owlrunkit 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## 0.22.0
+
+- Adds the independent `OwlCodaRunKitHookRecoveryV1` public contract and
+  `hook recovery` CLI for Codex `SessionStart(source=compact)` consumers.
+- Projects active Project Driver truth even when there is no active execution,
+  while keeping execution and lease state as a separate bounded summary.
+- Binds project identity with a deterministic objective digest, bounded preview,
+  current dominant gap, owner, next action, delivery disposition, warning
+  summary, and latest provable project fact time.
+- Caps the complete JSON response at 2,000 UTF-8 bytes, escapes control and
+  separator characters as untrusted data, and fails closed on redirected,
+  version-mismatched, invalid, or ambiguous control truth.
+- Keeps Compact V1/V2, full inspect, status, and takeover contracts unchanged;
+  Hook recovery remains byte-stable, read-only, zero-write, no-dispatch, and
+  all authority fields remain false.
+
+## 0.21.1
+
+- Adds Inspect Compact V2 with separate lifecycle, Project Driver, and
+  maintenance next actions plus distinct project, maintenance, shared-Skill,
+  and advisory summaries. Historical non-required receipt advisories no longer
+  inflate its actionable warning count.
+- Adds Doctor Report V3. ESLint flat config projects receive a global `ignores`
+  recommendation instead of the obsolete `.eslintignore` advice; only an
+  ignore-only object or ESLint's `globalIgnores()` helper counts as global
+  coverage. Shared-Skill activation is explicitly `eligible`, `blocked`, or
+  `not_evaluated`; unmanaged or drifted bytes remain blocked consistently with
+  fleet planning. Relative launcher warnings remain grouped and non-blocking.
+- Adds Team Recommendation V2 and Team Delivery Status V3. The public field is
+  now `teamCoordinationMode`, making clear that Team projection does not replace
+  ordinary usage-mode assurance. Missing historical verification receipts are
+  advisory and remain non-retroactive.
+- Adds Takeover V4 so completed WorkItems remain visible in history without
+  being presented as a current responsibility or contributing a stale owner
+  next action. Earlier takeover contracts remain unchanged.
+- Keeps project-local bootstrap compatible with the exact published 0.20.1 and
+  0.21.0 predecessor Core identities, and makes Team Delivery Status V3's
+  public schema mechanically keep receipt advisories out of actionable warning
+  summaries.
+
+## 0.21.0
+
+- Adds ExternalGateV1 as typed, source-hash-bound Project Driver truth. A due
+  pending, blocked, or deferred Gate becomes the dominant gap for its delivery
+  stage; superseding observations are append-only and raw capture cannot bypass
+  typed intake.
+- Adds DeliveryLifecycleV1 and Project Status V4 so source acceptance,
+  integration, materialization, deployment, live readback, and product acceptance are distinct
+  evidence facts. Work-ledger completion never auto-promotes a later stage.
+- Adds Team Delivery Status V2 with explicit known-but-unmodeled candidate
+  lanes while retaining one Project Driver graph and read-only, no-dispatch
+  Team coordination.
+- Adds optional WorkItem Quick-evidence policy and
+  `project checkpoint --from-quick-receipt`; ordinary WorkItems remain
+  lightweight and no assurance mode changes automatically.
+- Adds read-only `fleet skill-plan` for affected-project inventory, active
+  execution/lease blockers, and copyable dry-run, install, and rollback
+  commands. It grants no shared-Skill, project, Git, or release authority.
+- Adds a canonical candidate ledger with fixed Git object width, C-locale path
+  ordering, complete path/mode/size/content bindings, and a transport-only raw
+  binary diff. Object-store growth no longer changes the candidate identity.
+- Adds controller-owned `quick-verify --foreign-workspace` and Quick Receipt
+  V4. The target is copied into a disposable consumer; receipts remain under
+  the controller and bind target candidate, filesystem, dependency, command,
+  and before/after observed zero-write evidence without initializing RunKit in
+  the frozen target.
+- Doctor now reports the package-bound and discovered process-wide Skill versions and
+  absolute paths, labels drift as a visible non-blocking warning, and keeps the
+  actually loaded Skill version honest as `unknown`.
+- Replaces the temporal, candidate-only registry policy with a lifecycle-stable
+  registry-gated release artifact policy. The packed README, Skill, policy, and
+  SBOM no longer claim that the package is unpublished or that an older version
+  is still current; adoption still requires independent exact-registry evidence.
+- Treats formatting-only profile reconciliation as an apply-time no-op. The
+  result remains explicit through `normalizationOnly: true`, but owner JSON
+  bytes stay unchanged and no migration receipt or tracked diff is created.
+- Makes a version-mismatched bootstrap return the exact successor install and
+  dry-run commands instead of only reporting the older CLI's own exact spec.
+- Adds `inspect --json --compact`, a bounded projection of project truth,
+  progress, dominant gap, owner, next action, warning groups, execution counts,
+  and the unchanged authority boundary without full execution history.
+- Adds Team Delivery Status V2. Missing receipt warnings now carry severity,
+  blocking and gate semantics, an actionable recommendation, and deterministic
+  aggregation without retroactively requiring Formal evidence.
+- Shows project CLI/Core and process-level shared Skill versions in doctor.
+  Skill drift is explicitly non-blocking and includes a fleet activation
+  blocker when an active execution or lease prevents safe refresh.
+
 ## 0.20.0
 
 - Adds read-only `team recommend` and `team status` projections over the

package/README.md

@@ -67,17 +67,50 @@ Independent verification requires a different assigned Agent. Append-only
 scope revision can widen or narrow a WorkItem after diagnosis without rewriting
 history, and missing Quick/Formal receipt references remain visible warnings.
 
-RunKit 0.20.0 Phase 1 adds Team Delivery as a read-only coordination dimension
+RunKit 0.20 Phase 1 adds Team Delivery as a read-only coordination dimension
 over the existing Project Driver. `team recommend` exits for ordinary
 single-owner work, recommends Team only for real coordination facts, exposes
 owned-path conflicts and independent-acceptance gaps, and never dispatches an
 Agent. `team status` projects the existing project graph without storing a
 second graph. Three strict portable contracts—TeamTaskPacket V2,
 TeamAcceptancePacket V2, and CandidateTransferPacket V1—can be validated on a
-machine that does not have the local `manage-agent-team` Skill. This candidate
+machine that does not have the local `manage-agent-team` Skill. This phase
 does not add automatic or assisted dispatch and does not change Quick or Formal
 assurance.
 
+RunKit 0.21 Phase 2 keeps Team Delivery read-only while making delivery truth
+explicit. Typed external Gates may block the relevant stage without parsing a
+domain product's documents. Source acceptance, integration, materialization, deployment, live
+readback, and product acceptance are separate evidence-bound lifecycle facts.
+Project Status V4 and Team Delivery Status V3 expose that progression and an
+explicit inventory of known-but-unmodeled candidates. An optional WorkItem
+policy can require a currently attested Quick receipt, and `fleet skill-plan`
+shows affected projects, active blockers, and copyable install/rollback commands
+without mutating the shared Skill. No command dispatches an Agent or raises
+assurance automatically.
+
+The same phase adds a fixed-width canonical candidate ledger and
+controller-owned Foreign Quick. A controller running 0.21 may verify a
+disjoint frozen Git worktree without installing RunKit, changing package/lock
+files, or creating `.owlcoda/runkit` in that target. Doctor also exposes the
+package-bound and discovered process-wide Skill identities; it cannot prove which
+instructions an already-running Agent process loaded, so that field remains
+`unknown`.
+
+This release also folds in the upgrade-usability patch: cross-version bootstrap
+failures return copyable install and retry commands; `inspect --json --compact`
+omits historical payloads; Team receipt warnings are non-blocking, actionable,
+and grouped; doctor reports project CLI/Core separately from a process-level
+shared Skill; and formatting-only profile reconciliation is a zero-write apply.
+
+RunKit 0.22 adds a dedicated Hook Recovery projection for Codex
+`SessionStart(source=compact)`. It exposes only the bounded project identity,
+objective digest/preview, current Project Driver gap, execution/lease summary,
+warnings, and false authority boundary needed for a consumer to decide whether
+the project matches its current chat goal. It does not infer chat intent, emit
+full execution or event history, change project state, dispatch an Agent, or
+raise assurance.
+
 The 0.18 Project Driver is a bounded surface for new projects and controlled
 dogfood. Its product name does not claim to be a general long-running,
 multi-phase, or enterprise control plane. Version 0.18 adds one bounded
@@ -91,13 +124,15 @@ separate authority boundaries.
 
 ## Install
 
-`owlrunkit@0.20.0` is an unpublished release candidate. Until registry
-publication is independently verified, the current installable release is
-`owlrunkit@0.19.2`; a locally packed 0.20.0 tarball is for candidate testing
-only and is not adoption provenance.
+This package is the lifecycle-stable, registry-gated `owlrunkit@0.22.0`
+artifact. Registry adoption remains fail-closed until its exact official npm
+version, shasum, integrity, and tarball URL are independently verified. Local
+tarballs remain candidate-test inputs and are never adoption provenance. Until
+that registry evidence exists, use the package only for isolated candidate
+verification; do not treat the command below as available release truth.
 
 ```bash
-npm install --save-exact owlrunkit@0.19.2
+npm install --save-exact owlrunkit@0.22.0
 ```
 
 Use `npx --no-install owlrunkit` for project commands. The package bootstrap
@@ -113,11 +148,12 @@ the project Config must independently bind the same Core.
 ```bash
 npx --no-install owlrunkit --version
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.19.2 --dry-run
+  --exact owlrunkit@0.22.0 --dry-run
 npx --no-install owlrunkit bootstrap --workspace /absolute/path/to/project \
-  --exact owlrunkit@0.19.2 --apply
+  --exact owlrunkit@0.22.0 --apply
 npx --no-install owlrunkit init --workspace /absolute/path/to/project
 npx --no-install owlrunkit doctor --workspace /absolute/path/to/project
+npx --no-install owlrunkit inspect --workspace /absolute/path/to/project --json --compact
 npx --no-install owlrunkit mode recommend --workspace /absolute/path/to/project
 npx --no-install owlrunkit mode status --workspace /absolute/path/to/project
 ```
@@ -129,11 +165,44 @@ back doctor. Dry-run is zero-write; failed apply restores the governed preimage
 and keeps a failure receipt. It reports shared Skill drift but never silently
 updates a user or fleet Skill.
 
+When an older CLI receives a different exact successor spec, bootstrap returns
+two bounded repair commands: install that exact project dependency, then rerun
+the successor's project-local bootstrap dry-run. Doctor keeps shared Skill
+drift non-blocking and reports why fleet-safe activation must wait when an
+active execution or lease is present.
+
 `mode recommend` is read-only and defaults to human output; add `--json` for a
 machine contract. The five user modes are presets over `continuity`
 (`none | project_driver`) and `assurance` (`none | quick | formal`). They never
 grant Git, release, deployment, production, or business authority.
 
+## Hook recovery for compacted sessions
+
+Use the dedicated machine surface instead of full inspect when a Codex Hook
+needs only enough RunKit truth to compare identities after compaction:
+
+```bash
+npx --no-install owlrunkit hook recovery --workspace /absolute/path/to/project --json
+```
+
+The strict `OwlCodaRunKitHookRecoveryV1` response is deterministic and no more
+than 2,000 UTF-8 bytes. It includes `projectId`, `projectTruthHash`, an
+`objectiveDigest`, a bounded `objectivePreview`, progress, headline, dominant
+gap, owner, next action, delivery disposition, execution/open/lease counts,
+aggregated warnings, the latest provable project fact time, and a complete
+all-false authority boundary. Project text is escaped and labeled
+`untrusted_data`; it is data, never an instruction.
+
+The Hook consumer must first compare its current Goal/Done-when with
+`projectId` and the objective digest/preview. Only after that identity check may
+it consider `nextAction`; RunKit does not decide what the current chat means.
+An active Project Driver remains visible when there is no active execution.
+No Project Driver is explicit. Invalid, redirected, version-mismatched, or
+ambiguous control truth fails closed. The command never assigns, checkpoints,
+hands off, takes over, creates an execution, acquires a lease, dispatches an
+Agent, changes assurance, or grants Git, release, deployment, production,
+business, automation, or money authority.
+
 ## Team Delivery: Recommend coordination without dispatch
 
 Team Delivery is separate from continuity and assurance. It reads the current
@@ -156,6 +225,12 @@ raising assurance. Every result keeps Agent dispatch and all external authority
 false. Phase 1 contains no launcher, scheduler, model ranking, or vendor CLI
 federation.
 
+`team status` emits Team Delivery Status V3. Each
+`no_bound_verification_receipt` entry includes `severity`, `blocking`,
+`requiredAtGate`, and `recommendedAction`, plus a separate advisory summary.
+Completed historical WorkItems whose evidence policy did not require a reusable
+receipt are not retroactively told to add Formal evidence.
+
 ## Project Driver: Coordinate a multi-Agent project
 
 RunKit 0.18 keeps the project alive independently of any one Agent or chat.
@@ -244,6 +319,8 @@ a mechanical project invariant without forcing Formal. A verifying or completed
 checkpoint that does not reference a recognizable Quick/Formal receipt remains
 valid project truth but receives `no_bound_verification_receipt`; the warning is
 about the missing bound reference and does not attest any referenced receipt.
+Team Status V3 and Compact V2 surface this non-retroactive fact as an advisory,
+not an actionable warning.
 
 `project work-item revise-scope` appends Event V5 and never rewrites the original
 definition. It must bind the current assignment and owner, records the previous
@@ -371,7 +448,9 @@ and launchers that do not resolve to exact local files. Detection directly
 supports lock-bound npm plus exact project-installed pnpm, Yarn, and Bun
 launchers. A PATH-only package manager remains review-required. A dry-run that
 only canonicalizes JSON formatting reports `normalizationOnly: true` instead of
-showing unexplained hash drift with an empty update list.
+showing unexplained hash drift with an empty update list. Applying that plan is
+a zero-write `profiles_already_current` result: owner bytes remain unchanged and
+no migration receipt or tracked formatting diff is created.
 
 The dry-run is the V2 detection contract. It reports `profiles_insufficient`
 instead of `profiles_detected` when Git-visible source paths are uncovered or
@@ -427,6 +506,9 @@ npx --no-install owlrunkit quick-verify --workspace . --stdin-file ./remote-chec
   -- ssh test-host /bin/sh
 npx --no-install owlrunkit quick-verify --workspace . --isolate \
   --dependency-root /absolute/dependency-consumer -- npm test
+npx --no-install owlrunkit quick-verify --workspace /absolute/controller \
+  --foreign-workspace /absolute/frozen-target \
+  --dependency-root /absolute/dependency-consumer -- npm test
 npx --no-install owlrunkit quick-verify --workspace . \
   --bind-ignored .generated/audit.json -- node ./verify-generated.mjs
 npx --no-install owlrunkit quick-reuse --workspace . \
@@ -461,6 +543,16 @@ into the consumer, prepends its binary directory, and hash-binds package, lock,
 installed-package, and executable metadata before and after execution. RunKit
 does not install dependencies or contact a registry for this command.
 
+`--foreign-workspace` emits Quick Receipt V4 and always uses a disposable
+consumer. The exact project-local CLI, receipt store, stdout/stderr, and any
+stdin material remain under the controller `--workspace`; the target receives
+no RunKit initialization. The receipt records the target realpath, HEAD,
+fixed-width status ledger, path/mode/size/content hashes, before/after governed
+filesystem identity, command argv/cwd, and dependency environment. A permanent
+observed target change invalidates the receipt. This is before/after evidence,
+not an OS write sandbox or proof that no transient write was restored between
+observations.
+
 Repeatable literal `--bind-ignored` paths opt specific ignored workspace bytes
 into Workspace Snapshot V2. Missing is a bound state; file or directory changes
 invalidate Quick. Unrequested ignored paths remain explicitly outside the

package/docs/architecture/OWLCODA_RUNKIT_0201_RELEASE_TRUTH_AND_PROFILE_NORMALIZATION_PATCH_DECISION_20260813.md

@@ -0,0 +1,95 @@
+# OwlRunKit 0.20.1 Release Truth and Profile Normalization Patch Decision
+
+Date: 2026-08-13
+Status: `release_artifact_registry_gated`
+
+## Decision
+
+OwlRunKit 0.20.1 is a bounded patch over 0.20.0. It fixes six defects found by
+installing the official 0.20.0 registry package into an isolated consumer and
+then running bootstrap, doctor, profile validation, Team recommendation, and
+Quick attestation.
+
+The patch does not add Team dispatch, new assurance gates, deployment
+authority, or any other product branch.
+
+## Verified 0.20.0 dogfood facts
+
+- Exact registry installation and project-local bootstrap completed.
+- Doctor was ready, 28 profiles validated, Team recommendation remained
+  read-only, and Quick attestation returned GO.
+- The installed 0.20.0 README, Skill, and release policy still carried stale
+  candidate-lifecycle wording and a stale 0.19.2 registry pointer.
+- Applying profile reconciliation rewrote tracked `profiles.json` bytes for a
+  formatting-only normalization even though the update list was empty.
+- An older bootstrap receiving the 0.20.0 exact spec reported only its own
+  0.19.1 exact spec and a generic issue code instead of the install-and-retry
+  correction.
+- `inspect --json` retained complete execution and Project Driver history for
+  a routine blank-session status read.
+- Five historical `no_bound_verification_receipt` warnings were non-blocking
+  but lacked severity, gate semantics, a recommended action, and aggregation.
+- Doctor was ready while the project CLI/Core and process-level shared Skill
+  were on different versions, with no visible reason why fleet activation was
+  deferred.
+
+## Product contract
+
+### Lifecycle-stable release artifacts
+
+`OwlCodaRunKitRegistryReleasePolicyV2` describes immutable artifact behavior,
+not mutable registry time:
+
+- `status=release_artifact_registry_gated`;
+- `artifactVersion` is the package version;
+- `rollbackRelease` is the exact already-published rollback baseline;
+- adoption requires external exact-registry version, shasum, integrity, and
+  tarball evidence;
+- the artifact does not encode mutable publication state or name a moving
+  latest release.
+
+The V1 policy remains historical and is not reinterpreted in place.
+
+### Formatting-only profile reconciliation
+
+A dry-run may still report `normalizationOnly: true` and show the canonical
+proposal. Applying that same plan is a semantic no-op:
+
+- status is `profiles_already_current`;
+- `writesPerformed=0`;
+- the owner profile bytes remain unchanged;
+- no reconcile receipt is created.
+
+Real profile additions or command/path updates retain the existing atomic
+write, receipt, and rollback behavior.
+
+### Compact, actionable upgrade and recovery output
+
+- A version-mismatched bootstrap returns the exact `npm install --save-exact`
+  command for the requested successor and the matching project-local bootstrap
+  dry-run command.
+- `inspect --json --compact` emits `OwlCodaRunKitInspectCompactV1`: project
+  truth hash, progress, dominant gap, owner, next action, warning groups,
+  execution counts, and the false authority boundary only.
+- Existing full inspect remains unchanged; compact cannot be combined with
+  history, a selected run, or verbose output.
+
+### Team warning and shared Skill diagnosis
+
+Team Delivery Status V2 enriches and groups Project Driver warnings while
+leaving Status V1 unchanged. A missing Quick/Formal reference remains
+non-blocking, does not prove that any receipt was attested, and does not impose
+retroactive Formal work on a completed historical WorkItem.
+
+Doctor reports project-local CLI, project Core, and process-level shared Skill
+versions separately. Shared Skill drift does not change `ready`; if fleet-safe
+activation is blocked by an active execution or lease, the blocker and the
+wait-then-refresh action are visible.
+
+## Authority boundary
+
+This document and the packaged artifact grant no npm publication, project
+adoption, Git integration, deployment, production, or business authority.
+All authorization fields remain false. Registry adoption becomes eligible only
+after separate external evidence binds the exact official-registry version,
+shasum, integrity, and tarball URL.

package/docs/architecture/OWLCODA_RUNKIT_021_TEAM_DELIVERY_PHASE2_PRODUCT_DECISION_20260813.md

@@ -0,0 +1,249 @@
+# OwlRunKit 0.21 Team Delivery Phase 2 Product Decision
+
+Date: 2026-08-13
+Status: `product_contract_definition / implementation_and_release_truth_tracked_separately`
+
+## Decision
+
+OwlRunKit 0.21 extends the existing Project Driver and read-only Team Delivery
+projection with two missing kinds of durable truth:
+
+1. typed external Gates produced by domain-owned adapters; and
+2. an evidence-bound delivery lifecycle that keeps source acceptance,
+   integration, materialization, deployment, live readback, and product acceptance separate.
+
+Project Driver remains the only active task graph. Phase 2 does not add a
+scheduler, start an Agent, select a model, increase assurance, parse arbitrary
+domain documents, or grant Git, release, deployment, production, or business
+authority.
+
+The implementation order is fixed:
+
+1. ExternalGateV1 plus DeliveryLifecycleV1 contracts and read-only projection;
+2. explicit Quick-receipt binding for WorkItems that declare an evidence
+   requirement;
+3. inventory of explicit candidate artifacts not yet represented as active
+   WorkItem lanes; and
+4. copyable fleet Skill dry-run, install, and rollback plans.
+
+The OwlFootball 0.20 dogfood adds three bounded Phase 2 corrections to the
+same release: a canonical candidate identity, controller-owned verification of
+a frozen foreign worktree, and explicit Doctor visibility for package/shared
+Skill drift. Commit-rebinding remains a separate future receipt contract and
+is not implied by these additions.
+
+Assisted or automatic Agent dispatch is not part of 0.21. It requires a later
+Owner decision after real dogfood demonstrates lower handoff time or lower
+controller intervention.
+
+## Stable product model
+
+The independent dimensions remain:
+
+```text
+continuity   none | project_driver
+coordination none | team_delivery
+assurance    none | quick | formal
+acceptance   L0 | L1 | L2 | L3
+authority    externally granted; never inferred by RunKit
+```
+
+Phase 2 adds delivery state without folding it into those dimensions:
+
+```text
+work ledger
+  -> source accepted
+  -> integrated
+  -> materialized
+  -> deployed
+  -> live readback
+  -> product accepted
+```
+
+Every arrow requires a new append-only fact and evidence. A passed source Gate
+does not imply integration. Integration does not imply a sealed or built
+artifact. Materialization does not imply deployment. Deployment does not imply
+a healthy readback. A healthy readback does not imply product or business
+acceptance.
+
+## ExternalGateV1
+
+RunKit does not know what an OwlFootball packaging Gate, a MES runtime Gate, or
+another domain decision means. The domain product owns that judgment. A
+domain-owned adapter may emit one strict generic Gate observation containing:
+
+- a stable Gate identity and title;
+- the delivery stage that requires it;
+- `pending`, `passed`, `blocked`, or `deferred` status;
+- the responsible Agent;
+- adapter identity, source reference, and exact SHA-256 source digest;
+- a concise summary and evidence references; and
+- an all-false authority boundary.
+
+The typed Project Driver command records the observation as an immutable event.
+A later observation must explicitly supersede the current observation for that
+Gate. RunKit validates the structure and source binding; it does not parse or
+reinterpret the domain source.
+
+An unresolved external Gate is visible throughout status projection. Once the
+work ledger is otherwise ready for the Gate's delivery stage, that Gate becomes
+the dominant gap and replaces any misleading execution next action.
+
+## DeliveryLifecycleV1
+
+The lifecycle contains six fixed stages:
+
+| Stage | Positive fact | Other honest outcomes |
+|---|---|---|
+| source | `accepted` | `rejected` |
+| integration | `integrated` | `rejected` |
+| materialization | `materialized` | `failed` |
+| deployment | `deployed` | `failed`, `rolled_back` |
+| live readback | `passed` | `failed` |
+| product acceptance | `accepted` | `rejected`, `deferred` |
+
+A lifecycle record binds one stage, outcome, responsible Agent, evidence, and
+the external Gates used for that transition. The current projection includes
+all six stages, the highest positively established stage, the next required
+stage, any blocking stage, and unresolved external Gates.
+
+The runtime enforces ordering. It rejects integration before source acceptance,
+materialization before integration, deployment before materialization, live
+readback before deployment, and product acceptance before a passed live
+readback. A later correction for the same stage
+must supersede the current stage record. A correction cannot silently rewrite
+downstream facts.
+
+Recording a deployed or accepted fact is evidence bookkeeping only. Every
+result continues to carry `authorizationGranted=false` and cannot authorize the
+underlying action.
+
+## Versioning and compatibility
+
+Published predecessor contracts are immutable:
+
+- TeamProject Event V1-V5 retain their existing bytes and meanings;
+- TeamProject Status V1-V3 retain their existing fields and projections; and
+- Team Delivery Status V1 retains its Phase 1 surface.
+
+Phase 2 uses successor contracts:
+
+- TeamProject Event V6 for external Gate and delivery lifecycle facts;
+- TeamProject Event V7 for WorkItem evidence policy and receipt-bound
+  checkpoint facts;
+- TeamProject Status V4 for ExternalGateV1 and DeliveryLifecycleV1 projection;
+- Team Delivery Status V2 for the corresponding read-only Team view.
+
+Raw generic capture may not create V6 or V7 facts. Operators use typed commands so
+the current Gate, lifecycle ordering, source binding, and exact retry rules are
+checked before the event is written.
+
+## Receipt binding
+
+Phase 2 adds `project work-item require-evidence` and
+`project checkpoint --from-quick-receipt`. The WorkItem policy is append-only
+and may select `none` or `quick`; it does not represent Formal acceptance.
+Receipt binding attests the current Quick receipt and persists an immutable
+reference. It becomes blocking only when the WorkItem contract explicitly
+requires Quick evidence. Existing WorkItems, measurable work, and
+assurance=`none` are not retroactively upgraded to Quick or Formal.
+
+## Explicit candidate inventory
+
+Team Delivery may report `unmodeled_candidate_lanes` only from artifacts RunKit
+can identify explicitly, such as a verified DeliveryPacket, target snapshot,
+data-candidate event, or external Gate. It may not infer a candidate from an
+arbitrary dirty worktree or create a second task graph.
+
+The inventory is read-only. Turning an artifact into active Project Driver work
+requires a separate typed project action and authority.
+
+## Fleet Skill operations
+
+Shared Skill drift remains non-blocking for a project-local CLI unless an exact
+project contract says otherwise. A fleet plan may show affected projects and
+copyable dry-run, install, and rollback commands. It may not silently update a
+shared Skill while any project has an active execution or lease.
+
+## Canonical candidate identity
+
+The primary dirty-candidate identity is a canonical ordered ledger, not a raw
+`git diff` digest. It records the target HEAD and tracked tree plus every
+changed path, prior rename path, operation, Git status, file kind, mode, byte
+length, and content SHA-256. Discovery uses `LC_ALL=C`, disables optional Git
+locks, and fixes `core.abbrev=40`; the command, environment, Git version,
+ledger byte length, ledger hash, and candidate fingerprint are persisted.
+
+The full-index binary diff remains available as a transport artifact with a
+fixed command, but its digest is explicitly not the candidate identity.
+
+## Controller-owned Foreign Quick
+
+`quick-verify --workspace <controller> --foreign-workspace <target>` keeps the
+project-local CLI and every RunKit artifact in the controller. The target must
+be a separate real Git worktree root. RunKit copies its visible source into a
+disposable consumer, optionally projects an already-installed disjoint
+dependency root, and binds Quick Receipt V4 to the target's canonical candidate
+and bounded filesystem identities before and after execution.
+
+The current resolver remains fail-closed: a controller CLI may not masquerade
+as the target's older or absent project-local CLI. `zeroWriteObserved` means
+the governed target state matched before and after; RunKit does not claim an OS
+write sandbox or prove that a transient write restored before the second
+observation never occurred.
+
+## Doctor Skill drift
+
+Doctor reports package-bound and discovered process-wide Skill versions and absolute
+paths. A mismatch is a visible non-blocking warning when the project-local CLI
+and Core are valid. RunKit cannot observe which instruction bytes an existing
+Agent process loaded, so `loadedSkillVersion` remains `unknown` and the repair
+guidance starts a new session using the package-bound Skill. Fleet mutation
+still requires the separate safe plan/install boundary.
+
+## Acceptance scenarios
+
+1. A typed pending external Gate is projected with its source hash, blocks the
+   relevant delivery stage, and becomes the unique dominant gap when due.
+2. A later exact superseding observation may pass the Gate; stale, duplicate,
+   or source-unbound observations fail closed.
+3. Source, integration, materialization, deployment, live readback, and product acceptance each
+   require a separate evidence-bound event and never auto-promote.
+4. Out-of-order lifecycle facts, unresolved required external Gates, and
+   attempts to revise an earlier stage beneath downstream truth fail before
+   writing.
+5. Status V1-V3 and Team Delivery Status V1 remain unchanged; V4/V2 expose the
+   new fields under new schema identities.
+6. Raw project capture cannot bypass typed V6 intake.
+7. Team and Project status remain read-only and dispatch remains disabled.
+8. No result grants Git, release, deployment, production, business, automation,
+   money, credential, or Agent-dispatch authority.
+9. Quick-receipt binding never forces assurance on an existing WorkItem that
+   did not explicitly require it.
+10. Candidate inventory is derived only from explicit artifacts and does not
+    infer arbitrary dirty-worktree truth.
+11. Canonical candidate identity remains byte-stable when only Git object
+    abbreviation settings or unrelated object-store population changes.
+12. Foreign Quick writes receipts only under the controller, creates no target
+    `.owlcoda/runkit`, binds target/dependency/command evidence, and invalidates
+    any permanent governed target delta observed after execution.
+13. Doctor exposes package/process Skill drift and absolute package Skill path
+    without claiming knowledge of the Skill already loaded by an Agent.
+
+## Non-goals
+
+- no automatic or assisted Agent launch;
+- no model or vendor selection;
+- no general scheduler or second graph;
+- no automatic assurance escalation;
+- no parsing of domain product contracts inside Core;
+- no implicit deployment, product acceptance, or business verdict;
+- no shared Skill mutation without fleet-safe explicit invocation;
+- no publication claim from repository source or test success.
+
+## Claims boundary
+
+This document defines the Phase 2 product contract. Its presence does not prove
+implementation completion, package publication, project adoption, shared Skill
+activation, runtime deployment, or business acceptance. Those facts require
+their own current receipts and external readback.