owlrunkit 0.18.3 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## 0.19.0
+
+- Adds `bootstrap --dry-run|--apply` as one exact-registry, project-local,
+  lifecycle-locked onboarding transaction. It initializes or upgrades Core,
+  reconciles and validates profiles, adopts the release, runs doctor, and
+  restores its bounded preimage on failure without refreshing shared Skills.
+- Makes first-use help and empty-profile repair actionable, and reports the
+  installed package/Core/Skill identity independently instead of accepting a
+  matching version string with drifted Core bytes.
+- Runs Quick commands in an isolated temporary consumer with bounded dependency
+  projection and tool-cache directories, separating workspace source changes,
+  requested ignored-artifact bindings, and dependency-environment identity.
+- Adds `quick-reuse` planning and execution for a passed prior receipt plus an
+  explicitly allowed small delta. Reuse fails closed on prior candidate,
+  command, dependency, ignored-binding, or out-of-scope path drift.
+- Stores repeated Quick and Verification Envelope stdout/stderr as verified
+  content-addressed evidence objects while retaining the existing receipt-local
+  references and create-only receipt semantics.
+- Adds `quick-runtime-verify` with explicit workspace mutation, external
+  mutation, rollback, final external state, failed/last-passed stage, and
+  recovery lineage fields. Command-reported runtime truth remains distinct from
+  independent deployment or business acceptance.
+- Adds Project Event V4 actions for reopening or invalidating upstream work,
+  propagating downstream waiting, and atomically transferring responsibility.
+  Immutable prior failures, assignments, handoffs, and evidence remain visible.
+- Adds a six-layer human outcome projection that separates candidate identity,
+  workspace attestation, verification, product/UX acceptance, deployment/runtime
+  activation, and production/business validity; lower layers never promote the
+  higher ones automatically.
+- Adds local-only `efficiency record|status` metrics for repeated commands,
+  explicit false blocks and manual interventions, handoff wait, and
+  time-to-acceptable-result. Receipt count is intentionally not a success
+  metric and no telemetry is sent.
+- Preserves the independent continuity and assurance axes, mandatory Formal
+  risk routing, strict predecessor contracts, and
+  `authorizationGranted=false` for Git, release, deployment, production, and
+  business authority.
+
+## 0.18.4
+
+- Adds controller-owned `project target-snapshot --dry-run|--apply` for binding
+  an immutable target HEAD, visible dirty overlay, WorkItem path boundary, and
+  full workspace fingerprint without writing the frozen target worktree.
+- Adds `project import-delivery --dry-run|--apply` for verifying an external
+  DeliveryPacket against that target and recording exact candidate identity in
+  Project Driver through append-only Event V3.
+- Distinguishes an attested entry-to-candidate overlay from `candidate_only`
+  intake when no entry snapshot exists, so current candidate verification is
+  never overstated as historical delta proof.
+- Classifies visible tool-cache and dependency-environment changes separately
+  while rejecting packet paths outside WorkItem ownership and any unclassified
+  source delta before project truth is written.
+- Documents project-local `npx --no-install owlrunkit` as the normal command
+  surface and treats an older global CLI or process-level Skill as version
+  drift, not as authority to reinterpret a newer project.
+- Makes `profiles detect --dry-run` return the V3 contract with real visible
+  changed paths, `profiles_insufficient` when source coverage is incomplete,
+  a minimal suggested profile, and copyable preview/apply repair commands.
+- Emits Status/Takeover V2 and extends takeover with stale-handoff reasons plus
+  the current external delivery and exact per-file delta from its predecessor,
+  while retaining the one-screen human projection.
+- Emits Assurance Route V2 and Usage Mode Recommendation V2 with project-local
+  commands. The published Profile Detection V2, Status/Takeover V1, Assurance
+  Route V1, and Usage Mode Recommendation V1 contracts remain unchanged for
+  existing consumers.
+- Adds action-specific `project assign --help` and makes `quick-metrics`
+  local-by-default without requiring `--local`; the old flag remains an
+  accepted compatibility no-op.
+- Requires disjoint controller and target workspaces, binds only an exact Git
+  worktree root, brackets DeliveryPacket verification with stable target
+  snapshots, and rejects base-identity drift plus both sides of any
+  cross-boundary rename.
+- Reserves Event V3 for verified `import-delivery` intake so legacy raw request
+  actions cannot inject external-delivery truth without checking target bytes.
+- Revalidates Git-visible changed paths between profile detection and apply;
+  Git-status failure and rename-source coverage now fail closed instead of
+  appearing as a high-confidence empty candidate.
+- Keeps target writes and every Git, release, deployment, production, UX, and
+  business authorization flag false.
+
 ## 0.18.3
 
 - Adds `quick-verify --stdin-file <file>` so a local or remote verification

package/README.md

@@ -21,6 +21,30 @@ actionable-only receipt issues, optional one-command attestation, and concise
 metrics by default. It also adds one atomic failed-work return path and makes
 the bundled Skill's contract references self-contained.
 
+RunKit 0.18.4 lets one controller project bind a separate frozen target
+worktree without installing dependencies or `.owlcoda` into that target. It
+captures an immutable entry snapshot, verifies an external DeliveryPacket,
+classifies visible dirty-overlay changes, and imports the candidate identity
+into Project Driver. Missing entry truth is reported as `candidate_only`, not
+as an attested delta. Tool-cache and dependency-environment changes are
+disclosed separately; unclassified source changes fail closed. The release
+also makes project-local `npx --no-install owlrunkit` the documented command
+surface so an older global binary cannot reinterpret newer project truth.
+Profile detection now exposes real uncovered source paths and copyable repair
+commands instead of reporting a non-actionable success. Takeover reports stale
+handoffs and the exact current-versus-previous external candidate delta.
+These additions use Profile Detection V3, Status/Takeover V2, Assurance Route
+V2, and Usage Mode Recommendation V2; the published predecessor contracts
+remain unchanged.
+
+RunKit 0.19.0 consolidates the daily-use dogfood backlog into one release. It
+adds atomic onboarding, isolated Quick dependency/cache execution, bounded
+reuse of unchanged evidence, content-addressed output storage, explicit
+external-runtime and rollback truth, upstream rework propagation, atomic
+transfer actions, business-layer outcome projection, and local efficiency
+metrics. These conveniences do not weaken Formal routing or grant Git,
+release, deployment, production, or business authority.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -35,10 +59,11 @@ separate authority boundaries.
 ## Install
 
 ```bash
-npm install --save-exact owlrunkit@0.18.3
+npm install --save-exact owlrunkit@0.19.0
 ```
 
-The `owlrunkit` bootstrap uses the project's exact locally bound CLI for
+Use `npx --no-install owlrunkit` for project commands. The package bootstrap
+uses the project's exact locally bound CLI for
 ordinary project commands. The installed current package remains responsible
 for bootstrap operations such as initialization, adoption, and Core successor
 migration, so a global CLI does not reinterpret an older project's control
@@ -48,13 +73,24 @@ the current bootstrap Core or its embedded prior-release identity catalog, and
 the project Config must independently bind the same Core.
 
 ```bash
-owlrunkit --version
-owlrunkit init --workspace /absolute/path/to/project
-owlrunkit doctor --workspace /absolute/path/to/project
-owlrunkit mode recommend --workspace /absolute/path/to/project
-owlrunkit mode status --workspace /absolute/path/to/project
+npx --no-install owlrunkit --version
+npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
+  --exact owlrunkit@0.19.0 --dry-run
+npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
+  --exact owlrunkit@0.19.0 --apply
+npx --no-install owlrunkit init --workspace /absolute/path/to/project
+npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
+npx --no-install owlrunkit mode recommend --workspace /absolute/path/to/project
+npx --no-install owlrunkit mode status --workspace /absolute/path/to/project
 ```
 
+`bootstrap` is the complete first-onboarding and eligible idle-upgrade entry.
+It binds the exact project-local package to the official registry, initializes
+Core, reconciles and validates profiles, writes adoption evidence, and reads
+back doctor. Dry-run is zero-write; failed apply restores the governed preimage
+and keeps a failure receipt. It reports shared Skill drift but never silently
+updates a user or fleet Skill.
+
 `mode recommend` is read-only and defaults to human output; add `--json` for a
 machine contract. The five user modes are presets over `continuity`
 (`none | project_driver`) and `assurance` (`none | quick | formal`). They never
@@ -69,59 +105,59 @@ status, and takeover flow:
 
 ```bash
 cp node_modules/owlrunkit/scripts/runkit-contract/templates/team-project-definition.json ./project-definition.json
-owlrunkit project init --workspace . \
+npx --no-install owlrunkit project init --workspace . \
   --definition ./project-definition.json
-owlrunkit project assign --workspace . --assignment-id assign-1 \
+npx --no-install owlrunkit project assign --workspace . --assignment-id assign-1 \
   --at 2026-08-09T00:00:00.000Z --work-item work-item-1 --agent agent-runtime
-owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-1 \
+npx --no-install owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-1 \
   --at 2026-08-09T00:05:00.000Z --assignment-id assign-1 --work-item work-item-1 \
   --state active --summary 'Implement the bounded work item' \
   --completed-units 0 \
   --next 'Run the focused verification'
-owlrunkit project handoff --workspace . --handoff-id handoff-1 \
+npx --no-install owlrunkit project handoff --workspace . --handoff-id handoff-1 \
   --at 2026-08-09T00:10:00.000Z --assignment-id assign-1 --work-item work-item-1 \
   --from-agent agent-runtime --to-agent agent-successor \
   --summary 'Source work is ready for continuation' --next 'Run verification' \
   --evidence evidence/source.txt
 # If review instead rejects a failed checkpoint, preserve it and open rework
 # without first mutating the WorkItem back to active:
-owlrunkit project reject-and-return --workspace . --rework-id review-1 \
+npx --no-install owlrunkit project reject-and-return --workspace . --rework-id review-1 \
   --at 2026-08-09T00:10:30.000Z --work-item work-item-1 \
   --reviewer-agent agent-control --to-agent agent-runtime \
   --reason 'The candidate violates its versioned contract' \
   --next 'Repair the contract and rerun the focused check' \
   --evidence evidence/rejected-review.txt
-owlrunkit project assign --workspace . --assignment-id assign-2 \
+npx --no-install owlrunkit project assign --workspace . --assignment-id assign-2 \
   --at 2026-08-09T00:11:00.000Z --work-item work-item-1 \
   --agent agent-successor --supersedes assign-1
-owlrunkit project decision --workspace . --open --decision-id decision-1 \
+npx --no-install owlrunkit project decision --workspace . --open --decision-id decision-1 \
   --at 2026-08-09T00:12:00.000Z --title 'Choose the accepted source path' \
   --question 'Which source path should continue?' --owner-agent agent-successor \
   --blocking-work-item work-item-1 --option accepted --option rejected
-owlrunkit project decision --workspace . --resolve --decision-id decision-1 \
+npx --no-install owlrunkit project decision --workspace . --resolve --decision-id decision-1 \
   --at 2026-08-09T00:13:00.000Z --resolution 'Use the accepted source path' \
   --rationale 'It preserves the project contract' --evidence evidence/decision.txt
-owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-2 \
+npx --no-install owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-2 \
   --at 2026-08-09T00:14:00.000Z --assignment-id assign-2 \
   --work-item work-item-1 --state completed --completed-units 1 \
   --summary 'Accepted work is complete' --evidence evidence/completion.txt
-owlrunkit project verification --workspace . --defer \
+npx --no-install owlrunkit project verification --workspace . --defer \
   --verification-id release-batch --at 2026-08-09T00:14:30.000Z \
   --work-item work-item-1 --owner-agent agent-successor \
   --check typecheck --check full-suite --check package-smoke \
   --reason 'Run broad checks once after the related changes settle' \
   --due-gate integration-ready
 # After those checks run once against the frozen candidate:
-owlrunkit project verification --workspace . --close \
+npx --no-install owlrunkit project verification --workspace . --close \
   --verification-id release-batch --at 2026-08-09T00:14:45.000Z \
   --disposition verified --summary 'The batched release checks passed' \
   --evidence evidence/release-batch.txt
-owlrunkit project integrate --workspace . --gate integration-ready \
+npx --no-install owlrunkit project integrate --workspace . --gate integration-ready \
   --at 2026-08-09T00:15:00.000Z --summary 'Integration gate evidence is complete' \
   --evidence evidence/integration.txt
-owlrunkit project status --workspace .
-owlrunkit project takeover --workspace . --agent agent-successor
-owlrunkit project successor --workspace . --transition-id project-next-001 \
+npx --no-install owlrunkit project status --workspace .
+npx --no-install owlrunkit project takeover --workspace . --agent agent-successor
+npx --no-install owlrunkit project successor --workspace . --transition-id project-next-001 \
   --at 2026-08-09T00:16:00.000Z --definition ./next-project-definition.json \
   --reason 'Archive the completed project and begin the next bounded project'
 ```
@@ -141,6 +177,47 @@ the reviewer, evidence, target Agent, and new assignment. The failed checkpoint
 remains immutable; status and takeover expose the rework relation and attempt.
 The command is not a Git rejection, merge action, or release authorization.
 
+### Import a frozen external source lane
+
+Capture the target before delegating source work, then import the producer's
+DeliveryPacket after it freezes the candidate:
+
+```bash
+npx --no-install owlrunkit project target-snapshot --workspace . \
+  --snapshot-id w2-5-entry --at 2026-08-12T08:00:00.000Z \
+  --work-item work-item-1 --target-workspace /absolute/frozen/worktree --apply
+
+npx --no-install owlrunkit project import-delivery --workspace . \
+  --delivery-id w2-5-luna --at 2026-08-12T09:00:00.000Z \
+  --assignment-id assign-1 --work-item work-item-1 --producer luna-max \
+  --target-workspace /absolute/frozen/worktree \
+  --packet /absolute/delivery-packet.json \
+  --entry-snapshot w2-5-entry --apply
+```
+
+Both commands support `--dry-run` instead of `--apply`. Artifacts are written
+only under the controller's `.owlcoda/runkit/project`; the target is read-only.
+Controller and target must be disjoint real directories, and the target must
+be the exact Git worktree root rather than a nested repository directory.
+The imported Event V3 records `deliveryCandidateFingerprint`,
+`workspaceSnapshotFingerprint`, target HEAD, candidate file hashes, overlay
+classification, and explicit `proven` / `notProven` statements. Omitting
+`--entry-snapshot` verifies the current candidate bytes but records
+`overlayStatus=candidate_only`.
+
+External-delivery intake cache classification covers paths visible to Git status, such as
+`.vitest/**`, `.vite/**`, `.pytest_cache/**`, and `__pycache__/**`. It does not
+claim to bind ignored paths (`ignoredPathsBound=false`) and does not create a
+Quick isolated consumer. Lockfile or
+`node_modules` changes outside the packet are disclosed as dependency
+environment changes. Any other entry-to-candidate delta, or any packet path
+outside the WorkItem's allowed ownership, blocks import before project truth is
+written. This includes the deleted source side of a Git rename; changing target
+HEAD, tracked tree, or submodule identity also blocks overlay attestation.
+Event V3 can be created only by this verified intake path, not a legacy raw
+project request. No imported delivery grants Git, release, deployment,
+production, UX, or business acceptance.
+
 `project verification --defer` is a small deferred-verification ledger, not a
 test scheduler. It records stable check IDs, why they were intentionally not
 run yet, the responsible Agent, and the integration gate before which they
@@ -178,6 +255,11 @@ WorkItem. An assignment may bind an exact RunKit execution and lease; in that
 case, the WorkItem cannot complete until the execution has a trusted accepted
 closeout and its lease is released.
 
+`project takeover` adds the current candidate, its exact added/changed/removed
+path delta from the previous imported delivery, and handoffs that are stale
+because later project truth superseded them. These are read-only projections;
+they do not reopen work or grant writer authority.
+
 The Agent-facing natural actions are stable: split and assign work, report
 status, open or resolve a decision, hand off, take over, capture evidence, and
 verify. The CLI is the durable implementation surface; users can keep speaking
@@ -189,11 +271,11 @@ Preview deterministic, project-local commands, or atomically adopt only
 high-confidence candidates:
 
 ```bash
-owlrunkit profiles detect --workspace . --dry-run
-owlrunkit profiles detect --workspace . --apply
-owlrunkit profiles reconcile --workspace . --dry-run
-owlrunkit profiles reconcile --workspace . --apply
-owlrunkit profiles validate --workspace .
+npx --no-install owlrunkit profiles detect --workspace . --dry-run
+npx --no-install owlrunkit profiles detect --workspace . --apply
+npx --no-install owlrunkit profiles reconcile --workspace . --dry-run
+npx --no-install owlrunkit profiles reconcile --workspace . --apply
+npx --no-install owlrunkit profiles validate --workspace .
 ```
 
 `profiles detect --apply` is create-only. `profiles reconcile` previews or
@@ -205,12 +287,21 @@ launchers. A PATH-only package manager remains review-required. A dry-run that
 only canonicalizes JSON formatting reports `normalizationOnly: true` instead of
 showing unexplained hash drift with an empty update list.
 
+The dry-run is the V2 detection contract. It reports `profiles_insufficient`
+instead of `profiles_detected` when Git-visible source paths are uncovered or
+no actionable primary exists. `changedPaths`, `uncoveredSourcePaths`,
+`primaryBlockers`, `minimalSuggestedProfile`, and `repairCommands` explain the
+gap using only real project surfaces; absent conventional `src/` or `tests/`
+directories are never invented as blockers. Detection records both sides of a
+Git rename, reports Git-status failure, and rechecks the exact changed-path set
+before apply so a stale dry-run cannot write incomplete coverage.
+
 ## Choose auto, off, light, managed, or formal
 
 Start with the human-first read-only recommendation:
 
 ```bash
-owlrunkit mode recommend --workspace .
+npx --no-install owlrunkit mode recommend --workspace .
 ```
 
 - **off / No RunKit** uses neither continuity nor assurance for analysis,
@@ -231,7 +322,7 @@ recommendation; escalation is not sticky.
 Machine integrations may route an explicit risk-facts document directly:
 
 ```bash
-owlrunkit assurance route --workspace . \
+npx --no-install owlrunkit assurance route --workspace . \
   --request ./scripts/runkit-contract/templates/assurance-request.json
 ```
 
@@ -245,11 +336,22 @@ grant Git, release, publish, deploy, or business authority.
 Run Quick with:
 
 ```bash
-owlrunkit quick-verify --workspace . -- npm test
-owlrunkit quick-verify --workspace . --stdin-file ./remote-check.sh --attest \
+npx --no-install owlrunkit quick-verify --workspace . -- npm test
+npx --no-install owlrunkit quick-verify --workspace . --stdin-file ./remote-check.sh --attest \
   -- ssh test-host /bin/sh
-owlrunkit quick-metrics --workspace . --local
-owlrunkit quick-metrics --workspace . --local --verbose
+npx --no-install owlrunkit quick-verify --workspace . --isolate \
+  --dependency-root /absolute/dependency-consumer -- npm test
+npx --no-install owlrunkit quick-verify --workspace . \
+  --bind-ignored .generated/audit.json -- node ./verify-generated.mjs
+npx --no-install owlrunkit quick-reuse --workspace . \
+  --base-receipt .owlcoda/runkit/quick/receipts/<id>/receipt.json \
+  --allow-path src/new-adapter.mjs --dry-run -- node --test tests/new-adapter.test.mjs
+npx --no-install owlrunkit quick-verify --workspace . --capture-runtime \
+  -- ./deploy-and-readback.sh
+npx --no-install owlrunkit quick-runtime-verify --workspace . \
+  --receipt .owlcoda/runkit/quick/receipts/<id>/runtime-transition.json
+npx --no-install owlrunkit quick-metrics --workspace .
+npx --no-install owlrunkit quick-metrics --workspace . --verbose
 ```
 
 `--stdin-file` accepts a regular non-symlink file up to 1 MiB, copies its exact
@@ -261,12 +363,81 @@ restore phases remain visible while the complete artifacts stay receipt-bound.
 `--attest` runs the existing attestation immediately and returns its independent
 object alongside the Quick result; it does not promote Quick to Formal.
 
-`quick-metrics --local` returns aggregate counts only. Add `--verbose` when the
-individual receipt paths are needed. New successful receipts no longer carry
+`--isolate` emits Quick Receipt V3 and runs the exact command from a disposable
+copy of Git-visible candidate files. Common cache variables and temporary files
+point outside the source checkout; new ignored artifacts are disclosed and
+discarded, while a visible source edit in the consumer invalidates the receipt.
+The exact caller-owned command is not an OS write sandbox; direct writes it
+performs outside the consumer remain subject to the explicit before/after
+bindings.
+An optional `--dependency-root` projects an already-installed `node_modules`
+into the consumer, prepends its binary directory, and hash-binds package, lock,
+installed-package, and executable metadata before and after execution. RunKit
+does not install dependencies or contact a registry for this command.
+
+Repeatable literal `--bind-ignored` paths opt specific ignored workspace bytes
+into Workspace Snapshot V2. Missing is a bound state; file or directory changes
+invalidate Quick. Unrequested ignored paths remain explicitly outside the
+claim. V1/V2 receipts and Workspace Snapshot V1 keep their existing meanings.
+
+`quick-reuse` checks an earlier passed, source-unchanged Quick receipt against
+the current candidate at byte level. A clean commit does not create false drift
+when it preserves the previously dirty candidate bytes. Only literal
+`--allow-path` deltas may remain; any other tracked, untracked, deleted,
+renamed, submodule, or previously bound ignored-path delta blocks before the
+exact command runs. `--apply` then runs only the delta gate and records
+`OwlCodaQuickEvidenceReuseReceiptV1`. It does not promote either Quick receipt
+to Formal, UX, deployment, production, or business acceptance.
+
+New Quick output and Verification Envelope stdout/stderr bytes are also placed
+in a project-global create-only SHA-256 object store. Repeated objects reuse the
+same content identity; receipt-local Quick paths remain readable through
+copy-on-write materialization, and historical receipt paths are not rewritten
+or destructively compacted.
+
+`--capture-runtime` sets `OWLRUNKIT_RUNTIME_REPORT` to an initially absent,
+receipt-local path. The exact command may write one strict
+`OwlCodaRunKitExternalRuntimeReportV1`; RunKit then keeps the ordinary Quick
+receipt and adds an `OwlCodaRunKitRuntimeTransitionReceiptV1`. The companion
+separates derived `workspaceMutation` from command-reported
+`externalMutation`, and binds ordered stages, failed/last-passed stages,
+rollback, final external state, and recovery artifacts with explicit
+`capturedBefore` and `restoresTo` identities. Missing or inconsistent runtime
+truth fails closed without erasing the Quick receipt. This is a hash-bound
+command report, not an independent external observation or deployment
+authorization; `quick-runtime-verify` verifies stored integrity only.
+
+`quick-metrics` is local-only and returns aggregate counts. Add `--verbose`
+when the individual receipt paths are needed. The former `--local` flag remains
+accepted as a compatibility no-op. New successful receipts no longer carry
 the fixed `quick_ignored_artifact_unbound` issue; historical receipts remain
 strictly readable without surfacing that non-actionable code as an attestation
 issue.
 
+Quick's default human result is business-first: it says whether the exact
+verification passed, what candidate/workspace evidence is bound, and keeps
+product/UX, deployment/runtime, and production/business acceptance visibly
+separate. A command-reported runtime transition is labeled as reported rather
+than independently observed. Use `--json` for the strict
+`OwlCodaRunKitOutcomeSummaryV1` projection.
+
+RunKit can measure its own local workflow friction without telemetry:
+
+```bash
+npx --no-install owlrunkit efficiency record --workspace . \
+  --event-id wave-start --at 2026-08-13T00:00:00.000Z \
+  --kind workflow_started --workflow-id wave-1 --summary 'Wave started.'
+npx --no-install owlrunkit efficiency status --workspace .
+npx --no-install owlrunkit efficiency status --workspace . --verbose --json
+```
+
+Repeated Quick command executions are derived from matching command, candidate,
+input, and dependency bindings. False blocks and manual interventions count
+only when explicitly recorded. Handoff wait comes from Project Driver truth;
+time-to-acceptable-result requires paired workflow start/result marks. Receipt
+volume is intentionally not a value metric, and every result keeps Git,
+release, deployment, production, and business authority false.
+
 ## Formal Delivery in three commands
 
 Given a Goal Contract and the paths this work item may write, the happy path is:
@@ -274,13 +445,13 @@ Given a Goal Contract and the paths this work item may write, the happy path is:
 ```bash
 NODE_BIN="$(node -p 'process.execPath')"
 
-owlrunkit formal start --workspace . --run-id release-001 \
+npx --no-install owlrunkit formal start --workspace . --run-id release-001 \
   --goal .owlcoda/runkit/goal.json --owned-path 'src/**'
 
-owlrunkit formal check --workspace . --run-id release-001 \
+npx --no-install owlrunkit formal check --workspace . --run-id release-001 \
   --check-id source-syntax -- "$NODE_BIN" --check src/index.js
 
-owlrunkit formal finish --workspace . --run-id release-001 \
+npx --no-install owlrunkit formal finish --workspace . --run-id release-001 \
   --decision accepted
 ```
 
@@ -296,7 +467,7 @@ Formal also accepts a real project command through an enforced Verification
 Envelope:
 
 ```bash
-owlrunkit formal check --workspace . --run-id release-001 \
+npx --no-install owlrunkit formal check --workspace . --run-id release-001 \
   --work-item delivery --check-id project-tests \
   --envelope scripts/runkit-contract/templates/verification-envelope.json
 ```
@@ -311,7 +482,7 @@ the policy, the command is not run and no Formal acceptance is possible.
 Existing legacy verification may still capture evidence, but it is not silently
 promoted into this Formal path.
 
-Use `owlrunkit status --workspace .` for a concise human view of what is ready,
+Use `npx --no-install owlrunkit status --workspace .` for a concise human view of what is ready,
 what has not happened, how many gates remain, and the next allowed action.
 
 ## Freeze a dirty worktree safely
@@ -321,11 +492,11 @@ artifact. It binds the baseline, exact owned-path closure, source manifest,
 and payload bytes without requiring a Git commit.
 
 ```bash
-owlrunkit candidate freeze --workspace . --run-id release-001 \
+npx --no-install owlrunkit candidate freeze --workspace . --run-id release-001 \
   --from-lease delivery --candidate-id rc-001
-owlrunkit candidate verify --workspace . \
+npx --no-install owlrunkit candidate verify --workspace . \
   --candidate .owlcoda/runkit/executions/release-001/source-candidates/rc-001.json
-owlrunkit candidate materialize --workspace . \
+npx --no-install owlrunkit candidate materialize --workspace . \
   --candidate .owlcoda/runkit/executions/release-001/source-candidates/rc-001.json \
   --target-workspace /absolute/clean/materialization
 ```
@@ -344,10 +515,10 @@ Register every coverage root once. Later discovery and process-wide migration
 commands use the persistent registry automatically:
 
 ```bash
-owlrunkit fleet register-root --fleet-root /absolute/projects
-owlrunkit fleet register-root --fleet-root /absolute/other-projects
-owlrunkit fleet inspect-registry
-owlrunkit fleet discover
+npx --no-install owlrunkit fleet register-root --fleet-root /absolute/projects
+npx --no-install owlrunkit fleet register-root --fleet-root /absolute/other-projects
+npx --no-install owlrunkit fleet inspect-registry
+npx --no-install owlrunkit fleet discover
 ```
 
 The registry lives under the user-owned OwlCoda home. Initial discovery stops
@@ -372,10 +543,10 @@ Core successor separates an immutable candidate and fleet-wide plan from the
 Owner-authorized migration:
 
 ```bash
-owlrunkit core-successor plan --workspace . --plan-id core-016 \
+npx --no-install owlrunkit core-successor plan --workspace . --plan-id core-016 \
   --run-id release-001 --from-lease delivery --candidate-id rc-001
 
-owlrunkit core-successor apply --workspace . \
+npx --no-install owlrunkit core-successor apply --workspace . \
   --plan .owlcoda/runkit/core-successors/core-016/plan.json \
   --owner-authority ./owner-core-successor-authority.json \
   --receipt-id core-016-apply
@@ -395,19 +566,19 @@ Build and verification stay separate from the later permission to change a
 machine:
 
 ```bash
-owlrunkit deployment prepare --workspace . --run-id build-001 \
+npx --no-install owlrunkit deployment prepare --workspace . --run-id build-001 \
   --artifact dist/app.tgz --media-type application/gzip \
   --owner-decision ./owner-deployment-decision.json \
   --output .owlcoda/runkit/deployments/app-prepare.json
 
-owlrunkit deployment execute --workspace . \
+npx --no-install owlrunkit deployment execute --workspace . \
   --prepare .owlcoda/runkit/deployments/app-prepare.json \
   --owner-decision ./owner-deployment-decision.json \
   --owner-authority ./deployment-owner-authority.json \
   --manifest ./remote-deployment-manifest.json
 
 # Resume the automatic child after an interrupted or indeterminate stage.
-owlrunkit deployment execute --workspace . --resume \
+npx --no-install owlrunkit deployment execute --workspace . --resume \
   --prepare .owlcoda/runkit/deployments/app-prepare.json \
   --owner-decision ./owner-deployment-decision.json \
   --owner-authority ./deployment-owner-authority.json \