options, "at"),
+          workItemId: requireOption(options, "work-item"),
+          targetWorkspaceRoot: requireOption(options, "target-workspace"),
+          allowedPaths: options["allowed-path"],
+          apply: options.apply === true,
+        });
+        return options.json === true
+          ? captured
+          : withHumanOutput(captured, formatTargetSnapshotHuman(captured));
+      }
+      if (action === "import-delivery") {
+        if ((options.apply === true) === (options["dry-run"] === true)) {
+          throw new Error("project import-delivery requires exactly one of --dry-run or --apply.");
+        }
+        const imported = importExternalDeliveryV1({
+          controllerWorkspaceRoot: root,
+          deliveryId: requireOption(options, "delivery-id"),
+          occurredAt: requireOption(options, "at"),
+          assignmentId: requireOption(options, "assignment-id"),
+          workItemId: requireOption(options, "work-item"),
+          producerId: requireOption(options, "producer"),
+          targetWorkspaceRoot: requireOption(options, "target-workspace"),
+          packetPath: requireOption(options, "packet"),
+          entrySnapshotId: options["entry-snapshot"] ?? null,
+          apply: options.apply === true,
+        });
+        return options.json === true
+          ? imported
+          : withHumanOutput(imported, formatExternalDeliveryHuman(imported));
+      }
       if (action === "assign") {
         const directAssignmentFields = [
           "assignment-id",
@@ -2905,9 +3027,13 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           throw new Error("--request cannot be combined with direct assignment fields.");
         }
         if (options.request !== undefined) {
+          const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+          if (requestedEvent?.type !== "agent_assigned") {
+            throw new Error("Project assign request only accepts type=agent_assigned.");
+          }
           return appendTeamProjectEventV1({
             workspaceRoot: root,
-            event: readJson(realpathSync(requireOption(options, "request"))),
+            event: requestedEvent,
           });
         }
         const assigned = assignTeamProjectV1({
@@ -2943,9 +3069,13 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           throw new Error("--request cannot be combined with direct handoff fields.");
         }
         if (options.request !== undefined) {
+          const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+          if (requestedEvent?.type !== "handoff_recorded") {
+            throw new Error("Project handoff request only accepts type=handoff_recorded.");
+          }
           return appendTeamProjectEventV1({
             workspaceRoot: root,
-            event: readJson(realpathSync(requireOption(options, "request"))),
+            event: requestedEvent,
           });
         }
         const handedOff = handoffTeamProjectV1({
@@ -3002,9 +3132,16 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           throw new Error("--request cannot be combined with direct decision fields.");
         }
         if (options.request !== undefined) {
+          const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+          if (!new Set(["decision_opened", "decision_resolved"])
+            .has(requestedEvent?.type)) {
+            throw new Error(
+              "Project decision request only accepts type=decision_opened or decision_resolved.",
+            );
+          }
           return appendTeamProjectEventV1({
             workspaceRoot: root,
-            event: readJson(realpathSync(requireOption(options, "request"))),
+            event: requestedEvent,
           });
         }
         if (options.open === options.resolve) {
@@ -3205,7 +3342,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         } catch (error) {
           if (error instanceof Error
             && error.message === "Measured work item checkpoint requires completedUnits.") {
-            const projectStatus = readTeamProjectStatusV1({ workspaceRoot: root });
+            const projectStatus = readTeamProjectStatusV2({ workspaceRoot: root });
             const workItem = projectStatus.workItems.find((row) => row.workItemId === workItemId);
             const suggestedUnits = state === "completed"
               ? workItem?.progress.total
@@ -3257,25 +3394,31 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           : withHumanOutput(integrated, formatTeamProjectIntegrationHuman(integrated));
       }
       if (new Set(["checkpoint", "capture"]).has(action)) {
+        const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+        if (requestedEvent?.type === "source_delivery_imported") {
+          throw new Error(
+            "External source delivery events require verified intake; use project import-delivery.",
+          );
+        }
         return appendTeamProjectEventV1({
           workspaceRoot: root,
-          event: readJson(realpathSync(requireOption(options, "request"))),
+          event: requestedEvent,
         });
       }
       if (action === "status") {
-        const status = readTeamProjectStatusV1({ workspaceRoot: root });
+        const status = readTeamProjectStatusV2({ workspaceRoot: root });
         return options.json === true
           ? status
-          : withHumanOutput(status, formatTeamProjectStatusHumanV1(status));
+          : withHumanOutput(status, formatTeamProjectStatusHumanV2(status));
       }
       if (action === "takeover") {
-        const takeover = buildTeamProjectTakeoverV1({
+        const takeover = buildTeamProjectTakeoverV2({
           workspaceRoot: root,
           agentId: requireOption(options, "agent"),
         });
         return options.json === true
           ? takeover
-          : withHumanOutput(takeover, formatTeamProjectTakeoverHumanV1(takeover));
+          : withHumanOutput(takeover, formatTeamProjectTakeoverHumanV2(takeover));
       }
       if (action === "successor") {
         const successor = successorTeamProjectV1({
@@ -3290,7 +3433,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? successor
           : withHumanOutput(successor, formatTeamProjectSuccessorHumanV1(successor));
       }
-      throw new Error("Usage: owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|integrate|capture|status|takeover|successor> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|integrate|capture|target-snapshot|import-delivery|status|takeover|successor> [options]");
     }
     if (command === "profiles") {
       const root = requireOption(options, "workspace");
@@ -3298,12 +3441,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         if (options.apply === true && options["dry-run"] === true) {
           throw new Error("profiles detect accepts either --apply or --dry-run, not both.");
         }
-        if (options["dry-run"] === true) {
-          return detectProfiles({ workspaceRoot: root });
-        }
-        const detection = detectProfilesV2({ workspaceRoot: root });
+        if (options["dry-run"] === true) return detectProfilesV3({ workspaceRoot: root });
+        const detection = detectProfilesV3({ workspaceRoot: root });
         return options.apply === true
-          ? applyDetectedProfilesV2({ workspaceRoot: root, detection })
+          ? applyDetectedProfilesV3({ workspaceRoot: root, detection })
           : detection;
       }
       if (action === "reconcile") {
@@ -3324,7 +3465,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         if (changedPaths.length === 0) throw new Error("profiles impact requires --changed.");
         return resolveProfilesImpact({ workspaceRoot: root, changedPaths });
       }
-      throw new Error("Usage: owlrunkit profiles <detect|reconcile|validate|impact> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit profiles <detect|reconcile|validate|impact> [options]");
     }
     if (command === "lease") {
       const root = workspace(options);
@@ -3419,9 +3560,6 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       };
     }
     if (command === "quick-metrics") {
-      if (options.local !== true) {
-        throw new Error("Quick metrics requires --local; network telemetry is not available.");
-      }
       const local = readLocalQuickMetrics(workspace(options), {
         verbose: options.verbose === true,
       });
@@ -3487,7 +3625,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       return withControlTransaction(root, () => closeout(options));
     }
     if (command === "finish") return finishExecution(options);
-    throw new Error("Usage: owlrunkit <init|doctor|adopt|mode|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-attest|quick-metrics|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
+    throw new Error("Usage: npx --no-install owlrunkit <init|doctor|adopt|mode|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-attest|quick-metrics|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
   } catch (error) {
     return {
       status: "invalid_input",