owlrunkit 0.19.2 → 0.21.0

package/scripts/runkit-contract/runkit-cli.mjs

@@ -13,6 +13,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import {
   CORE_VERSION,
@@ -85,7 +86,11 @@ import {
   verifySourceCandidateV1,
   verifySourceCandidateV2,
 } from "./source-candidate.mjs";
-import { buildInspectSummary, formatInspectHuman } from "./inspect-presentation.mjs";
+import {
+  buildInspectCompactV1,
+  buildInspectSummary,
+  formatInspectHuman,
+} from "./inspect-presentation.mjs";
 import { attestQuickReceiptDetails } from "./quick-attest.mjs";
 import { readLocalQuickMetrics } from "./quick-metrics.mjs";
 import { runQuickEvidenceReuse } from "./quick-evidence-reuse.mjs";
@@ -119,6 +124,10 @@ import {
   replaceFleetRegistry,
   rollbackFleetRegistry,
 } from "./fleet-discovery.mjs";
+import {
+  formatFleetSkillUpgradePlanHumanV1,
+  planFleetSkillUpgradeV1,
+} from "./fleet-skill-plan.mjs";
 import {
   RUNKIT_RISK_CATEGORIES,
   routeRunKitAssuranceV2,
@@ -156,7 +165,7 @@ import {
   formatDoctorHuman,
   readAdoptionReadiness,
   readProfileLauncherReadiness,
-  runDoctor,
+  runDoctorV2,
 } from "./onboarding-doctor.mjs";
 import {
   applyOnboardingBootstrapV1,
@@ -173,6 +182,7 @@ import {
   assignTeamProjectV1,
   buildTeamProjectTakeoverV3,
   checkpointTeamProjectV1,
+  checkpointTeamProjectFromQuickReceiptV1,
   closeTeamProjectVerificationV1,
   deferTeamProjectVerificationV1,
   formatTeamProjectStatusHumanV2,
@@ -183,10 +193,14 @@ import {
   openTeamProjectDecisionV1,
   readTeamProjectStatusV2,
   readTeamProjectStatusV3,
+  readTeamProjectStatusV4,
+  reconcileExternalGateV1,
+  recordDeliveryLifecycleV1,
   rejectAndReturnTeamProjectV1,
   reopenUpstreamTeamProjectV1,
   resolveTeamProjectDecisionV1,
   reviseTeamProjectWorkItemScopeV1,
+  setWorkItemEvidenceRequirementV1,
   transferTeamProjectV1,
 } from "./team-project.mjs";
 import {
@@ -197,6 +211,16 @@ import {
   captureTargetWorkspaceSnapshotV1,
   importExternalDeliveryV1,
 } from "./project-external-delivery.mjs";
+import {
+  formatTeamDeliveryRecommendationHumanV1,
+  formatTeamDeliveryStatusHumanV1,
+  formatTeamDeliveryStatusHumanV2,
+  formatTeamPacketValidationHumanV1,
+  readTeamDeliveryStatusV1,
+  readTeamDeliveryStatusV2,
+  recommendTeamDeliveryV1,
+  validateTeamPacketFileV1,
+} from "./team-delivery.mjs";
 
 const TOP_LEVEL_HELP = `OwlRunKit ${CORE_VERSION}
 
@@ -230,14 +254,14 @@ Fleet and status
   npx --no-install owlrunkit fleet <register-root|inspect-registry> [options]
   npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file> [--dry-run]
   npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file>
+  npx --no-install owlrunkit fleet skill-plan --skill-root <directory> --archive-root <directory>
   npx --no-install owlrunkit fleet discover; npx --no-install owlrunkit status --workspace .
-
 Agent team projects
-  npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|work-item revise-scope|decision|verification|capture|target-snapshot|import-delivery|status|takeover|successor> [options]
-  Durable Agent work, dependencies, decisions, gates, progress, and handoffs.
+  npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|work-item revise-scope|work-item require-evidence|reconcile|delivery record|decision|verification|capture|target-snapshot|import-delivery|status|takeover|successor> [options]
+  npx --no-install owlrunkit team <recommend|status|packet validate> [options]
+  Durable project truth plus read-only Team recommendation and packet validation. No Agent dispatch.
 Core successor
   npx --no-install owlrunkit core-successor <plan|apply|resume> --workspace . [...]
-
 Other onboarding commands:
   npx --no-install owlrunkit profiles validate --workspace .; npx --no-install owlrunkit profiles impact --workspace . --changed <path>
   npx --no-install owlrunkit inspect --workspace . --json
@@ -263,6 +287,25 @@ validation, exact registry adoption, and doctor readback. Failed apply restores
 the governed preimage and retains a failure receipt. Shared Skill drift is
 diagnosed only; bootstrap never silently refreshes user or fleet Skills and
 grants no Git, release, deployment, production, or business authority.
+`,
+  inspect: `Usage:
+  npx --no-install owlrunkit inspect --workspace <directory> [--json]
+  npx --no-install owlrunkit inspect --workspace <directory> --json --compact
+  npx --no-install owlrunkit inspect --workspace <directory> --history [--json]
+  npx --no-install owlrunkit inspect --workspace <directory> --run-id <id> [--verbose] [--json]
+
+--compact returns only current project truth, progress, dominant gap, owner,
+next action, warning summary, execution counts, and the authority boundary.
+It never grants Git, release, deployment, production, or business authority.
+`,
+  doctor: `Usage:
+  npx --no-install owlrunkit doctor --workspace <directory>
+    [--registry <url>] [--timeout-ms <milliseconds>]
+    [--skill-root <installed-skill-directory>] [--json]
+
+Checks the project package, Core, registry, profiles, adoption, lifecycle, and
+process-level shared Skill independently. Shared Skill drift is diagnostic and
+non-blocking; it never changes project authority.
 `,
   adopt: `Usage:
   npx --no-install owlrunkit adopt --workspace <directory> --exact owlrunkit@${CORE_VERSION}
@@ -270,6 +313,16 @@ grants no Git, release, deployment, production, or business authority.
 
 Verifies the exact registry release against the project-local install and writes
 project-owned adoption evidence. It grants no Git or release authority.
+`,
+  doctor: `Usage:
+  npx --no-install owlrunkit doctor --workspace <directory>
+    [--skill-root <shared-skill-directory>] [--registry <url>]
+    [--timeout-ms <milliseconds>] [--json]
+
+Diagnoses the project package, Core, registry, profiles, lifecycle, and the
+package-bound versus shared Skill version. A shared Skill mismatch is a visible
+non-blocking warning because the CLI cannot prove which Skill the active Agent
+session already loaded.
 `,
   assurance: `Usage:
   npx --no-install owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
@@ -308,6 +361,69 @@ Persisted mode preferences are not part of this release.
   npx --no-install owlrunkit mode status --workspace <directory> [--json]
 
 Reads the current mode preference source without creating project state.
+`,
+  team: `Usage:
+  npx --no-install owlrunkit team recommend --workspace <directory> [--json]
+  npx --no-install owlrunkit team status --workspace <directory> [--json]
+  npx --no-install owlrunkit team packet validate --workspace <directory>
+    --packet <packet.json> [--json]
+
+Projects existing Project Driver truth into a read-only Team Delivery view and
+validates portable Team packets. It never dispatches an Agent or grants Git,
+release, deployment, production, business, automation, or money authority.
+`,
+  "team recommend": `Usage:
+  npx --no-install owlrunkit team recommend --workspace <directory> [--json]
+
+Recommends Team coordination only when current Project Driver facts require it.
+Single ordinary lanes and uninitialized projects remain off. This is read-only.
+`,
+  "team status": `Usage:
+  npx --no-install owlrunkit team status --workspace <directory> [--json]
+
+Reads a Team Delivery projection from Project Driver. No second graph is stored.
+`,
+  "project reconcile": `Usage:
+  npx --no-install owlrunkit project reconcile --workspace <directory>
+    --reconciliation-id <id> --at <ISO-UTC> --gate-id <id> --title <text>
+    --required-for <source|integration|materialization|deployment|live_readback|product_acceptance>
+    --gate-status <pending|passed|blocked|deferred> --owner-agent <id>
+    --source-adapter <id> --source-ref <ref> --source-sha256 <sha256:hex>
+    --summary <text> --evidence <ref> [--evidence <ref> ...] [--json]
+
+Records one domain-adapter-produced ExternalGateV1 observation. RunKit validates
+the typed source binding but does not parse domain contracts. It grants no Git,
+release, deployment, production, business, or Agent-dispatch authority;
+authorizationGranted remains false.
+`,
+  "project delivery record": `Usage:
+  npx --no-install owlrunkit project delivery record --workspace <directory>
+    --record-id <id> --at <ISO-UTC>
+    --stage <source|integration|materialization|deployment|live_readback|product_acceptance>
+    --stage-status <stage-specific-outcome> --owner-agent <id> --summary <text>
+    --evidence <ref> [--evidence <ref> ...]
+    [--external-gate <id> ...] [--json]
+
+Records one evidence-bound delivery lifecycle fact. The command never performs
+the underlying integration, materialization, deployment, readback, or product acceptance and
+grants no authority for those actions; authorizationGranted remains false.
+`,
+  "project work-item require-evidence": `Usage:
+  npx --no-install owlrunkit project work-item require-evidence --workspace <directory>
+    --policy-id <id> --at <ISO-UTC> --work-item <id> --owner-agent <id>
+    --requirement <none|quick> --reason <text>
+    --evidence <ref> [--evidence <ref> ...] [--json]
+
+Records an explicit WorkItem evidence requirement without selecting or raising
+assurance automatically. Existing WorkItems remain requirement=none until this
+typed action is invoked; authorizationGranted remains false.
+`,
+  "team packet validate": `Usage:
+  npx --no-install owlrunkit team packet validate --workspace <directory>
+    --packet <packet.json> [--json]
+
+Validates a TeamTaskPacketV2, TeamAcceptancePacketV2, or
+CandidateTransferPacketV1 against current project truth without writing state.
 `,
   "quick-attest": `Usage:
   npx --no-install owlrunkit quick-attest --workspace <directory> --receipt <receipt.json> [--json]
@@ -317,6 +433,7 @@ It never grants repository or business authority.
 `,
   "quick-verify": `Usage:
   npx --no-install owlrunkit quick-verify --workspace <directory>
+    [--foreign-workspace <frozen-git-worktree>]
     [--isolate] [--dependency-root <directory>] [--bind-ignored <relative-path> ...]
     [--stdin-file <file>] [--capture-runtime] [--attest] [--json]
     -- <executable> [args...]
@@ -329,6 +446,10 @@ attests the saved receipt without merging Quick and attestation semantics.
 --dependency-root binds and projects an existing dependency environment without
 installing anything. Ignored workspace bytes are bound only by explicit,
 repeatable --bind-ignored literal paths.
+--foreign-workspace keeps the exact project-local CLI and receipt store in the
+controller --workspace, copies the foreign source into a disposable consumer,
+and binds its canonical candidate and whole-tree before/after identities. It
+never initializes or writes RunKit state in the foreign worktree.
 --capture-runtime sets OWLRUNKIT_RUNTIME_REPORT for the exact command and binds
 one strict command-reported external transition without conflating it with
 workspace mutation. Missing or inconsistent runtime truth fails closed while
@@ -392,6 +513,7 @@ non-Formal and grants no Git, release, deployment, production, or business autho
   npx --no-install owlrunkit fleet replace-registry --request <file> --receipt <file> [--registry <file>] [--dry-run]
   npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file> [--registry <file>]
   npx --no-install owlrunkit fleet discover [--fleet-root <directory>] [--fleet-manifest <file>]
+  npx --no-install owlrunkit fleet skill-plan --skill-root <directory> --archive-root <directory>
 `,
   "fleet register-root": `Usage:
   npx --no-install owlrunkit fleet register-root --fleet-root <directory>
@@ -421,6 +543,16 @@ Restores the exact preimage recorded by a replacement receipt.
     [--workspace-root <directory>]
 
 With no source option, discovers the complete fleet inside registered roots.
+`,
+  "fleet skill-plan": `Usage:
+  npx --no-install owlrunkit fleet skill-plan --skill-root <installed-skill-directory>
+    --archive-root <skill-archive-directory>
+    [--workspace-root <directory> ... | --fleet-root <directory> ... |
+     --fleet-manifest <file> | --registry <file>] [--json]
+
+Reads the shared Skill and complete fleet, then reports affected projects,
+active execution or lease blockers, and copyable dry-run, install, and rollback
+commands. It never updates the Skill or any project.
 `,
   profiles: `Usage:
   npx --no-install owlrunkit profiles detect --workspace <directory> [--dry-run | --apply]
@@ -580,7 +712,8 @@ action without granting any authority.
     --state <active|waiting_dependency|waiting_decision|verifying|ready_to_integrate|completed|failed>
     --summary <text> [--completed-units <nonnegative-int>]
     [--evidence <ref> ...] [--blocker <ref> ...] [--decision <id> ...]
-    [--next <text>] [--source-fingerprint <sha256>] [--json]
+    [--next <text>] [--source-fingerprint <sha256>]
+    [--from-quick-receipt <receipt.json>] [--json]
   npx --no-install owlrunkit project verification --workspace <directory> --defer --verification-id <id> --at <ISO-UTC>
     --work-item <id> --owner-agent <id> --check <check-id> [--check <check-id> ...]
     --reason <text> --due-gate <gate-id> [--json]
@@ -612,6 +745,9 @@ No self-reported percentage is accepted.
 Measured WorkItems require --completed-units on every checkpoint. A completed
 checkpoint must use the WorkItem's declared total. Example:
   npx --no-install owlrunkit project checkpoint --workspace . --checkpoint-id checkpoint-x --at 2026-08-11T00:00:00.000Z --assignment-id assign-x --work-item x --state completed --summary 'Completed x.' --completed-units 5 --evidence receipt:quick
+
+--from-quick-receipt re-attests and atomically binds one current GO Quick
+receipt. It is required only when an explicit WorkItem evidence policy says so.
 `,
   "project init": `Usage:
   npx --no-install owlrunkit project init --workspace <directory>
@@ -1796,6 +1932,10 @@ function inspect(options) {
   if (options.history && requestedRunId) throw new Error("inspect --history cannot be combined with --run-id.");
   if (options.verbose && !requestedRunId) throw new Error("inspect --verbose requires --run-id.");
   if (options.history && options.verbose) throw new Error("inspect --history cannot be combined with --verbose.");
+  if (options.compact && options.json !== true) throw new Error("inspect --compact requires --json.");
+  if (options.compact && (options.history || options.verbose || requestedRunId)) {
+    throw new Error("inspect --compact cannot be combined with --history, --verbose, or --run-id.");
+  }
   const controlIssues = [];
   const configPath = runtimePath(root, "config.json");
   const candidateConfig = readJsonForInspection(root, configPath, "Project config", controlIssues);
@@ -2033,13 +2173,14 @@ function inspect(options) {
           execution: executions.find(execution => execution.runId === requestedRunId),
         }
       : { mode: "summary" };
-  return {
+  const inspected = {
     ...result,
     summary,
     view,
     onboarding,
     ...(projectDriver === null ? {} : { projectDriver }),
   };
+  return options.compact === true ? buildInspectCompactV1(inspected) : inspected;
 }
 
 function closeout(options) {
@@ -2307,6 +2448,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       "mode",
       "profiles",
       "project",
+      "team",
     ]).has(command);
     let [action, ...nestedOptions] = nested ? optionValues : [null, ...optionValues];
     if (command === "project" && action === "work-item"
@@ -2314,6 +2456,21 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       action = "work-item revise-scope";
       nestedOptions = nestedOptions.slice(1);
     }
+    if (command === "project" && action === "work-item"
+      && nestedOptions[0] === "require-evidence") {
+      action = "work-item require-evidence";
+      nestedOptions = nestedOptions.slice(1);
+    }
+    if (command === "project" && action === "delivery"
+      && nestedOptions[0] === "record") {
+      action = "delivery record";
+      nestedOptions = nestedOptions.slice(1);
+    }
+    if (command === "team" && action === "packet"
+      && nestedOptions[0] === "validate") {
+      action = "packet validate";
+      nestedOptions = nestedOptions.slice(1);
+    }
     const helpRequested = optionValues.includes("--help")
       || optionValues.includes("-h");
     if (helpRequested) {
@@ -2340,7 +2497,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["allow-path"]
         : command === "profiles" && action === "impact"
         ? ["changed"]
-        : (command === "fleet" && action === "discover")
+        : (command === "fleet" && new Set(["discover", "skill-plan"]).has(action))
           || (command === "core-successor" && action === "plan")
           ? ["fleet-root", "workspace-root"]
         : (command === "lease" && action === "acquire")
@@ -2367,6 +2524,12 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["blocking-work-item", "option", "evidence"]
         : command === "project" && action === "work-item revise-scope"
           ? ["owned-path", "evidence"]
+        : command === "project" && action === "work-item require-evidence"
+          ? ["evidence"]
+        : command === "project" && action === "reconcile"
+          ? ["evidence"]
+        : command === "project" && action === "delivery record"
+          ? ["evidence", "external-gate"]
         : command === "efficiency" && action === "record"
           ? ["evidence"]
           : [],
@@ -2390,8 +2553,10 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ]
         : command === "mode" && action === "status"
           ? ["json"]
+        : command === "team"
+          ? ["json"]
         : command === "inspect"
-        ? ["json", "verbose", "history"]
+        ? ["json", "compact", "verbose", "history"]
         : command === "init"
           ? ["json"]
         : command === "bootstrap"
@@ -2404,7 +2569,9 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["json", "defer", "close"]
         : command === "project" && action === "work-item revise-scope"
           ? ["json", "unmeasured"]
-        : command === "project" && new Set(["init", "assign", "handoff", "reject-and-return", "reopen-upstream", "transfer", "checkpoint", "integrate", "capture", "status", "takeover", "successor"]).has(action)
+        : command === "project" && action === "work-item require-evidence"
+          ? ["json"]
+        : command === "project" && new Set(["init", "assign", "handoff", "reject-and-return", "reopen-upstream", "transfer", "checkpoint", "integrate", "capture", "reconcile", "delivery record", "status", "takeover", "successor"]).has(action)
           ? ["json"]
         : command === "project" && new Set(["target-snapshot", "import-delivery"]).has(action)
           ? ["json", "dry-run", "apply"]
@@ -2412,6 +2579,8 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
             ? ["json"]
         : command === "profiles"
             ? ["json", "dry-run", "apply"]
+        : command === "fleet" && action === "skill-plan"
+          ? ["json"]
         : command === "fleet" && action === "replace-registry"
           ? ["dry-run"]
         : command === "candidate"
@@ -2459,16 +2628,24 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         : withHumanOutput(result, formatOnboardingBootstrapHumanV1(result));
     }
     if (command === "doctor") {
+      assertOnlyOptions(options, [
+        "workspace", "registry", "timeout-ms", "skill-root", "json",
+      ]);
       const timeoutMs = options["timeout-ms"] === undefined
         ? 1_500
         : Number.parseInt(options["timeout-ms"], 10);
       if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 25 || timeoutMs > 10_000) {
         throw new Error("--timeout-ms must be an integer from 25 to 10000.");
       }
-      const report = await runDoctor({
+      const report = await runDoctorV2({
         workspaceRoot: requireOption(options, "workspace"),
+        sharedSkillRoot: options["skill-root"],
+        discoverSharedSkill: true,
         registryUrl: options.registry ?? OFFICIAL_NPM_REGISTRY,
         timeoutMs,
+        ...(options["skill-root"] === undefined
+          ? {}
+          : { skillRoot: options["skill-root"] }),
       });
       report.exitCode = report.status === "ready" ? 0 : 2;
       return options.json === true
@@ -2591,7 +2768,67 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       }
       throw new Error("Usage: npx --no-install owlrunkit mode <recommend|status> --workspace <directory>");
     }
+    if (command === "team") {
+      const root = workspace(options);
+      if (action === "recommend") {
+        assertOnlyOptions(options, ["workspace", "json"]);
+        const recommendation = recommendTeamDeliveryV1({ workspaceRoot: root });
+        return options.json === true
+          ? recommendation
+          : withHumanOutput(
+              recommendation,
+              formatTeamDeliveryRecommendationHumanV1(recommendation),
+            );
+      }
+      if (action === "status") {
+        assertOnlyOptions(options, ["workspace", "json"]);
+        const status = readTeamDeliveryStatusV2({ workspaceRoot: root });
+        return options.json === true
+          ? status
+          : withHumanOutput(status, formatTeamDeliveryStatusHumanV2(status));
+      }
+      if (action === "packet validate") {
+        assertOnlyOptions(options, ["workspace", "packet", "json"]);
+        const validation = validateTeamPacketFileV1({
+          workspaceRoot: root,
+          packetPath: requireOption(options, "packet"),
+        });
+        return options.json === true
+          ? validation
+          : withHumanOutput(validation, formatTeamPacketValidationHumanV1(validation));
+      }
+      throw new Error(
+        "Usage: npx --no-install owlrunkit team <recommend|status|packet validate> --workspace <directory>",
+      );
+    }
     if (command === "fleet") {
+      if (action === "skill-plan") {
+        assertOnlyOptions(options, [
+          "skill-root",
+          "archive-root",
+          "workspace-root",
+          "fleet-root",
+          "fleet-manifest",
+          "registry",
+          "json",
+        ]);
+        const plan = await planFleetSkillUpgradeV1({
+          repositoryRoot: path.resolve(
+            path.dirname(fileURLToPath(import.meta.url)),
+            "../..",
+          ),
+          targetRoot: requireOption(options, "skill-root"),
+          archiveRoot: requireOption(options, "archive-root"),
+          workspaceRoots: options["workspace-root"] ?? null,
+          fleetRoots: options["fleet-root"] ?? null,
+          fleetManifestPath: options["fleet-manifest"] ?? null,
+          fleetRegistryPath: options.registry ?? null,
+        });
+        const result = { ...plan, exitCode: plan.status === "ready" ? 0 : 2 };
+        return options.json === true
+          ? result
+          : withHumanOutput(result, formatFleetSkillUpgradePlanHumanV1(plan));
+      }
       if (action === "register-root") {
         const registered = await registerFleetCoverageRoot({
           fleetRoot: requireOption(options, "fleet-root"),
@@ -2632,7 +2869,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         };
       }
       if (action !== "discover") {
-        throw new Error("Usage: npx --no-install owlrunkit fleet <register-root|inspect-registry|replace-registry|rollback-registry|discover>");
+        throw new Error("Usage: npx --no-install owlrunkit fleet <register-root|inspect-registry|replace-registry|rollback-registry|discover|skill-plan>");
       }
       const discovered = await discoverFleet({
         fleetRoots: options["fleet-root"] ?? null,
@@ -3411,6 +3648,19 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           "owner-agent", "owned-path", "measurable-unit", "measurable-total",
           "unmeasured", "reason", "evidence", "json",
         ],
+        "work-item require-evidence": [
+          "workspace", "policy-id", "at", "work-item", "owner-agent",
+          "requirement", "reason", "evidence", "json",
+        ],
+        reconcile: [
+          "workspace", "reconciliation-id", "at", "gate-id", "title",
+          "required-for", "gate-status", "owner-agent", "source-adapter",
+          "source-ref", "source-sha256", "summary", "evidence", "json",
+        ],
+        "delivery record": [
+          "workspace", "record-id", "at", "stage", "stage-status",
+          "owner-agent", "summary", "evidence", "external-gate", "json",
+        ],
         decision: [
           "workspace", "request", "open", "resolve", "decision-id", "at", "title",
           "question", "owner-agent", "blocking-work-item", "option", "resolution",
@@ -3419,7 +3669,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
         checkpoint: [
           "workspace", "request", "checkpoint-id", "at", "assignment-id", "work-item",
           "state", "summary", "completed-units", "evidence", "blocker", "decision",
-          "next", "source-fingerprint", "json",
+          "next", "source-fingerprint", "from-quick-receipt", "json",
         ],
         verification: [
           "workspace", "request", "defer", "close", "verification-id", "at",
@@ -3687,6 +3937,83 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
               "",
             ].join("\n"));
       }
+      if (action === "work-item require-evidence") {
+        const evidenceRefs = options.evidence ?? [];
+        if (evidenceRefs.length === 0) {
+          throw new Error("WorkItem evidence requirement requires at least one --evidence.");
+        }
+        const policy = setWorkItemEvidenceRequirementV1({
+          workspaceRoot: root,
+          policyId: requireOption(options, "policy-id"),
+          occurredAt: requireOption(options, "at"),
+          workItemId: requireOption(options, "work-item"),
+          ownerAgentId: requireOption(options, "owner-agent"),
+          requirement: requireOption(options, "requirement"),
+          reason: requireOption(options, "reason"),
+          evidenceRefs,
+        });
+        return options.json === true
+          ? policy
+          : withHumanOutput(policy, [
+              `WorkItem ${policy.workItemId} evidence requirement: ${policy.requirement}.`,
+              "Assurance was not changed and authority was not granted.",
+              "",
+            ].join("\n"));
+      }
+      if (action === "reconcile") {
+        const evidenceRefs = options.evidence ?? [];
+        if (evidenceRefs.length === 0) {
+          throw new Error("Project reconcile requires at least one --evidence.");
+        }
+        const reconciled = reconcileExternalGateV1({
+          workspaceRoot: root,
+          reconciliationId: requireOption(options, "reconciliation-id"),
+          occurredAt: requireOption(options, "at"),
+          gateId: requireOption(options, "gate-id"),
+          title: requireOption(options, "title"),
+          requiredFor: requireOption(options, "required-for"),
+          gateStatus: requireOption(options, "gate-status"),
+          ownerAgentId: requireOption(options, "owner-agent"),
+          sourceAdapterId: requireOption(options, "source-adapter"),
+          sourceRef: requireOption(options, "source-ref"),
+          sourceSha256: requireOption(options, "source-sha256"),
+          summary: requireOption(options, "summary"),
+          evidenceRefs,
+        });
+        return options.json === true
+          ? reconciled
+          : withHumanOutput(reconciled, [
+              `External Gate ${reconciled.gateId}: ${reconciled.gateStatus}.`,
+              `Next: ${reconciled.nextAction ?? "none"}.`,
+              "Authority: not granted.",
+              "",
+            ].join("\n"));
+      }
+      if (action === "delivery record") {
+        const evidenceRefs = options.evidence ?? [];
+        if (evidenceRefs.length === 0) {
+          throw new Error("Project delivery record requires at least one --evidence.");
+        }
+        const recorded = recordDeliveryLifecycleV1({
+          workspaceRoot: root,
+          recordId: requireOption(options, "record-id"),
+          occurredAt: requireOption(options, "at"),
+          stage: requireOption(options, "stage"),
+          stageStatus: requireOption(options, "stage-status"),
+          ownerAgentId: requireOption(options, "owner-agent"),
+          summary: requireOption(options, "summary"),
+          evidenceRefs,
+          externalGateIds: options["external-gate"] ?? [],
+        });
+        return options.json === true
+          ? recorded
+          : withHumanOutput(recorded, [
+              `Delivery stage ${recorded.stage}: ${recorded.stageStatus}.`,
+              `Next: ${recorded.nextAction ?? "none"}.`,
+              "Authority: not granted.",
+              "",
+            ].join("\n"));
+      }
       if (action === "decision") {
         const directDecisionFields = [
           "open",
@@ -3873,6 +4200,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           "decision",
           "next",
           "source-fingerprint",
+          "from-quick-receipt",
         ];
         const hasDirectCheckpointFields = directCheckpointFields.some(
           name => options[name] !== undefined,
@@ -3901,7 +4229,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           : parseCanonicalNonnegativeSafeInteger(options["completed-units"], "completed-units");
         let checkpointed;
         try {
-          checkpointed = checkpointTeamProjectV1({
+          const checkpointInput = {
             workspaceRoot: root,
             checkpointId,
             occurredAt,
@@ -3915,7 +4243,13 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
             decisionRefs: options.decision ?? [],
             nextAction: options.next ?? null,
             sourceFingerprint: options["source-fingerprint"],
-          });
+          };
+          checkpointed = options["from-quick-receipt"] === undefined
+            ? checkpointTeamProjectV1(checkpointInput)
+            : checkpointTeamProjectFromQuickReceiptV1({
+                ...checkpointInput,
+                receiptPath: options["from-quick-receipt"],
+              });
         } catch (error) {
           if (error instanceof Error
             && error.message === "Measured work item checkpoint requires completedUnits.") {
@@ -3977,13 +4311,25 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
             "External source delivery events require verified intake; use project import-delivery.",
           );
         }
+        if (new Set([
+          "external_gate_reconciled",
+          "delivery_lifecycle_recorded",
+          "work_item_evidence_requirement_set",
+          "checkpoint_receipt_bound",
+        ])
+          .has(requestedEvent?.type)) {
+          throw new Error(
+            "Phase 2 facts require typed project reconcile, project delivery record, "
+            + "project work-item require-evidence, or project checkpoint intake.",
+          );
+        }
         return appendTeamProjectEventV1({
           workspaceRoot: root,
           event: requestedEvent,
         });
       }
       if (action === "status") {
-        const status = readTeamProjectStatusV3({ workspaceRoot: root });
+        const status = readTeamProjectStatusV4({ workspaceRoot: root });
         return options.json === true
           ? status
           : withHumanOutput(status, formatTeamProjectStatusHumanV2(status));
@@ -4010,7 +4356,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? successor
           : withHumanOutput(successor, formatTeamProjectSuccessorHumanV1(successor));
       }
-      throw new Error("Usage: npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|work-item revise-scope|decision|verification|integrate|capture|target-snapshot|import-delivery|status|takeover|successor> [options]");
+      throw new Error("Usage: npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|work-item revise-scope|reconcile|delivery record|decision|verification|integrate|capture|target-snapshot|import-delivery|status|takeover|successor> [options]");
     }
     if (command === "profiles") {
       const root = requireOption(options, "workspace");
@@ -4096,6 +4442,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       }
       const verification = await runQuickVerification({
         workspaceRoot: workspace(options),
+        foreignWorkspaceRoot: options["foreign-workspace"],
         commandArgv,
         stdinFile: options["stdin-file"],
         isolate: options.isolate === true,
@@ -4253,7 +4600,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       return withControlTransaction(root, () => closeout(options));
     }
     if (command === "finish") return finishExecution(options);
-    throw new Error("Usage: npx --no-install owlrunkit <bootstrap|init|doctor|adopt|mode|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-reuse|quick-runtime-verify|quick-attest|quick-metrics|efficiency|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
+    throw new Error("Usage: npx --no-install owlrunkit <bootstrap|init|doctor|adopt|mode|team|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-reuse|quick-runtime-verify|quick-attest|quick-metrics|efficiency|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
   } catch (error) {
     return {
       status: "invalid_input",
@@ -4275,7 +4622,7 @@ if (isDirectExecution(import.meta.url)) {
     },
   });
   const inspectOptions = argv[0] === "inspect" && result.status === "inspected"
-    ? parseOptions(argv.slice(1), { boolean: ["json", "verbose", "history"] })
+    ? parseOptions(argv.slice(1), { boolean: ["json", "compact", "verbose", "history"] })
     : null;
   const humanInspect = inspectOptions !== null && inspectOptions.json !== true;
   const onboardingHumanCommand = new Set(["bootstrap", "init", "doctor", "adopt", "profiles"]).has(argv[0]);