owlrunkit 0.18.3 → 0.19.0

package/scripts/runkit-contract/runkit-cli.mjs

@@ -79,16 +79,26 @@ import {
 import { buildInspectSummary, formatInspectHuman } from "./inspect-presentation.mjs";
 import { attestQuickReceiptDetails } from "./quick-attest.mjs";
 import { readLocalQuickMetrics } from "./quick-metrics.mjs";
+import { runQuickEvidenceReuse } from "./quick-evidence-reuse.mjs";
 import { runQuickVerification } from "./quick-verify.mjs";
+import {
+  formatQuickOutcomeHumanV1,
+  projectQuickOutcomeV1,
+} from "./outcome-presentation.mjs";
+import {
+  formatEfficiencyMetricsHumanV1,
+  readEfficiencyMetricsV1,
+  recordEfficiencyEventV1,
+} from "./efficiency-metrics.mjs";
+import { verifyRuntimeTransitionReceipt } from "./runtime-transition.mjs";
 import { runRepairExecution } from "./repair-execution.mjs";
 import {
   exportOfflineReceipt,
   importOfflineReceipt,
 } from "./offline-store.mjs";
 import {
-  applyDetectedProfilesV2,
-  detectProfiles,
-  detectProfilesV2,
+  applyDetectedProfilesV3,
+  detectProfilesV3,
   reconcileProfilesV2,
   resolveProfilesImpact,
   validateProfiles,
@@ -102,11 +112,11 @@ import {
 } from "./fleet-discovery.mjs";
 import {
   RUNKIT_RISK_CATEGORIES,
-  routeRunKitAssuranceV1,
+  routeRunKitAssuranceV2,
 } from "./assurance-router.mjs";
 import {
-  formatUsageModeHumanV1,
-  recommendUsageModeV1,
+  formatUsageModeHumanV2,
+  recommendUsageModeV2,
 } from "./usage-mode.mjs";
 import { deriveHumanStatusFromInspectV1 } from "./human-status.mjs";
 import {
@@ -139,6 +149,11 @@ import {
   readProfileLauncherReadiness,
   runDoctor,
 } from "./onboarding-doctor.mjs";
+import {
+  applyOnboardingBootstrapV1,
+  formatOnboardingBootstrapHumanV1,
+  planOnboardingBootstrapV1,
+} from "./onboarding-bootstrap.mjs";
 import {
   formatAdoptionHuman,
   runRegistryAdoption,
@@ -147,100 +162,125 @@ import { OFFICIAL_NPM_REGISTRY } from "./registry-adoption-gate.mjs";
 import {
   appendTeamProjectEventV1,
   assignTeamProjectV1,
-  buildTeamProjectTakeoverV1,
+  buildTeamProjectTakeoverV2,
   checkpointTeamProjectV1,
   closeTeamProjectVerificationV1,
   deferTeamProjectVerificationV1,
-  formatTeamProjectStatusHumanV1,
-  formatTeamProjectTakeoverHumanV1,
+  formatTeamProjectStatusHumanV2,
+  formatTeamProjectTakeoverHumanV2,
   handoffTeamProjectV1,
   initializeTeamProjectV1,
   integrateTeamProjectV1,
   openTeamProjectDecisionV1,
-  readTeamProjectStatusV1,
+  readTeamProjectStatusV2,
   rejectAndReturnTeamProjectV1,
+  reopenUpstreamTeamProjectV1,
   resolveTeamProjectDecisionV1,
+  transferTeamProjectV1,
 } from "./team-project.mjs";
 import {
   formatTeamProjectSuccessorHumanV1,
   successorTeamProjectV1,
 } from "./team-project-successor.mjs";
+import {
+  captureTargetWorkspaceSnapshotV1,
+  importExternalDeliveryV1,
+} from "./project-external-delivery.mjs";
 
 const TOP_LEVEL_HELP = `OwlRunKit ${CORE_VERSION}
 
 Usage:
-  owlrunkit <command> [options]
+  npx --no-install owlrunkit <command> [options]
 
 Start here:
-  owlrunkit mode recommend --workspace .
-  owlrunkit doctor --workspace .
-  owlrunkit profiles detect --workspace . --dry-run
-  owlrunkit profiles detect --workspace . --apply
-  owlrunkit assurance route --workspace . --request <risk-facts.json>
-  owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION}
+  npx --no-install owlrunkit bootstrap --workspace . --exact owlrunkit@${CORE_VERSION} --dry-run
+  npx --no-install owlrunkit mode recommend --workspace .
+  npx --no-install owlrunkit doctor --workspace .
+  npx --no-install owlrunkit profiles detect --workspace . --dry-run
+  npx --no-install owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION}
 Quick Verification
-  owlrunkit quick-verify --workspace . -- <command> [args...]
+  npx --no-install owlrunkit quick-verify --workspace . -- <command> [args...]
+  npx --no-install owlrunkit quick-reuse --workspace . --base-receipt <receipt> --allow-path <path> --dry-run|--apply -- <delta-command>
+  npx --no-install owlrunkit quick-runtime-verify --workspace . --receipt <runtime-transition.json>
   Low-risk, source-bound reusable evidence without writer leases or acceptance.
 
 Formal Delivery
-  owlrunkit formal <start|check|finish> --workspace . --run-id <id> [...]
+  npx --no-install owlrunkit formal <start|check|finish> --workspace . --run-id <id> [...]
   Use for multi-writer, permissions, security, funds, irreversible change,
   uncertain rollback, schema/data migration, or explicit Formal acceptance.
-
 Frozen dirty source
-  owlrunkit candidate <freeze|verify|materialize> --workspace . [...]
+  npx --no-install owlrunkit candidate <freeze|verify|materialize> --workspace . [...]
 
 Two-stage deployment
-  owlrunkit deployment prepare --workspace . --run-id <accepted-run> --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
-  owlrunkit deployment execute --workspace . [--resume] --prepare <receipt> --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json>
+  npx --no-install owlrunkit deployment prepare --workspace . --run-id <accepted-run> --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
+  npx --no-install owlrunkit deployment execute --workspace . [--resume] --prepare <receipt> --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json>
 
 Fleet and status
-  owlrunkit fleet <register-root|inspect-registry> [options]
-  owlrunkit fleet replace-registry --request <file> --receipt <file> [--dry-run]
-  owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file>
-  owlrunkit fleet discover; owlrunkit status --workspace .
+  npx --no-install owlrunkit fleet <register-root|inspect-registry> [options]
+  npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file> [--dry-run]
+  npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file>
+  npx --no-install owlrunkit fleet discover; npx --no-install owlrunkit status --workspace .
 
 Agent team projects
-  owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|capture|status|takeover|successor> [options]
+  npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|decision|verification|capture|target-snapshot|import-delivery|status|takeover|successor> [options]
   Durable Agent work, dependencies, decisions, gates, progress, and handoffs.
 Core successor
-  owlrunkit core-successor <plan|apply|resume> --workspace . [...]
+  npx --no-install owlrunkit core-successor <plan|apply|resume> --workspace . [...]
 
 Other onboarding commands:
-  owlrunkit profiles validate --workspace .; owlrunkit profiles impact --workspace . --changed <path>
-  owlrunkit inspect --workspace . --json
+  npx --no-install owlrunkit profiles validate --workspace .; npx --no-install owlrunkit profiles impact --workspace . --changed <path>
+  npx --no-install owlrunkit inspect --workspace . --json
 Formal accepted does not grant Git or release authority; Quick cannot become Formal.
 `;
 
 const COMMAND_HELP = Object.freeze({
+  init: `Usage:
+  npx --no-install owlrunkit init --workspace <directory> [--json]
+
+Initializes the project-owned RunKit Core and control directory. For a complete
+first-time onboarding transaction, use bootstrap after installing the exact
+project-local package. Initialization grants no Git, release, deployment, or
+business authority.
+`,
+  bootstrap: `Usage:
+  npx --no-install owlrunkit bootstrap --workspace <directory>
+    --exact owlrunkit@${CORE_VERSION} (--dry-run | --apply)
+    [--skill-root <installed-skill-directory>] [--json]
+
+Preflights or atomically completes Core initialization, profile reconciliation,
+validation, exact registry adoption, and doctor readback. Failed apply restores
+the governed preimage and retains a failure receipt. Shared Skill drift is
+diagnosed only; bootstrap never silently refreshes user or fleet Skills and
+grants no Git, release, deployment, production, or business authority.
+`,
   adopt: `Usage:
-  owlrunkit adopt --workspace <directory> --exact owlrunkit@${CORE_VERSION}
+  npx --no-install owlrunkit adopt --workspace <directory> --exact owlrunkit@${CORE_VERSION}
     [--registry <url>] [--timeout-ms <milliseconds>] [--json]
 
 Verifies the exact registry release against the project-local install and writes
 project-owned adoption evidence. It grants no Git or release authority.
 `,
   assurance: `Usage:
-  owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
+  npx --no-install owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
 
 Selects none, Quick, or Formal from structured risk facts. It does not grant
 repository, release, deployment, or destructive authority.
 `,
   "assurance route": `Usage:
-  owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
+  npx --no-install owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
 
 Required:
   --request <file>       Structured assurance risk facts.
 `,
   mode: `Usage:
-  owlrunkit mode recommend --workspace <directory> [risk facts]
-  owlrunkit mode status --workspace <directory> [--json]
+  npx --no-install owlrunkit mode recommend --workspace <directory> [risk facts]
+  npx --no-install owlrunkit mode status --workspace <directory> [--json]
 
 Selects continuity and assurance independently. Recommendation and status are
 read-only and grant no Git, release, deployment, production, or business authority.
 `,
   "mode recommend": `Usage:
-  owlrunkit mode recommend --workspace <directory>
+  npx --no-install owlrunkit mode recommend --workspace <directory>
     [--requested-mode auto|off|light|managed|formal]
     [--needs-evidence] [--exact-command-count <count>] [--writer-count <count>]
     [--cross-session] [--long-running] [--interruption-recovery]
@@ -254,207 +294,274 @@ Returns one user mode plus the independent continuity and assurance selections.
 Persisted mode preferences are not part of this release.
 `,
   "mode status": `Usage:
-  owlrunkit mode status --workspace <directory> [--json]
+  npx --no-install owlrunkit mode status --workspace <directory> [--json]
 
 Reads the current mode preference source without creating project state.
 `,
   "quick-attest": `Usage:
-  owlrunkit quick-attest --workspace <directory> --receipt <receipt.json> [--json]
+  npx --no-install owlrunkit quick-attest --workspace <directory> --receipt <receipt.json> [--json]
 
 Attests one Quick Receipt against its bound materials and current workspace.
 It never grants repository or business authority.
 `,
   "quick-verify": `Usage:
-  owlrunkit quick-verify --workspace <directory> [--stdin-file <file>] [--attest] [--json]
+  npx --no-install owlrunkit quick-verify --workspace <directory>
+    [--isolate] [--dependency-root <directory>] [--bind-ignored <relative-path> ...]
+    [--stdin-file <file>] [--capture-runtime] [--attest] [--json]
     -- <executable> [args...]
 
 Runs one exact command, saves source-bound stdout/stderr and a Quick receipt,
 and returns a bounded head/tail output summary. --stdin-file copies and hash-binds
 up to 1 MiB of exact stdin bytes in the receipt store. --attest immediately
 attests the saved receipt without merging Quick and attestation semantics.
+--isolate runs a Git-visible source copy in a disposable cache environment.
+--dependency-root binds and projects an existing dependency environment without
+installing anything. Ignored workspace bytes are bound only by explicit,
+repeatable --bind-ignored literal paths.
+--capture-runtime sets OWLRUNKIT_RUNTIME_REPORT for the exact command and binds
+one strict command-reported external transition without conflating it with
+workspace mutation. Missing or inconsistent runtime truth fails closed while
+retaining the ordinary Quick receipt.
 Quick evidence is not Formal acceptance and grants no repository or business authority.
+`,
+  "quick-runtime-verify": `Usage:
+  npx --no-install owlrunkit quick-runtime-verify --workspace <directory>
+    --receipt <runtime-transition.json> [--json]
+
+Verifies the companion runtime-transition receipt, Quick receipt, command report,
+and bound material bytes. It does not independently re-observe the external
+runtime and grants no Git, release, deployment, production, or business authority.
 `,
   "quick-metrics": `Usage:
-  owlrunkit quick-metrics --workspace <directory> --local [--verbose] [--json]
+  npx --no-install owlrunkit quick-metrics --workspace <directory> [--local] [--verbose] [--json]
 
 Returns aggregate local-only Quick counts with no telemetry or network access.
 --verbose additionally lists the receipt paths used for the aggregation.
+`,
+  efficiency: `Usage:
+  npx --no-install owlrunkit efficiency status --workspace <directory> [--verbose] [--json]
+  npx --no-install owlrunkit efficiency record --workspace <directory>
+    --event-id <id> --at <ISO-UTC>
+    --kind workflow_started|false_block_confirmed|manual_intervention|acceptable_result_reached
+    --workflow-id <id> --summary <text> [--evidence <ref>...] [--json]
+
+Reads project-local evidence only. False blocks and manual interventions are
+counted only when explicitly recorded; receipt counts are not a value metric.
+It grants no Git, release, deployment, production, or business authorization.
+`,
+  "efficiency record": `Usage:
+  npx --no-install owlrunkit efficiency record --workspace <directory>
+    --event-id <id> --at <ISO-UTC>
+    --kind workflow_started|false_block_confirmed|manual_intervention|acceptable_result_reached
+    --workflow-id <id> --summary <text> [--evidence <ref>...] [--json]
+
+Creates one immutable, project-local observation. Recording friction grants no
+Git, release, deployment, production, or business authorization.
+`,
+  "efficiency status": `Usage:
+  npx --no-install owlrunkit efficiency status --workspace <directory> [--verbose] [--json]
+
+Reports local evidence about RunKit friction without telemetry or network use.
+It grants no Git, release, deployment, production, or business authorization.
+`,
+  "quick-reuse": `Usage:
+  npx --no-install owlrunkit quick-reuse --workspace <directory>
+    --base-receipt <receipt.json> --allow-path <literal-path> [--allow-path <literal-path> ...]
+    (--dry-run | --apply) [--stdin-file <file>] [--json]
+    -- <exact-delta-command> [args...]
+
+Verifies that every current candidate delta is explicitly allowed. --dry-run
+runs no command and writes no receipt. --apply runs only the exact delta gate
+through Quick and records an additive evidence-reuse receipt. Reuse remains
+non-Formal and grants no Git, release, deployment, production, or business authority.
 `,
   fleet: `Usage:
-  owlrunkit fleet register-root --fleet-root <directory>
-  owlrunkit fleet inspect-registry [--registry <file>]
-  owlrunkit fleet replace-registry --request <file> --receipt <file> [--registry <file>] [--dry-run]
-  owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file> [--registry <file>]
-  owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
+  npx --no-install owlrunkit fleet register-root --fleet-root <directory>
+  npx --no-install owlrunkit fleet inspect-registry [--registry <file>]
+  npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file> [--registry <file>] [--dry-run]
+  npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file> [--registry <file>]
+  npx --no-install owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
 `,
   "fleet register-root": `Usage:
-  owlrunkit fleet register-root --fleet-root <directory>
+  npx --no-install owlrunkit fleet register-root --fleet-root <directory>
 
 Registers one durable fleet coverage root for later no-argument discovery.
 `,
   "fleet inspect-registry": `Usage:
-  owlrunkit fleet inspect-registry [--registry <file>]
+  npx --no-install owlrunkit fleet inspect-registry [--registry <file>]
 
 Reads the exact registry bytes, hashes, roots, and membership without mutation.
 `,
   "fleet replace-registry": `Usage:
-  owlrunkit fleet replace-registry --request <file> --receipt <file>
+  npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file>
     [--registry <file>] [--dry-run]
 
 Atomically replaces a registry from an exact preimage and evidence-bound fleet
 membership. Coverage reduction requires explicit exclusion evidence.
 `,
   "fleet rollback-registry": `Usage:
-  owlrunkit fleet rollback-registry --receipt <replacement-receipt.json>
+  npx --no-install owlrunkit fleet rollback-registry --receipt <replacement-receipt.json>
     --rollback-receipt <file> [--registry <file>]
 
 Restores the exact preimage recorded by a replacement receipt.
 `,
   "fleet discover": `Usage:
-  owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
+  npx --no-install owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
     [--workspace-root <directory>]
 
 With no source option, discovers the complete fleet inside registered roots.
 `,
   profiles: `Usage:
-  owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
-  owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
-  owlrunkit profiles validate --workspace <directory>
-  owlrunkit profiles impact --workspace <directory> --changed <path>
+  npx --no-install owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
+  npx --no-install owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
+  npx --no-install owlrunkit profiles validate --workspace <directory>
+  npx --no-install owlrunkit profiles impact --workspace <directory> --changed <path>
 `,
   "profiles detect": `Usage:
-  owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
+  npx --no-install owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
 
 --dry-run reports deterministic candidates. --apply atomically adopts only a
 high-confidence unambiguous profile.
 `,
   "profiles reconcile": `Usage:
-  owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
+  npx --no-install owlrunkit profiles reconcile --workspace <directory> (--dry-run | --apply)
 
 --dry-run previews deterministic additions and command updates without writing.
 --apply atomically updates profiles.json and writes a hash-bound migration receipt.
 `,
   formal: `Usage:
-  owlrunkit formal start --workspace <directory> --run-id <id> [...]
-  owlrunkit formal check --workspace <directory> --run-id <id> -- <command>
-  owlrunkit formal finish --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal start --workspace <directory> --run-id <id> [...]
+  npx --no-install owlrunkit formal check --workspace <directory> --run-id <id> -- <command>
+  npx --no-install owlrunkit formal finish --workspace <directory> --run-id <id>
 `,
   "formal start": `Usage:
-  owlrunkit formal start --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal start --workspace <directory> --run-id <id>
     --goal <goal.json> --work-item <id> --owned-path <path>
 
 Creates the execution and exact writer lease.
 `,
   "formal check": `Usage:
-  owlrunkit formal check --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal check --workspace <directory> --run-id <id>
     --work-item <id> --check-id <id> --envelope <verification-envelope.json>
-  owlrunkit formal check --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal check --workspace <directory> --run-id <id>
     --work-item <id> --check-id <id> --cwd <directory> -- <built-in-command> [args...]
 
 Verification Envelopes admit real project commands only when file, network,
 process, environment, output, timeout, and cleanup constraints are enforced.
 `,
   "formal finish": `Usage:
-  owlrunkit formal finish --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit formal finish --workspace <directory> --run-id <id>
 
 Runs the final source, evidence, permission, closeout, and lease-release path.
 `,
   candidate: `Usage:
-  owlrunkit candidate freeze --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit candidate freeze --workspace <directory> --run-id <id>
     --from-lease <id> --candidate-id <id>
-  owlrunkit candidate verify --workspace <directory> --candidate <file>
-  owlrunkit candidate materialize --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate verify --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate materialize --workspace <directory> --candidate <file>
     --target-workspace <directory>
 `,
   "candidate freeze": `Usage:
-  owlrunkit candidate freeze --workspace <directory> --run-id <id>
+  npx --no-install owlrunkit candidate freeze --workspace <directory> --run-id <id>
     --from-lease <id> --candidate-id <id>
 
 Freezes the exact dirty source manifest, including deletions and renames.
 `,
   "candidate verify": `Usage:
-  owlrunkit candidate verify --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate verify --workspace <directory> --candidate <file>
 `,
   "candidate materialize": `Usage:
-  owlrunkit candidate materialize --workspace <directory> --candidate <file>
+  npx --no-install owlrunkit candidate materialize --workspace <directory> --candidate <file>
     --target-workspace <directory>
 `,
   deployment: `Usage:
-  owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
+  npx --no-install owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
     --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
-  owlrunkit deployment execute --workspace <directory> --prepare <receipt>
+  npx --no-install owlrunkit deployment execute --workspace <directory> --prepare <receipt>
     --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json> [--resume]
 `,
   "deployment prepare": `Usage:
-  owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
+  npx --no-install owlrunkit deployment prepare --workspace <directory> --run-id <accepted-run>
     --artifact <file> --media-type <type> --owner-decision <decision-v1.json> --output <receipt>
 `,
   "deployment execute": `Usage:
-  owlrunkit deployment execute --workspace <directory> --prepare <receipt>
+  npx --no-install owlrunkit deployment execute --workspace <directory> --prepare <receipt>
     --owner-decision <decision-v1.json> --owner-authority <signed-v2.json> --manifest <remote.json> [--resume]
 
 The default happy path creates and closes the deployment child, goal, lease,
 profile, preflight, lineage, and result. --request is an advanced legacy path.
 `,
   "core-successor": `Usage:
-  owlrunkit core-successor plan --workspace <directory> --plan-id <id> [...]
-  owlrunkit core-successor apply --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor plan --workspace <directory> --plan-id <id> [...]
+  npx --no-install owlrunkit core-successor apply --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> --receipt-id <id>
-  owlrunkit core-successor resume --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor resume --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> [...]
 `,
   "core-successor plan": `Usage:
-  owlrunkit core-successor plan --workspace <directory> --plan-id <id>
+  npx --no-install owlrunkit core-successor plan --workspace <directory> --plan-id <id>
     --run-id <id> --from-lease <id> --candidate-id <id>
     [--fleet-root <directory> | --fleet-manifest <file>]
 `,
   "core-successor apply": `Usage:
-  owlrunkit core-successor apply --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor apply --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> --receipt-id <id>
 `,
   "core-successor resume": `Usage:
-  owlrunkit core-successor resume --workspace <directory> --plan <file>
+  npx --no-install owlrunkit core-successor resume --workspace <directory> --plan <file>
     --owner-authority <signed-v2.json> [--from-receipt <file>]
 `,
   status: `Usage:
-  owlrunkit status --workspace <directory> [--json]
+  npx --no-install owlrunkit status --workspace <directory> [--json]
 
 Shows completed milestones, current state, remaining gates, and the next allowed
 action without granting any authority.
 `,
   project: `Usage:
-  owlrunkit project init --workspace <directory> --definition <project.json>
-  owlrunkit project assign --workspace <directory> --assignment-id <id> --at <ISO-UTC> --work-item <id> --agent <id>
+  npx --no-install owlrunkit project init --workspace <directory> --definition <project.json>
+  npx --no-install owlrunkit project assign --workspace <directory> --assignment-id <id> --at <ISO-UTC> --work-item <id> --agent <id>
     [--supersedes <current-assignment-id>] [--execution-run-id <id> --execution-work-item <id>] [--json]
-  owlrunkit project handoff --workspace <directory> --handoff-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project handoff --workspace <directory> --handoff-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id> --from-agent <id> --to-agent <id>
     --summary <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
     --work-item <failed-id> --reviewer-agent <id> --to-agent <id>
     --reason <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project decision --workspace <directory> --open --decision-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project reopen-upstream --workspace <directory> --reopen-id <id> --at <ISO-UTC>
+    --upstream-work-item <completed-id> --trigger-work-item <downstream-id>
+    --reviewer-agent <id> --to-agent <id> --reason <text> --next <text>
+    --evidence <ref> [--evidence <ref> ...] [--json]
+  npx --no-install owlrunkit project transfer --workspace <directory> --transfer-id <id> --at <ISO-UTC>
+    --assignment-id <current> --work-item <id> --from-agent <id> --to-agent <id>
+    --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate>
+    --summary <text> [--completed-units <nonnegative-int>]
+    --evidence <ref> [--evidence <ref> ...] [--blocker <ref> ...]
+    [--decision <id> ...] --next <text> [--source-fingerprint <sha256>] [--json]
+  npx --no-install owlrunkit project decision --workspace <directory> --open --decision-id <id> --at <ISO-UTC>
     --title <text> --question <text> --owner-agent <id>
     [--blocking-work-item <id> ...] --option <text> [--option <text> ...] [--json]
-  owlrunkit project decision --workspace <directory> --resolve --decision-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project decision --workspace <directory> --resolve --decision-id <id> --at <ISO-UTC>
     --resolution <text> --rationale <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id>
     --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
     --summary <text> [--completed-units <nonnegative-int>]
     [--evidence <ref> ...] [--blocker <ref> ...] [--decision <id> ...]
     [--next <text>] [--source-fingerprint <sha256>] [--json]
-  owlrunkit project verification --workspace <directory> --defer --verification-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project verification --workspace <directory> --defer --verification-id <id> --at <ISO-UTC>
     --work-item <id> --owner-agent <id> --check <check-id> [--check <check-id> ...]
     --reason <text> --due-gate <gate-id> [--json]
-  owlrunkit project verification --workspace <directory> --close --verification-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project verification --workspace <directory> --close --verification-id <id> --at <ISO-UTC>
     --disposition <verified|no_longer_required> --summary <text>
     [--evidence <ref> ...] [--decision <resolved-decision-id> ...] [--json]
-  owlrunkit project integrate --workspace <directory> --gate <gate-id> --at <ISO-UTC>
+  npx --no-install owlrunkit project integrate --workspace <directory> --gate <gate-id> --at <ISO-UTC>
     --summary <text> --evidence <ref> [--evidence <ref> ...] [--json]
-  owlrunkit project <checkpoint|handoff|decision|verification|integrate|capture> --workspace <directory> --request <event.json>
-  owlrunkit project status --workspace <directory> [--json]
-  owlrunkit project takeover --workspace <directory> --agent <id> [--json]
-  owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project <checkpoint|handoff|decision|verification|integrate|capture> --workspace <directory> --request <event.json>
+  npx --no-install owlrunkit project target-snapshot --workspace <controller> --snapshot-id <id> --at <ISO-UTC> --work-item <id> --target-workspace <frozen-worktree> --dry-run|--apply
+  npx --no-install owlrunkit project import-delivery --workspace <controller> --delivery-id <id> --at <ISO-UTC> --assignment-id <current> --work-item <id> --producer <id> --target-workspace <frozen-worktree> --packet <delivery-packet.json> --dry-run|--apply
+  npx --no-install owlrunkit project status --workspace <directory> [--json]
+  npx --no-install owlrunkit project takeover --workspace <directory> --agent <id> [--json]
+  npx --no-install owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
     --definition <project.json> --reason <text> [--json]
 
 Project status is derived from durable work items, Agent assignments,
@@ -462,7 +569,7 @@ dependencies, decisions, checkpoints, integration gates, and evidence refs.
 No self-reported percentage is accepted.
 `,
   "project checkpoint": `Usage:
-  owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project checkpoint --workspace <directory> --checkpoint-id <id> --at <ISO-UTC>
     --assignment-id <current> --work-item <id>
     --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
     --summary <text> [--completed-units <nonnegative-int>]
@@ -471,27 +578,83 @@ No self-reported percentage is accepted.
 
 Measured WorkItems require --completed-units on every checkpoint. A completed
 checkpoint must use the WorkItem's declared total. Example:
-  owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
+  npx --no-install owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
+`,
+  "project assign": `Usage:
+  npx --no-install owlrunkit project assign --workspace <directory>
+    --assignment-id <id> --at <ISO-UTC> --work-item <id> --agent <id>
+    [--supersedes <current-assignment-id>]
+    [--execution-run-id <id> --execution-work-item <id>] [--json]
+
+Assigns one current WorkItem owner without granting Git, release, deployment,
+production, business, or other authorization.
 `,
   "project reject-and-return": `Usage:
-  owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project reject-and-return --workspace <directory> --rework-id <id> --at <ISO-UTC>
     --work-item <failed-id> --reviewer-agent <id> --to-agent <id>
     --reason <text> --next <text> --evidence <ref> [--evidence <ref> ...] [--json]
 
 Atomically records the rejection and opens a new assigned rework attempt. The
 failed attempt remains immutable and evidence-linked. This action does not
-grant Git, release, deployment, production, or business authority.
+  grant Git, release, deployment, production, or business authority.
+  `,
+  "project reopen-upstream": `Usage:
+  npx --no-install owlrunkit project reopen-upstream --workspace <directory>
+    --reopen-id <id> --at <ISO-UTC> --upstream-work-item <completed-id>
+    --trigger-work-item <transitive-downstream-id> --reviewer-agent <id>
+    --to-agent <id> --reason <text> --next <text>
+    --evidence <ref> [--evidence <ref> ...] [--json]
+
+Invalidates stale completion truth for the upstream WorkItem and every transitive
+downstream WorkItem, then creates a new upstream assignment. Passed integration
+gates remain immutable. No Git, release, deployment, production, or business
+authority is granted.
+`,
+  "project transfer": `Usage:
+  npx --no-install owlrunkit project transfer --workspace <directory>
+    --transfer-id <id> --at <ISO-UTC> --assignment-id <current>
+    --work-item <id> --from-agent <id> --to-agent <id>
+    --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate>
+    --summary <text> [--completed-units <nonnegative-int>]
+    --evidence <ref> [--evidence <ref> ...] [--blocker <ref> ...]
+    [--decision <id> ...] --next <text> [--source-fingerprint <sha256>] [--json]
+
+Atomically records checkpoint, handoff, and successor-assignment facts inside one
+immutable Event V4 envelope. Terminal WorkItems cannot transfer. No Git, release,
+deployment, production, or business authority is granted.
+`,
+  "project target-snapshot": `Usage:
+  npx --no-install owlrunkit project target-snapshot --workspace <controller>
+    --snapshot-id <id> --at <ISO-UTC> --work-item <id>
+    --target-workspace <frozen-worktree> [--allowed-path <path> ...]
+    --dry-run|--apply [--json]
+
+Captures target HEAD and the visible dirty overlay into the controller project.
+It does not write the target worktree or grant Git, release, deployment,
+production, business, or other authorization.
+`,
+  "project import-delivery": `Usage:
+  npx --no-install owlrunkit project import-delivery --workspace <controller>
+    --delivery-id <id> --at <ISO-UTC> --assignment-id <current>
+    --work-item <id> --producer <id> --target-workspace <frozen-worktree>
+    --packet <delivery-packet.json> [--entry-snapshot <id>]
+    --dry-run|--apply [--json]
+
+Verifies the external DeliveryPacket against the read-only target and records
+candidate identity in Project Driver only with --apply. Without an entry
+snapshot it reports candidate_only and does not claim entry-to-candidate proof.
+No Git, release, deployment, production, business, or other authorization is granted.
 `,
   "project status": `Usage:
-  owlrunkit project status --workspace <directory> [--json]
+  npx --no-install owlrunkit project status --workspace <directory> [--json]
 `,
   "project takeover": `Usage:
-  owlrunkit project takeover --workspace <directory> --agent <id> [--json]
+  npx --no-install owlrunkit project takeover --workspace <directory> --agent <id> [--json]
 
 Builds a read-only blank-session recovery packet for one Agent.
 `,
   "project successor": `Usage:
-  owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
+  npx --no-install owlrunkit project successor --workspace <directory> --transition-id <id> --at <ISO-UTC>
     --definition <project.json> --reason <text> [--json]
 
 Archives one derived-completed active project and installs one fresh active
@@ -509,6 +672,17 @@ function withHumanOutput(result, humanOutput) {
   return result;
 }
 
+function presentQuickOutcome(result, json) {
+  const presented = {
+    ...result,
+    outcome: projectQuickOutcomeV1(result),
+    authorizationGranted: false,
+  };
+  return json === true
+    ? presented
+    : withHumanOutput(presented, formatQuickOutcomeHumanV1(presented.outcome));
+}
+
 function shellCommandToken(value) {
   const text = String(value);
   return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(text)
@@ -525,7 +699,7 @@ function correctedCheckpointCommand(argv, completedUnits) {
     "--completed-units",
     String(completedUnits),
   );
-  return `owlrunkit ${corrected.map(shellCommandToken).join(" ")}`;
+  return `npx --no-install owlrunkit ${corrected.map(shellCommandToken).join(" ")}`;
 }
 
 function formatTeamProjectAssignmentHuman(result) {
@@ -572,6 +746,64 @@ function formatTeamProjectReworkHuman(result) {
   ].join("\n");
 }
 
+function formatTeamProjectUpstreamReopenHuman(result) {
+  const disposition = result.resumed ? "Resumed" : "Reopened";
+  return [
+    `${disposition} upstream WorkItem ${result.upstreamWorkItemId} for Agent ${result.toAgentId}.`,
+    `Invalidated completion: ${result.invalidatedWorkItemIds.join(", ")}`,
+    `Project next: ${result.nextAction ?? "none"}${result.nextActorId ? ` (owner ${result.nextActorId})` : ""}`,
+    "Git/release/deployment/business authority: not granted.",
+    "",
+  ].join("\n");
+}
+
+function formatTeamProjectTransferHuman(result) {
+  const disposition = result.resumed ? "Resumed" : "Transferred";
+  return [
+    `${disposition} WorkItem ${result.workItemId} from Agent ${result.fromAgentId} to Agent ${result.toAgentId}.`,
+    `New assignment: ${result.assignmentId}; immutable facts: ${result.factRefs.length}`,
+    `Project next: ${result.nextAction ?? "none"}${result.nextActorId ? ` (owner ${result.nextActorId})` : ""}`,
+    "Git/release/deployment/business authority: not granted.",
+    "",
+  ].join("\n");
+}
+
+function formatTargetSnapshotHuman(result) {
+  return [
+    result.persisted
+      ? `Captured target snapshot ${result.snapshotId}.`
+      : `Previewed target snapshot ${result.snapshotId}; nothing persisted.`,
+    `Target: ${result.targetWorkspaceRef}`,
+    `HEAD: ${result.targetHead}`,
+    `Allowed paths: ${result.allowedPaths.join(", ")}`,
+    "Target write: no; authorization granted: no.",
+    "",
+  ].join("\n");
+}
+
+function formatExternalDeliveryHuman(result) {
+  if (result.status === "external_delivery_rejected") {
+    return [
+      `Rejected external delivery ${result.deliveryId}.`,
+      `Out-of-scope source: ${result.overlay?.outOfScopeSourcePaths?.join(", ") || "none"}`,
+      "Nothing was added to Project Driver; authorization granted: no.",
+      "",
+    ].join("\n");
+  }
+  return [
+    result.persisted
+      ? `Imported external delivery ${result.deliveryId}.`
+      : `Previewed external delivery ${result.deliveryId}; nothing persisted.`,
+    `Candidate: ${result.deliveryCandidateFingerprint}`,
+    `Overlay: ${result.overlay.status}`,
+    `Tool cache changes: ${result.overlay.toolCachePaths.join(", ") || "none"}`,
+    `Dependency environment changes: ${result.overlay.dependencyEnvironmentPaths.join(", ") || "none"}`,
+    `Not proven: ${result.notProven.join(" ")}`,
+    "Target write: no; authorization granted: no.",
+    "",
+  ].join("\n");
+}
+
 function formatTeamProjectDecisionHuman(result) {
   const disposition = result.resumed
     ? "Resumed"
@@ -669,18 +901,18 @@ function onboardingProjection(root, recovery = null) {
   const steps = [
     {
       id: "doctor",
-      command: "owlrunkit doctor --workspace .",
+      command: "npx --no-install owlrunkit doctor --workspace .",
     },
     ...(!profilesReady
       ? [{
           id: "profiles_detect",
-          command: "owlrunkit profiles detect --workspace . --dry-run",
+          command: "npx --no-install owlrunkit profiles detect --workspace . --dry-run",
         }]
       : []),
     ...(!adoptionReady
       ? [{
           id: "adopt_or_start",
-          command: `owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or owlrunkit start`,
+          command: `npx --no-install owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or npx --no-install owlrunkit start`,
         }]
       : []),
   ];
@@ -1378,9 +1610,9 @@ async function initialize(options) {
       `Initialized OwlRunKit ${result.core.coreVersion} in ${result.runtimeRoot}`,
       "",
       "Next:",
-      "1. owlrunkit doctor --workspace .",
-      "2. owlrunkit profiles detect --workspace . --dry-run",
-      `3. owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or owlrunkit start`,
+      "1. npx --no-install owlrunkit doctor --workspace .",
+      "2. npx --no-install owlrunkit profiles detect --workspace . --dry-run",
+      `3. npx --no-install owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or npx --no-install owlrunkit start`,
       "",
     ].join("\n"),
   );
@@ -1680,7 +1912,7 @@ function inspect(options) {
   const onboarding = onboardingProjection(root, recovery);
   const projectDefinitionPath = runtimePath(root, "project", "definition.json");
   const projectDriver = pathEntryExists(projectDefinitionPath)
-    ? readTeamProjectStatusV1({ workspaceRoot: root })
+    ? readTeamProjectStatusV2({ workspaceRoot: root })
     : null;
   const summary = buildInspectSummary(result, {
     maintenanceNextAction: onboarding.maintenanceNextAction ?? null,
@@ -1908,9 +2140,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
     const separatorIndex = rest.indexOf("--");
     const acceptsExactCommand = command === "verify"
       || command === "quick-verify"
+      || command === "quick-reuse"
       || (command === "formal" && rest[0] === "check");
     if (separatorIndex >= 0 && !acceptsExactCommand) {
-      throw new Error("Only verify, quick-verify, and formal check accept an exact command after --.");
+      throw new Error("Only verify, quick-verify, quick-reuse, and formal check accept an exact command after --.");
     }
     const optionValues = separatorIndex >= 0 ? rest.slice(0, separatorIndex) : rest;
     const commandArgv = separatorIndex >= 0 ? rest.slice(separatorIndex + 1) : [];
@@ -1920,6 +2153,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       "core-successor",
       "delivery",
       "deployment",
+      "efficiency",
       "fleet",
       "formal",
       "lease",
@@ -1948,6 +2182,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
     const options = parseOptions(nested ? nestedOptions : optionValues, {
       multi: command === "mode"
         ? ["risk-category"]
+        : command === "quick-verify"
+          ? ["bind-ignored"]
+        : command === "quick-reuse"
+          ? ["allow-path"]
         : command === "profiles" && action === "impact"
         ? ["changed"]
         : (command === "fleet" && action === "discover")
@@ -1957,10 +2195,16 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           || command === "start"
           || (command === "formal" && action === "start")
           ? ["owned-path"]
+        : command === "project" && action === "target-snapshot"
+          ? ["allowed-path"]
         : command === "project" && action === "handoff"
           ? ["evidence"]
         : command === "project" && action === "reject-and-return"
           ? ["evidence"]
+        : command === "project" && action === "reopen-upstream"
+          ? ["evidence"]
+        : command === "project" && action === "transfer"
+          ? ["evidence", "blocker", "decision"]
         : command === "project" && action === "integrate"
           ? ["evidence"]
         : command === "project" && action === "verification"
@@ -1969,6 +2213,8 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["evidence", "blocker", "decision"]
         : command === "project" && action === "decision"
           ? ["blocking-work-item", "option", "evidence"]
+        : command === "efficiency" && action === "record"
+          ? ["evidence"]
           : [],
       boolean: command === "mode" && action === "recommend"
         ? [
@@ -1994,12 +2240,16 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         ? ["json", "verbose", "history"]
         : command === "init"
           ? ["json"]
+        : command === "bootstrap"
+          ? ["json", "dry-run", "apply"]
         : command === "project" && action === "decision"
           ? ["json", "open", "resolve"]
         : command === "project" && action === "verification"
           ? ["json", "defer", "close"]
-        : command === "project" && new Set(["assign", "handoff", "reject-and-return", "checkpoint", "integrate", "status", "takeover", "successor"]).has(action)
+        : command === "project" && new Set(["assign", "handoff", "reject-and-return", "reopen-upstream", "transfer", "checkpoint", "integrate", "status", "takeover", "successor"]).has(action)
           ? ["json"]
+        : command === "project" && new Set(["target-snapshot", "import-delivery"]).has(action)
+          ? ["json", "dry-run", "apply"]
           : command === "doctor" || command === "adopt" || command === "status"
             ? ["json"]
         : command === "profiles"
@@ -2013,14 +2263,43 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         : command === "deployment" && action === "execute"
           ? ["resume"]
         : command === "quick-verify"
-          ? ["json", "attest"]
+          ? ["json", "attest", "isolate", "capture-runtime"]
+        : command === "quick-reuse"
+          ? ["json", "dry-run", "apply"]
+        : command === "quick-runtime-verify"
+          ? ["json"]
         : command === "quick-attest"
           ? ["json"]
         : command === "quick-metrics"
           ? ["json", "local", "verbose"]
+        : command === "efficiency" && action === "record"
+          ? ["json"]
+        : command === "efficiency" && action === "status"
+          ? ["json", "verbose"]
           : [],
     });
     if (command === "init") return await initialize(options);
+    if (command === "bootstrap") {
+      if (options.apply === true && options["dry-run"] === true) {
+        throw new Error("bootstrap accepts either --apply or --dry-run, not both.");
+      }
+      if (options.apply !== true && options["dry-run"] !== true) {
+        throw new Error("bootstrap requires --dry-run or --apply.");
+      }
+      const input = {
+        workspaceRoot: requireOption(options, "workspace"),
+        exactSpec: requireOption(options, "exact"),
+        ...(options["skill-root"] === undefined
+          ? {}
+          : { skillRoot: options["skill-root"] }),
+      };
+      const result = options.apply === true
+        ? await applyOnboardingBootstrapV1(input)
+        : await planOnboardingBootstrapV1(input);
+      return options.json === true
+        ? result
+        : withHumanOutput(result, formatOnboardingBootstrapHumanV1(result));
+    }
     if (command === "doctor") {
       const timeoutMs = options["timeout-ms"] === undefined
         ? 1_500
@@ -2050,10 +2329,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
     }
     if (command === "assurance") {
       if (action !== "route") {
-        throw new Error("Usage: owlrunkit assurance route --request <risk-facts.json>");
+        throw new Error("Usage: npx --no-install owlrunkit assurance route --request <risk-facts.json>");
       }
       const requestPath = realpathSync(requireOption(options, "request"));
-      return routeRunKitAssuranceV1(readJson(requestPath));
+      return routeRunKitAssuranceV2(readJson(requestPath));
     }
     if (command === "mode") {
       const root = workspace(options);
@@ -2080,7 +2359,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           "risk-category",
           "json",
         ]);
-        const recommendation = recommendUsageModeV1({
+        const recommendation = recommendUsageModeV2({
           workspaceRoot: root,
           requestedMode: options["requested-mode"] ?? "auto",
           needsDurableEvidence: options["needs-evidence"] === true,
@@ -2109,11 +2388,11 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         });
         return options.json === true
           ? recommendation
-          : withHumanOutput(recommendation, formatUsageModeHumanV1(recommendation));
+          : withHumanOutput(recommendation, formatUsageModeHumanV2(recommendation));
       }
       if (action === "status") {
         assertOnlyOptions(options, ["workspace", "json"]);
-        const recommendation = recommendUsageModeV1({
+        const recommendation = recommendUsageModeV2({
           workspaceRoot: root,
           requestedMode: "auto",
           needsDurableEvidence: false,
@@ -2142,9 +2421,9 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         };
         return options.json === true
           ? status
-          : withHumanOutput(status, formatUsageModeHumanV1(status));
+          : withHumanOutput(status, formatUsageModeHumanV2(status));
       }
-      throw new Error("Usage: owlrunkit mode <recommend|status> --workspace <directory>");
+      throw new Error("Usage: npx --no-install owlrunkit mode <recommend|status> --workspace <directory>");
     }
     if (command === "fleet") {
       if (action === "register-root") {
@@ -2187,7 +2466,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         };
       }
       if (action !== "discover") {
-        throw new Error("Usage: owlrunkit fleet <register-root|inspect-registry|replace-registry|rollback-registry|discover>");
+        throw new Error("Usage: npx --no-install owlrunkit fleet <register-root|inspect-registry|replace-registry|rollback-registry|discover>");
       }
       const discovered = await discoverFleet({
         fleetRoots: options["fleet-root"] ?? null,
@@ -2259,7 +2538,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         });
       }
       throw new Error(
-        "Usage: owlrunkit core-successor <plan|apply|resume> [options]",
+        "Usage: npx --no-install owlrunkit core-successor <plan|apply|resume> [options]",
       );
     }
     if (command === "deployment") {
@@ -2692,7 +2971,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           };
         }
       }
-      throw new Error("Usage: owlrunkit deployment <prepare|execute> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit deployment <prepare|execute> [options]");
     }
     if (command === "formal") {
       if (action === "start") {
@@ -2774,7 +3053,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           authorizationGranted: false,
         };
       }
-      throw new Error("Usage: owlrunkit formal <start|check|finish> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit formal <start|check|finish> [options]");
     }
     if (command === "candidate") {
       if (action === "freeze") {
@@ -2814,7 +3093,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           targetWorkspaceRoot: requireOption(options, "target-workspace"),
         });
       }
-      throw new Error("Usage: owlrunkit candidate <freeze|verify|materialize> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit candidate <freeze|verify|materialize> [options]");
     }
     if (command === "start") return startExecution(options);
     if (command === "plan") {
@@ -2857,6 +3136,15 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           "workspace", "rework-id", "at", "work-item", "reviewer-agent",
           "to-agent", "reason", "next", "evidence", "json",
         ],
+        "reopen-upstream": [
+          "workspace", "reopen-id", "at", "upstream-work-item", "trigger-work-item",
+          "reviewer-agent", "to-agent", "reason", "next", "evidence", "json",
+        ],
+        transfer: [
+          "workspace", "transfer-id", "at", "assignment-id", "work-item",
+          "from-agent", "to-agent", "state", "summary", "completed-units",
+          "evidence", "blocker", "decision", "next", "source-fingerprint", "json",
+        ],
         decision: [
           "workspace", "request", "open", "resolve", "decision-id", "at", "title",
           "question", "owner-agent", "blocking-work-item", "option", "resolution",
@@ -2874,6 +3162,15 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         ],
         integrate: ["workspace", "request", "gate", "at", "summary", "evidence", "json"],
         capture: ["workspace", "request"],
+        "target-snapshot": [
+          "workspace", "snapshot-id", "at", "work-item", "target-workspace",
+          "allowed-path", "dry-run", "apply", "json",
+        ],
+        "import-delivery": [
+          "workspace", "delivery-id", "at", "assignment-id", "work-item",
+          "producer", "target-workspace", "packet", "entry-snapshot",
+          "dry-run", "apply", "json",
+        ],
         status: ["workspace", "json"],
         takeover: ["workspace", "agent", "json"],
         successor: ["workspace", "transition-id", "at", "definition", "reason", "json"],
@@ -2888,6 +3185,43 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           definition: readJson(realpathSync(requireOption(options, "definition"))),
         });
       }
+      if (action === "target-snapshot") {
+        if ((options.apply === true) === (options["dry-run"] === true)) {
+          throw new Error("project target-snapshot requires exactly one of --dry-run or --apply.");
+        }
+        const captured = captureTargetWorkspaceSnapshotV1({
+          controllerWorkspaceRoot: root,
+          snapshotId: requireOption(options, "snapshot-id"),
+          occurredAt: requireOption(options, "at"),
+          workItemId: requireOption(options, "work-item"),
+          targetWorkspaceRoot: requireOption(options, "target-workspace"),
+          allowedPaths: options["allowed-path"],
+          apply: options.apply === true,
+        });
+        return options.json === true
+          ? captured
+          : withHumanOutput(captured, formatTargetSnapshotHuman(captured));
+      }
+      if (action === "import-delivery") {
+        if ((options.apply === true) === (options["dry-run"] === true)) {
+          throw new Error("project import-delivery requires exactly one of --dry-run or --apply.");
+        }
+        const imported = importExternalDeliveryV1({
+          controllerWorkspaceRoot: root,
+          deliveryId: requireOption(options, "delivery-id"),
+          occurredAt: requireOption(options, "at"),
+          assignmentId: requireOption(options, "assignment-id"),
+          workItemId: requireOption(options, "work-item"),
+          producerId: requireOption(options, "producer"),
+          targetWorkspaceRoot: requireOption(options, "target-workspace"),
+          packetPath: requireOption(options, "packet"),
+          entrySnapshotId: options["entry-snapshot"] ?? null,
+          apply: options.apply === true,
+        });
+        return options.json === true
+          ? imported
+          : withHumanOutput(imported, formatExternalDeliveryHuman(imported));
+      }
       if (action === "assign") {
         const directAssignmentFields = [
           "assignment-id",
@@ -2905,9 +3239,13 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           throw new Error("--request cannot be combined with direct assignment fields.");
         }
         if (options.request !== undefined) {
+          const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+          if (requestedEvent?.type !== "agent_assigned") {
+            throw new Error("Project assign request only accepts type=agent_assigned.");
+          }
           return appendTeamProjectEventV1({
             workspaceRoot: root,
-            event: readJson(realpathSync(requireOption(options, "request"))),
+            event: requestedEvent,
           });
         }
         const assigned = assignTeamProjectV1({
@@ -2943,9 +3281,13 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           throw new Error("--request cannot be combined with direct handoff fields.");
         }
         if (options.request !== undefined) {
+          const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+          if (requestedEvent?.type !== "handoff_recorded") {
+            throw new Error("Project handoff request only accepts type=handoff_recorded.");
+          }
           return appendTeamProjectEventV1({
             workspaceRoot: root,
-            event: readJson(realpathSync(requireOption(options, "request"))),
+            event: requestedEvent,
           });
         }
         const handedOff = handoffTeamProjectV1({
@@ -2980,6 +3322,55 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? returned
           : withHumanOutput(returned, formatTeamProjectReworkHuman(returned));
       }
+      if (action === "reopen-upstream") {
+        const evidenceRefs = options.evidence ?? [];
+        if (evidenceRefs.length === 0) {
+          throw new Error("Project reopen-upstream requires at least one --evidence.");
+        }
+        const reopened = reopenUpstreamTeamProjectV1({
+          workspaceRoot: root,
+          reopenId: requireOption(options, "reopen-id"),
+          occurredAt: requireOption(options, "at"),
+          upstreamWorkItemId: requireOption(options, "upstream-work-item"),
+          triggerWorkItemId: requireOption(options, "trigger-work-item"),
+          reviewerAgentId: requireOption(options, "reviewer-agent"),
+          toAgentId: requireOption(options, "to-agent"),
+          reason: requireOption(options, "reason"),
+          nextAction: requireOption(options, "next"),
+          evidenceRefs,
+        });
+        return options.json === true
+          ? reopened
+          : withHumanOutput(reopened, formatTeamProjectUpstreamReopenHuman(reopened));
+      }
+      if (action === "transfer") {
+        const evidenceRefs = options.evidence ?? [];
+        if (evidenceRefs.length === 0) {
+          throw new Error("Project transfer requires at least one --evidence.");
+        }
+        const transferred = transferTeamProjectV1({
+          workspaceRoot: root,
+          transferId: requireOption(options, "transfer-id"),
+          occurredAt: requireOption(options, "at"),
+          assignmentId: requireOption(options, "assignment-id"),
+          workItemId: requireOption(options, "work-item"),
+          fromAgentId: requireOption(options, "from-agent"),
+          toAgentId: requireOption(options, "to-agent"),
+          state: requireOption(options, "state"),
+          summary: requireOption(options, "summary"),
+          completedUnits: options["completed-units"] === undefined
+            ? undefined
+            : Number(options["completed-units"]),
+          evidenceRefs,
+          blockerRefs: options.blocker ?? [],
+          decisionRefs: options.decision ?? [],
+          nextAction: requireOption(options, "next"),
+          sourceFingerprint: options["source-fingerprint"],
+        });
+        return options.json === true
+          ? transferred
+          : withHumanOutput(transferred, formatTeamProjectTransferHuman(transferred));
+      }
       if (action === "decision") {
         const directDecisionFields = [
           "open",
@@ -3002,9 +3393,16 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           throw new Error("--request cannot be combined with direct decision fields.");
         }
         if (options.request !== undefined) {
+          const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+          if (!new Set(["decision_opened", "decision_resolved"])
+            .has(requestedEvent?.type)) {
+            throw new Error(
+              "Project decision request only accepts type=decision_opened or decision_resolved.",
+            );
+          }
           return appendTeamProjectEventV1({
             workspaceRoot: root,
-            event: readJson(realpathSync(requireOption(options, "request"))),
+            event: requestedEvent,
           });
         }
         if (options.open === options.resolve) {
@@ -3205,7 +3603,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         } catch (error) {
           if (error instanceof Error
             && error.message === "Measured work item checkpoint requires completedUnits.") {
-            const projectStatus = readTeamProjectStatusV1({ workspaceRoot: root });
+            const projectStatus = readTeamProjectStatusV2({ workspaceRoot: root });
             const workItem = projectStatus.workItems.find((row) => row.workItemId === workItemId);
             const suggestedUnits = state === "completed"
               ? workItem?.progress.total
@@ -3257,25 +3655,31 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           : withHumanOutput(integrated, formatTeamProjectIntegrationHuman(integrated));
       }
       if (new Set(["checkpoint", "capture"]).has(action)) {
+        const requestedEvent = readJson(realpathSync(requireOption(options, "request")));
+        if (requestedEvent?.type === "source_delivery_imported") {
+          throw new Error(
+            "External source delivery events require verified intake; use project import-delivery.",
+          );
+        }
         return appendTeamProjectEventV1({
           workspaceRoot: root,
-          event: readJson(realpathSync(requireOption(options, "request"))),
+          event: requestedEvent,
         });
       }
       if (action === "status") {
-        const status = readTeamProjectStatusV1({ workspaceRoot: root });
+        const status = readTeamProjectStatusV2({ workspaceRoot: root });
         return options.json === true
           ? status
-          : withHumanOutput(status, formatTeamProjectStatusHumanV1(status));
+          : withHumanOutput(status, formatTeamProjectStatusHumanV2(status));
       }
       if (action === "takeover") {
-        const takeover = buildTeamProjectTakeoverV1({
+        const takeover = buildTeamProjectTakeoverV2({
           workspaceRoot: root,
           agentId: requireOption(options, "agent"),
         });
         return options.json === true
           ? takeover
-          : withHumanOutput(takeover, formatTeamProjectTakeoverHumanV1(takeover));
+          : withHumanOutput(takeover, formatTeamProjectTakeoverHumanV2(takeover));
       }
       if (action === "successor") {
         const successor = successorTeamProjectV1({
@@ -3290,7 +3694,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? successor
           : withHumanOutput(successor, formatTeamProjectSuccessorHumanV1(successor));
       }
-      throw new Error("Usage: owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|decision|verification|integrate|capture|status|takeover|successor> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|decision|verification|integrate|capture|target-snapshot|import-delivery|status|takeover|successor> [options]");
     }
     if (command === "profiles") {
       const root = requireOption(options, "workspace");
@@ -3298,12 +3702,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         if (options.apply === true && options["dry-run"] === true) {
           throw new Error("profiles detect accepts either --apply or --dry-run, not both.");
         }
-        if (options["dry-run"] === true) {
-          return detectProfiles({ workspaceRoot: root });
-        }
-        const detection = detectProfilesV2({ workspaceRoot: root });
+        if (options["dry-run"] === true) return detectProfilesV3({ workspaceRoot: root });
+        const detection = detectProfilesV3({ workspaceRoot: root });
         return options.apply === true
-          ? applyDetectedProfilesV2({ workspaceRoot: root, detection })
+          ? applyDetectedProfilesV3({ workspaceRoot: root, detection })
           : detection;
       }
       if (action === "reconcile") {
@@ -3324,7 +3726,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         if (changedPaths.length === 0) throw new Error("profiles impact requires --changed.");
         return resolveProfilesImpact({ workspaceRoot: root, changedPaths });
       }
-      throw new Error("Usage: owlrunkit profiles <detect|reconcile|validate|impact> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit profiles <detect|reconcile|validate|impact> [options]");
     }
     if (command === "lease") {
       const root = workspace(options);
@@ -3380,24 +3782,55 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         workspaceRoot: workspace(options),
         commandArgv,
         stdinFile: options["stdin-file"],
+        isolate: options.isolate === true,
+        dependencyRoot: options["dependency-root"],
+        ignoredPaths: options["bind-ignored"] ?? [],
+        captureRuntime: options["capture-runtime"] === true,
       });
       if (options.attest !== true || typeof verification.receiptPath !== "string") {
-        return verification;
+        return presentQuickOutcome(verification, options.json === true);
       }
       const details = attestQuickReceiptDetails({
         receiptPath: verification.receiptPath,
         workspaceRoot: workspace(options),
       });
-      return {
+      return presentQuickOutcome({
         ...verification,
         exitCode: details.exitCode === 0 ? verification.exitCode : details.exitCode,
         attestationDecision: details.attestation.decision,
         attestation: details.attestation,
-        nextAllowedAction: details.attestation.decision === "GO"
-          ? "consume_attestation"
-          : "inspect_attestation_issues",
+        nextAllowedAction: verification.status === "quick_verification_runtime_truth_invalid"
+          ? verification.nextAllowedAction
+          : details.attestation.decision === "GO"
+            ? "consume_attestation"
+            : "inspect_attestation_issues",
         authorizationGranted: false,
-      };
+      }, options.json === true);
+    }
+    if (command === "quick-runtime-verify") {
+      return verifyRuntimeTransitionReceipt({
+        workspaceRoot: workspace(options),
+        receiptPath: requireOption(options, "receipt"),
+      });
+    }
+    if (command === "quick-reuse") {
+      if (options.apply === true && options["dry-run"] === true) {
+        throw new Error("quick-reuse accepts either --apply or --dry-run, not both.");
+      }
+      if (options.apply !== true && options["dry-run"] !== true) {
+        throw new Error("quick-reuse requires --dry-run or --apply.");
+      }
+      if (commandArgv.length === 0) {
+        throw new Error("quick-reuse requires an exact delta command after --.");
+      }
+      return runQuickEvidenceReuse({
+        workspaceRoot: workspace(options),
+        baseReceiptPath: requireOption(options, "base-receipt"),
+        allowedPaths: options["allow-path"] ?? [],
+        commandArgv,
+        stdinFile: options["stdin-file"],
+        apply: options.apply === true,
+      });
     }
     if (command === "quick-attest") {
       const details = attestQuickReceiptDetails({
@@ -3419,9 +3852,6 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       };
     }
     if (command === "quick-metrics") {
-      if (options.local !== true) {
-        throw new Error("Quick metrics requires --local; network telemetry is not available.");
-      }
       const local = readLocalQuickMetrics(workspace(options), {
         verbose: options.verbose === true,
       });
@@ -3431,6 +3861,26 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         networkRequests: 0,
       };
     }
+    if (command === "efficiency" && action === "record") {
+      return recordEfficiencyEventV1({
+        workspaceRoot: workspace(options),
+        eventId: requireOption(options, "event-id"),
+        occurredAt: requireOption(options, "at"),
+        kind: requireOption(options, "kind"),
+        workflowId: requireOption(options, "workflow-id"),
+        summary: requireOption(options, "summary"),
+        evidenceRefs: options.evidence ?? [],
+      });
+    }
+    if (command === "efficiency" && action === "status") {
+      const metrics = readEfficiencyMetricsV1({
+        workspaceRoot: workspace(options),
+        verbose: options.verbose === true,
+      });
+      return options.json === true
+        ? metrics
+        : withHumanOutput(metrics, formatEfficiencyMetricsHumanV1(metrics));
+    }
     if (command === "repair") {
       return runRepairExecution({
         workspaceRoot: workspace(options),
@@ -3487,7 +3937,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       return withControlTransaction(root, () => closeout(options));
     }
     if (command === "finish") return finishExecution(options);
-    throw new Error("Usage: owlrunkit <init|doctor|adopt|mode|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-attest|quick-metrics|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
+    throw new Error("Usage: npx --no-install owlrunkit <bootstrap|init|doctor|adopt|mode|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-reuse|quick-runtime-verify|quick-attest|quick-metrics|efficiency|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
   } catch (error) {
     return {
       status: "invalid_input",
@@ -3512,7 +3962,7 @@ if (isDirectExecution(import.meta.url)) {
     ? parseOptions(argv.slice(1), { boolean: ["json", "verbose", "history"] })
     : null;
   const humanInspect = inspectOptions !== null && inspectOptions.json !== true;
-  const onboardingHumanCommand = new Set(["init", "doctor", "adopt", "profiles"]).has(argv[0]);
+  const onboardingHumanCommand = new Set(["bootstrap", "init", "doctor", "adopt", "profiles"]).has(argv[0]);
   const interactiveOnboarding = onboardingHumanCommand
     && !argv.includes("--json")
     && process.stdout.isTTY === true;