wicked-crew-api-types 0.148.0 → 0.167.0

package/index.d.ts

@@ -346,6 +346,19 @@ export interface HealthCapabilities {
    * and `POST /runs/:id/working-doc/versions` ({@link WorkingDocView}). ABSENT on an older daemon — read as `false`.
    */
   workingDoc?: boolean;
+  /**
+   * (api-types 0.149.0, power mode) The engine runs POWER MODE: `LaunchRunBody.power`, `GET|POST /runs/:id/power`,
+   * `POST /runs/:id/rigor`, `POST /runs/:id/power/pause`, `GET /runs/:id/bus` ({@link RunBusPage}),
+   * `AgentSession.power` ({@link PowerState}) and the power frames ({@link PowerEvent}).
+   * ABSENT on an older daemon: read as `false` and hide the switch.
+   */
+  powerMode?: boolean | undefined;
+  /**
+   * (api-types 0.156.0, DES-VOICE) Voice mode's routes are served: `GET /voice/status`, `POST|DELETE /voice/model`,
+   * `POST /voice/transcribe` and `GET|PUT /voice/dashboard`. Whether transcription can run NOW (the engine and
+   * the model are on this machine) is {@link VoiceStatus.ready}. ABSENT on an older daemon: read as `false`.
+   */
+  voice?: boolean;
 }
 
 // ── A run's working document (program DES-POWER-MODE §8.3, §9; api-types 0.148.0) ──────────────────
@@ -353,10 +366,12 @@ export interface HealthCapabilities {
 /** The working document's sections, in order. */
 export type WorkingDocSectionId = 'goal' | 'approach' | 'decisions' | 'constraints' | 'questions' | 'next';
 
-/** Who wrote a version: a person (the operator), a plugin's own generated lines, or crew (the first version). */
+/** Who wrote a version: a person (the operator), a plugin's own generated lines, the power orchestrator's own notes
+ *  (`agent`, id `agent:<seat>`: Approach and Decisions only, never a steer), or crew (the first version). */
 export type WorkingDocAuthor =
   | { kind: 'human'; id: string }
   | { kind: 'plugin'; id: string }
+  | { kind: 'agent'; id: string }
   | { kind: 'system'; id: 'crew' };
 
 /** One version of the working document, as crew attributed it. */
@@ -394,6 +409,9 @@ export interface WorkingDocSteer {
   error: string | null;
   supersededBy?: string | null;
   renewals?: number;
+  /** (0.161.0, DES-VOICE) The person said the edit and confirmed it on screen: the thread says "You (by voice)".
+   *  ABSENT on a typed edit (and on an older daemon). It grants nothing. */
+  input?: 'voice';
 }
 
 /** `GET /runs/:id/working-doc` (and the body of `POST /runs/:id/working-doc`). */
@@ -405,15 +423,23 @@ export interface WorkingDocView {
   labels: Record<WorkingDocSectionId, string>;
   trail: WorkingDocTrailEntry[];
   steers: WorkingDocSteer[];
+  /** (0.151.0) `true` when crew itself writes the document's event-derived lines (Decisions answered, Open questions,
+   *  Next) from the run's own log, as `plugin:wicked-phase-report@…`: a host plugin then writes none of its own and
+   *  only renders and takes a person's edits. ABSENT on an older daemon — read as `false` (the plugin keeps writing). */
+  eventLines?: boolean;
 }
 
 /** `POST /runs/:id/working-doc/versions`. `author: 'operator'` only from a person; `author: 'plugin'` writes only the
- *  plugin's own section (`decisions`). 409 `{head}` when the document moved since `base`. */
+ *  plugin's own lines, under `decisions`, `questions` and `next` (never `goal`, `approach` or `constraints`: 403). A
+ *  plugin's write never steers, in any section (`steer` is null). 409 `{head}` when the document moved since `base`. */
 export interface ProposeWorkingDocRequest {
   base: number;
   sections: Partial<Record<WorkingDocSectionId, string>>;
   author: 'operator' | 'plugin';
   plugin?: { id: string; version: string };
+  /** (0.161.0, DES-VOICE) The person said this edit and confirmed it on screen. On `author: 'operator'` only (400
+   *  otherwise); kept on the steer ({@link WorkingDocSteer.input}) and the `run.steered.doc` audit line. */
+  input?: 'voice';
 }
 
 export interface ProposeWorkingDocResponse {
@@ -431,6 +457,437 @@ export interface WorkingDocChangedEvent {
   head: number | null;
 }
 
+// ── Power mode (program DES-POWER-MODE; api-types 0.149.0) ──────────────────────────────────────────
+//
+// One orchestrator seat session builds the whole change in many turns; rigor is sized at intake, re-scored at
+// checkpoints from the actual diff, and applied once at hand-off. The ENGINE computes every rigor value: nothing on a
+// request or a plugin can lower it. Field names are camelCase on every surface (session, route, frame, bus row).
+
+/** The operator's word for the engine's floor band (core `review_scale` bands): light 0-19, standard 20-39,
+ *  high 40-69, highest 70-100 (or destructive). */
+export type Rigor = 'light' | 'standard' | 'high' | 'highest';
+
+/** What re-scored the run. `intake` is the QE plan; `commit` / `turn` / `timer` / `pre_handoff` are checkpoints;
+ *  `operator` / `plugin` / `doc_edit` are raises; `toggle` records a power switch flip. */
+export type RigorTrigger =
+  | 'intake' | 'commit' | 'turn' | 'timer' | 'pre_handoff'
+  | 'operator' | 'plugin' | 'doc_edit' | 'toggle';
+
+/** A level rigor can never go below, and who set it. */
+export interface RigorFloor {
+  rigor: Rigor;
+  /** `policy` (the assurance contract / required phases), `compliance` (a steering rule), `qe_plan`, `operator`,
+   *  `plugin`, `doc_edit`. */
+  by: 'policy' | 'compliance' | 'qe_plan' | 'operator' | 'plugin' | 'doc_edit';
+  why: string;
+}
+
+/** What hand-off will apply, as the current rigor sizes it. */
+export interface HandoffRequirements {
+  /** `targeted`: the floor runs the change's targeted tests; `full`: the repo's full suite. */
+  tests: 'targeted' | 'full';
+  /** Reviews on a seat distinct from the orchestrator (never the builder, nor its subagents). `design` is not a
+   *  separate step: the `review` step ({@link HandoffStep}) also judges the orchestrator's approach and counts as the
+   *  band's `design` phase (operator ruling 2026-10-29); it is listed so the card can say so. */
+  reviews: Array<{ kind: 'distinct_seat' | 'design' | 'security'; why: string }>;
+  qeAcceptance: { required: boolean; why: string };
+  /** Named checks beyond the repo's floor (QE plan / plugin added), in order. */
+  checks: string[];
+}
+
+/** The intake QE plan's rigor record (`wicked.run.intake.planned`). The band is the engine's intent score of the
+ *  declared scope; the QE plan (garden qe-risk-assessor + qe-test-strategist) can only RAISE it. */
+export interface RigorPlan {
+  rigor: Rigor;
+  /** The engine's 0-100 intent score and its band (`"20-39"`). */
+  score: number;
+  band: string;
+  highRisk: boolean;
+  /** Plain reasons for the band (the scorer's, then the QE plan's). */
+  reasons: string[];
+  handoff: HandoffRequirements;
+  /** Phases that stay phased even in power mode (policy, a steering rule, or the QE plan), with why. */
+  mandatoryPhases: Array<{ phase: string; why: string }>;
+  /** Non-null when power mode is refused for this run (policy or the plan requires phased), in one line. */
+  phasedRequired: string | null;
+  /** The QE plan's time estimate for the build, minutes; null when it gave none. */
+  estimateMinutes: number | null;
+  /** The QE plan's risks and planned test scenarios (pass 1), plain lines. */
+  risks: string[];
+  scenarios: string[];
+  /** What rigor can never go below. */
+  floors: RigorFloor[];
+  /** The seat that planned (the intake unit's seat), and when (unix millis). */
+  plannedBy: string;
+  at: number;
+}
+
+/** The signals one checkpoint read from the actual diff. */
+export interface RigorSignals {
+  files: number;
+  lines: number;
+  /** Graph dependents within the scorer's hops; null when the graph could not be read. */
+  dependents: number | null;
+  /** Products (top-level areas) the diff spans. */
+  spread: number;
+  newDependencies: number;
+  /** Sensitive areas touched: critical-path markers and steering-rule areas, plain words. */
+  sensitive: string[];
+  struggle: {
+    failedRuns: number;
+    reverts: number;
+    turns: number;
+    elapsedMinutes: number;
+    estimateMinutes: number | null;
+    /** 0-100; at or over the struggle line pauses the session. */
+    score: number;
+  };
+  /** Planned scenarios with no test yet, or new surfaces the plan did not cover. */
+  planGaps: string[];
+}
+
+/** One rigor-history row (`wicked.run.rigor.rescored`), written EVERY time the run is re-scored, raised, lowered or
+ *  toggled — also when nothing changed (`direction: 'same'`). */
+export interface RigorChange {
+  /** 1-based, per run. */
+  seq: number;
+  at: number;
+  trigger: RigorTrigger;
+  /** Rigor before and after. The `intake` row has `from === to` (the planned rigor). Null only on a `toggle` row
+   *  written before intake planned anything. */
+  from: Rigor | null;
+  to: Rigor | null;
+  direction: 'up' | 'down' | 'same';
+  /** The intake score, the score now, and `actual - planned`. */
+  planned: number;
+  actual: number;
+  delta: number;
+  reasons: string[];
+  signals: RigorSignals | null;
+  /** `engine`, a person's actor id, or `plugin:<id>@<version>`. */
+  by: string;
+  /** What held rigor up when a lowering was capped (empty otherwise). */
+  floors: RigorFloor[];
+  /** The checkpoint ordinal (1-based) and the orchestrator turn, when a checkpoint wrote it. */
+  checkpoint: number | null;
+  turn: number | null;
+  /** This checkpoint paused the session ("suddenly complex"); see {@link PowerPause}. */
+  paused: boolean;
+}
+
+/** One flip of the power switch. */
+export interface PowerToggle {
+  at: number;
+  on: boolean;
+  by: string;
+  reason: string | null;
+  /** The phases that stay phased after an Off -> On flip (the plan mandates them). */
+  stayPhased: string[];
+}
+
+/** The session is paused at a checkpoint: a two-band jump, a destructive marker, spread into another product, a new
+ *  dependency in a sensitive area, or struggle past its line. The orchestrator waits at its turn end (the run stays
+ *  `executing`; no engine gate opens under an in-flight unit) until `POST /runs/:id/power/pause`
+ *  ({@link PowerPauseRequest}) answers. */
+export interface PowerPause {
+  at: number;
+  checkpoint: number;
+  reasons: string[];
+  /** `split` is recommended when the diff spans two or more products. */
+  recommended: 'split' | 'switch_phased' | 'continue_high' | 'stop';
+}
+
+/** One hand-off step as it ran. */
+export interface HandoffStep {
+  step: 'rescore' | 'checks' | 'review' | 'security' | 'qe' | 'compliance';
+  /** The hand-off round this row belongs to (1-based): a failed round's rows stay, the next round adds its own. */
+  round: number;
+  ord: number | null;
+  status: 'pending' | 'running' | 'passed' | 'failed' | 'skipped';
+  /** The seat that ran it (never the orchestrator for a review / QE). */
+  seat: string | null;
+  summary: string | null;
+  at: number;
+}
+
+/** A run's power-mode state: `AgentSession.power`, and the body of `GET /runs/:id/power`. */
+export interface PowerState {
+  /** The switch, now. */
+  on: boolean;
+  /** False when policy or the plan requires phased; {@link refusedReason} says why. */
+  available: boolean;
+  refusedReason: string | null;
+  /** Current rigor (null before intake has planned). */
+  rigor: Rigor | null;
+  plan: RigorPlan | null;
+  history: RigorChange[];
+  toggles: PowerToggle[];
+  /** The orchestrator seat session: its seat, the build unit, turns so far, and whether it is in a turn now. */
+  orchestrator: { cli: string | null; ord: number | null; turns: number; inTurn: boolean; sessionRestarts: number };
+  /** Every orchestrator turn so far, oldest first (at most the last 50). */
+  turnLog: PowerTurnRecord[];
+  checkpoints: number;
+  /** The hand-off as it runs: round 1 is the first hand-off; a failure goes back to the SAME session as a new turn
+   *  and starts the next round. After `maxRounds` the run asks the operator. */
+  handoff: { round: number; maxRounds: number; steps: HandoffStep[] } | null;
+  pause: PowerPause | null;
+  /** The insights row for planned vs actual (written when the run ends). */
+  outcome: PowerOutcome | null;
+  /** Floors set after launch (an operator's raise), kept whether or not intake planned anything; the intake plan's own
+   *  are on `plan.floors`. Rigor never goes below any of them. */
+  floors: RigorFloor[];
+}
+
+/** One orchestrator turn as recorded. */
+export interface PowerTurnRecord {
+  turn: number;
+  attempt: number;
+  cli: string;
+  startedAt: number;
+  endedAt: number | null;
+  outcome: 'checkpoint' | 'handoff' | 'paused' | 'failed' | 'cap' | null;
+  summary: string | null;
+}
+
+/** Planned vs actual, recorded when a power run ends (the insights calibration input). */
+export interface PowerOutcome {
+  plannedRigor: Rigor;
+  finalRigor: Rigor;
+  plannedScore: number;
+  finalScore: number;
+  estimateMinutes: number | null;
+  actualMinutes: number;
+  turns: number;
+  checkpoints: number;
+  handoffRounds: number;
+  operatorGates: number;
+  outcome: 'delivered' | 'completed' | 'failed' | 'cancelled';
+}
+
+/** `GET /runs/:id/power` (404 for an unknown run; a run launched phased answers `on: false`). */
+export interface PowerView extends PowerState {
+  runId: string;
+}
+
+/** `POST /runs/:id/power`: flip the switch; 200 answers {@link PowerView}. On -> Off is always allowed (adds rigor;
+ *  the remaining work goes phased). Off -> On is allowed only for phases the plan does not mandate; a phased-required
+ *  run answers 409 {@link PowerConflict}. Human actors only; audited `run.power_mode.toggled`. */
+export interface PowerToggleRequest {
+  on: boolean;
+  reason?: string | null | undefined;
+}
+
+/** `POST /runs/:id/rigor`: raise rigor; 200 answers {@link PowerView}. Never lowers: a lower or equal `atLeast` is
+ *  409 {@link PowerConflict}. The raise becomes a floor. Human actors only; audited `run.rigor.raised`. */
+export interface RigorRaiseRequest {
+  atLeast: Rigor;
+  reason: string;
+}
+
+/** `POST /runs/:id/power/pause`: answer a checkpoint pause ({@link PowerPause}); 200 answers {@link PowerView}.
+ *  `continue_high` raises rigor to at least high (an operator floor), `continue` goes on (the `note`, if any, is the
+ *  next turn's steer), `switch_phased` flips the switch off (the build hands off as it stands), `stop` cancels the
+ *  run. 409 {@link PowerConflict} when the run is not paused. Human actors only; audited `run.power_mode.paused`. */
+export interface PowerPauseRequest {
+  decision: 'continue_high' | 'continue' | 'switch_phased' | 'stop';
+  note?: string | null | undefined;
+}
+
+/** The 409 (and 422) body of the power routes. */
+export interface PowerConflict {
+  error: string;
+  reason: string;
+}
+
+/** `/ws` frame: intake planned the run's rigor (bus `wicked.run.intake.planned`). */
+export type PowerIntakePlannedEvent = {
+  type: 'powerIntakePlanned';
+  session: string;
+  ord: number;
+  plan: RigorPlan;
+};
+
+/** `/ws` frame: the run was re-scored, raised, lowered or toggled (bus `wicked.run.rigor.rescored`). */
+export type RigorRescoredEvent = {
+  type: 'rigorRescored';
+  session: string;
+  change: RigorChange;
+};
+
+/** `/ws` frame: a checkpoint ran (bus `wicked.run.checkpoint.reached`). `picked` = the operator messages and doc
+ *  steers the next turn's prompt carries. */
+export type PowerCheckpointEvent = {
+  type: 'powerCheckpointReached';
+  session: string;
+  ord: number;
+  checkpoint: number;
+  turn: number;
+  trigger: 'commit' | 'turn' | 'timer' | 'pre_handoff';
+  /** The worktree HEAD at the checkpoint (short sha), null before the first commit. */
+  head: string | null;
+  picked: number;
+  rigor: Rigor;
+  paused: boolean;
+  /** The pause this checkpoint opened (also on `PowerState.pause`), else null. */
+  pause: PowerPause | null;
+  at: number;
+};
+
+/** `/ws` frame: an orchestrator turn started (bus `wicked.run.turn.started`). */
+export type PowerTurnStartedEvent = {
+  type: 'powerTurnStarted';
+  session: string;
+  ord: number;
+  attempt: number;
+  turn: number;
+  cli: string;
+};
+
+/** `/ws` frame: an orchestrator turn ended (bus `wicked.run.turn.completed`). `outcome`: `checkpoint` (more turns
+ *  follow), `handoff` (the orchestrator declared hand-off), `paused`, `failed`, `cap` (the turn cap; handed off). */
+export type PowerTurnCompletedEvent = {
+  type: 'powerTurnCompleted';
+  session: string;
+  ord: number;
+  attempt: number;
+  turn: number;
+  cli: string;
+  outcome: 'checkpoint' | 'handoff' | 'paused' | 'failed' | 'cap';
+  /** The orchestrator's one-line summary, or null. */
+  summary: string | null;
+};
+
+export type PowerTurnEvent = PowerTurnStartedEvent | PowerTurnCompletedEvent;
+
+/** `/ws` frame: a hand-off step changed (bus `wicked.run.handoff.stepped`). */
+export type PowerHandoffEvent = {
+  type: 'powerHandoffStepped';
+  session: string;
+  round: number;
+  maxRounds: number;
+  step: HandoffStep;
+};
+
+/** `/ws` frame: the power switch flipped (bus `wicked.run.power.toggled`). */
+export type PowerToggledEvent = {
+  type: 'powerToggled';
+  session: string;
+  toggle: PowerToggle;
+};
+
+/** `/ws` frame: what the orchestrator did in the worktree, read off git by the engine (bus
+ *  `wicked.run.activity.recorded`). Polled about once a minute during a turn and at its end, so rows arrive in
+ *  batches, not keystroke by keystroke. `edit`: a file whose +/- against the run's base changed since the last look
+ *  (`path`, `added`, `removed`: the file's totals against the base, not the delta). `commit`: a new commit (`sha`
+ *  short, `subject`, `added`, `removed` of that commit). Test runs are NOT reported (the headless carrier records
+ *  no exit codes); the hand-off's `checks` step and `repoChecksEvaluated` carry the test results. */
+export type PowerActivityEvent = {
+  type: 'powerActivity';
+  session: string;
+  ord: number;
+  turn: number;
+  at: number;
+  kind: 'edit' | 'commit';
+  path: string | null;
+  added: number | null;
+  removed: number | null;
+  sha: string | null;
+  subject: string | null;
+};
+
+/** `/ws` frame: a seat's tool call started or finished, live from its stream as it happens (bus
+ *  `wicked.run.tool.started` / `wicked.run.tool.finished`). Sent for claude, codex (`exec --json` items) and pi
+ *  (`--mode json` tool executions); at most 24 frames per 2 s and 4000 per attempt, and a call shown starting is
+ *  always shown finishing. `target` is a repo-relative path, a search, or a command with secrets cut, at most 160
+ *  characters. (0.151.0) `state: 'working'` (bus `wicked.run.tool.working`) is a quiet seat's heartbeat, any seat,
+ *  copilot included: after 15 s with no frame, one per 15 s while it stays quiet, `id` `working-<attempt>` (update one
+ *  row), `kind: 'working'`, `tool` the seat, `target` `last output N s ago`, `durationMs` that silence. */
+export type ToolActivityEvent = {
+  type: 'toolActivity';
+  session: string;
+  ord: number;
+  attempt: number;
+  at: number;
+  id: string;
+  state: 'started' | 'finished' | 'working';
+  kind: 'read' | 'search' | 'run' | 'test' | 'edit' | 'write' | 'skill' | 'task' | 'other' | 'working';
+  tool: string;
+  target: string | null;
+  ok: boolean | null;
+  durationMs: number | null;
+};
+
+/** `/ws` frame: new working notes from the power orchestrator's stream (bus `wicked.run.notes.recorded`): its
+ *  approach when stated or restated, and each new decision with its reason. Crew writes them into the run's working
+ *  document as `agent:<seat>`; they never steer. */
+export type PowerWorkingNotesEvent = {
+  type: 'powerWorkingNotes';
+  session: string;
+  ord: number;
+  attempt: number;
+  turn: number;
+  seat: string;
+  at: number;
+  approach: string | null;
+  decisions: Array<{ text: string; why: string | null }>;
+};
+
+export type PowerEvent =
+  | ToolActivityEvent
+  | PowerWorkingNotesEvent
+  | PowerActivityEvent
+  | PowerIntakePlannedEvent
+  | RigorRescoredEvent
+  | PowerCheckpointEvent
+  | PowerTurnEvent
+  | PowerHandoffEvent
+  | PowerToggledEvent;
+
+/** The engine's bus mirror of the power frames (and the first `wicked.run.*` lifecycle set, DES-PLUGIN-EVENTS §3.1),
+ *  4-segment `wicked.<domain>.<noun>.<verb>`, `domain=wicked-core`. */
+export type RunBusType =
+  | 'wicked.run.intake.planned'
+  | 'wicked.run.rigor.rescored'
+  | 'wicked.run.checkpoint.reached'
+  | 'wicked.run.turn.started'
+  | 'wicked.run.turn.completed'
+  | 'wicked.run.handoff.stepped'
+  | 'wicked.run.power.toggled'
+  | 'wicked.run.activity.recorded'
+  | 'wicked.run.tool.started'
+  | 'wicked.run.tool.finished'
+  | 'wicked.run.tool.working'
+  | 'wicked.run.notes.recorded'
+  | 'wicked.run.unit.started'
+  | 'wicked.run.unit.finished'
+  | 'wicked.run.checks.evaluated'
+  | 'wicked.run.human.awaited'
+  | 'wicked.run.qe.decided'
+  | 'wicked.run.steer.queued'
+  | 'wicked.run.steer.delivered';
+
+/** One mirrored row as a plugin feed or `GET /runs/:id/bus` serves it. `eventId` is the bus row id (ordered,
+ *  at-least-once: dedupe on it). `seq` is the durable run log's `seq` of the event the row mirrors: a correlation and
+ *  ordering value, strictly increasing within a run but WITH GAPS (the log counter is process-wide and most events
+ *  are not mirrored) — never a continuity check. `payload` is the matching `/ws` frame without `type` and `session`
+ *  (bulky `output` / `log` fields dropped), plus `runId`, `seq` and `at`. */
+export interface RunBusRow {
+  eventId: number;
+  seq: number;
+  type: RunBusType;
+  runId: string;
+  at: number;
+  payload: Record<string, unknown>;
+}
+
+/** `GET /runs/:id/bus?after=<eventId>&limit=<n>`: the run's mirrored rows after a cursor, oldest first. `cursor` is
+ *  the last row's `eventId` (pass it back as `after`); `rows` is empty and `cursor === after` when there are none.
+ *  503 when the daemon has no bus. */
+export interface RunBusPage {
+  rows: RunBusRow[];
+  cursor: number;
+}
+
 /** One `GET /health.warnings[]` entry (additive; wicked-core#411 / wicked-crew#497). */
 export interface HealthWarning {
   /** `state-home.unregistered` today; open for later kinds (e.g. `seat.work_default`,
@@ -446,6 +903,11 @@ export interface AgentSession {
   id: string;
   workflow_id: string;
   problem: string;
+  /**
+   * (api-types 0.149.0) The run's power-mode state ({@link PowerState}); ABSENT or `null` on a run launched phased
+   * before power mode existed, or on an older engine. camelCase inside, unlike the session's own fields.
+   */
+  power?: PowerState | null | undefined;
   /**
    * (api-types 0.113.0; operator ruling 2026-10-12) The run's SHORT JOB TITLE, derived by the daemon
    * at DTO assembly on `GET /runs` and `GET /runs/:id` from {@link problem} — deterministic, at most
@@ -1966,6 +2428,20 @@ export interface GateDecision {
    * `POST /runs/:id/resume` or `/reassign`.
    */
   ord?: number;
+  /**
+   * (api-types 0.156.0, DES-VOICE) The person answered by voice: studio matched the spoken words to this
+   * answer, showed it on screen and the person confirmed it, then the usual undo window ran. Recorded on the
+   * `gate.decided` audit line and {@link DecidedGate.input}; it grants nothing a typed answer does not.
+   */
+  input?: 'voice';
+  /**
+   * (api-types 0.160.0, program DES-LEARN §3.1) On a steering-author propose gate: the drafted rule ids
+   * (`SteeringDraftResponse.rules[].id`) the person keeps. Only those land; the rest are declined
+   * (`SteeringLandingResult.declinedIds`, audited `governance.steering.declined`). Absent = every drafted
+   * rule lands. With a plain approve only (400 otherwise); **409** `no_draft` on a gate with no readable
+   * draft, **409** `draft_changed` when an id is not in the draft as it reads now (the gate stays open).
+   */
+  keepRules?: string[];
 }
 
 /**
@@ -2041,6 +2517,8 @@ export interface CoreEvent {
   seat?: string;
   /** `elicitationCreated`: an ordered set of valid responses; `null` / absent = free-text. */
   options?: string[] | null;
+  /** `elicitationCreated` (api-types 0.158.0): a multi-select's bounds (`propType: "array"`). Absent otherwise. */
+  multi?: ElicitationMulti;
   /**
    * `elicitationCreated` (C3; wicked-core-ts >= 0.7.35, api-types 0.83.0): the index into `options`
    * of the option the PRODUCER of the options recommends (the field's JSON Schema `default`).
@@ -2065,6 +2543,13 @@ export interface CoreEvent {
   /** `awaitingHuman{gateKind: 'consent'}` (core#820): why no write targets are listed (no dry run
    *  ran before the gate, or it printed no plan); the gate is then a plain approve / reject. */
   writeTargetsMissing?: string;
+  /**
+   * `awaitingHuman{gateKind: 'repeat'}` (api-types 0.163.0, domain-graph-3): a loop step's ask —
+   * its command's progress line ("Mapping wicked-crew · 3% → 23% · target 80% · page 21 · budget
+   * reached …"). The ask's answers ride `choices` (`consent:<id>`…, `reject` = stop, the run ends
+   * and what it did is kept), `choiceLabels` and `recommended`, as on a consent gate.
+   */
+  repeatLine?: string;
   /** PTY terminal frames (`terminalOpened`/`terminalOutput`/`terminalExited`): the terminal id. */
   id?: string;
   /**
@@ -2472,6 +2957,24 @@ export interface CliUsageEvent {
   costUsd: number | null;
 }
 
+/**
+ * (0.155.0) `/ws` frame (and logged with the run): a working seat's running token TOTAL for one unit attempt, live from
+ * its own stream (wicked-core: claude per assistant message, pi per `message_end`, codex per `turn.completed`). Fresh +
+ * cache input, as {@link CliUsageEvent} counts it; sent when it changed, at most one per 3 s. `costUsd` only where the
+ * seat's stream states one (pi), else `null`. The attempt's `cliUsage` at its end stays the record.
+ */
+export interface UsageProgressEvent {
+  type: 'usageProgress';
+  session: string;
+  ord: number;
+  attempt: number;
+  /** Unix ms. */
+  at: number;
+  inputTokens: number;
+  outputTokens: number;
+  costUsd: number | null;
+}
+
 /** §3 B4 — the data files a unit's CLI touched. */
 export interface DataUsedEvent {
   type: 'dataUsed';
@@ -3639,6 +4142,23 @@ export interface WorkflowSelectedEvent {
   unitCount: number;
 }
 
+/**
+ * (api-types 0.163.0, domain-graph-3) A loop step sent the run back for another pass: every unit
+ * from `fromOrd` through `ord` was re-armed at a fresh attempt and the run goes on from `fromOrd`.
+ * `pass` counts the passes the loop has sent back (1 after the first); `line` is the step's own
+ * progress line ("Mapping wicked-crew · 3% → 12% → 19% · target 80% · page 4 · about 2 h left"),
+ * possibly empty. One per loop rewind: a page that reaches the target, or stops at a budget ask
+ * (whose `awaitingHuman.repeatLine` carries the line), emits none.
+ */
+export type StepRepeatedEvent = {
+  type: 'stepRepeated';
+  session: string;
+  ord: number;
+  fromOrd: number;
+  pass: number;
+  line: string;
+};
+
 /** P2 — a human approved a gate with an amendment text that was injected into the unit's description
  *  before re-dispatch. Fires after the amendment is persisted, before Resumed. Only emitted when
  *  the amendment text is non-empty. The canonical record for the HITL paper trail. */
@@ -3823,6 +4343,28 @@ export interface WorkerMessageInjectedEvent {
   message: string;
   /** `"all"` or the cli_key that was targeted. */
   target: string;
+  /** (0.161.0, DES-VOICE) Stamped by crew when the note was sent with {@link InjectMessageRequest.input} `voice`
+   *  (on `/ws` and `GET /runs/:id/events`; also on the `workerMessageQueued` frame). Crew remembers spoken notes in
+   *  memory, so one sent before a daemon restart reads as typed here; its `run.injected` audit line keeps it. */
+  input?: 'voice';
+}
+
+/** `POST /runs/:id/cancel` (0.161.0): the body is optional; a bodiless cancel is unchanged. */
+export interface CancelRunRequest {
+  /** Why the person stopped it (≤ 2000 characters), said or typed: kept on the `run.cancelled` audit line. */
+  reason?: string;
+  /** (DES-VOICE) The person said the stop and confirmed it on screen. A person's only (403 otherwise). */
+  input?: 'voice';
+}
+
+/** `POST /runs/:id/inject`: an operator note into the run's active worker(s). */
+export interface InjectMessageRequest {
+  message: string;
+  /** `"all"` (the default) or a CLI key. */
+  target?: string;
+  /** (0.161.0, DES-VOICE) The person said this note and confirmed it on screen. A person's only (403 for a worker or
+   *  plugin bearer); kept on the `run.injected` audit line and stamped on the note's frames. Grants nothing. */
+  input?: 'voice';
 }
 
 /** A unit was stopped and re-dispatched to a different CLI (or re-routed via council). */
@@ -4084,6 +4626,91 @@ export interface SteeringLandingResult {
   alreadyLanded?: boolean;
   /** Present iff `outcome: "failed"` — the loud, operator-readable reason. */
   error?: string;
+  /** (api-types 0.160.0) The drafted rules the approve's `keepRules` left out: never landed. */
+  declinedIds?: string[];
+}
+
+/**
+ * `GET /governance/steering/author/:runId/draft` (api-types 0.160.0, program DES-LEARN §3.1): a
+ * steering-author run's drafted rules, normalized exactly as the landing lands them. `ready` is true once
+ * the propose step has run and the run waits at a gate; until then `rules` may be empty. 404 for an
+ * unknown run or one that is not steering-author (`code: "not_steering_author"`).
+ */
+export interface SteeringDraftResponse {
+  runId: string;
+  ready: boolean;
+  rules: ConformanceRule[];
+  source?: SteeringProposalSource;
+}
+
+// ── Personality (api-types 0.160.0, program DES-LEARN §3.3) ──────────────────────────────────────
+
+/** 0 = the left word, 2 = the right word: length short..thorough, warmth plain..warm, pushback goes
+ *  along..challenges, initiative asks first..just starts. */
+export type PersonaDial = 0 | 1 | 2;
+export type PersonaHabit = 'says-unchecked' | 'tables' | 'cites' | 'names';
+
+/** `PUT /persona`'s `persona`: how the orchestrator talks. Tone only: never read by a gate, review, QE or rule. */
+export interface PersonaInput {
+  /** 1..40 characters. */
+  name: string;
+  /** `#rrggbb`. */
+  colour: string;
+  dials: { length: PersonaDial; warmth: PersonaDial; pushback: PersonaDial; initiative: PersonaDial };
+  habits: PersonaHabit[];
+  /** At most 500 characters, about tone. */
+  notes?: string;
+}
+
+export interface Persona extends PersonaInput {
+  /** 1 on the first save of a scope, one more on each save. */
+  version: number;
+  /** Unix ms. */
+  updatedAt: number;
+}
+
+/** `user`, or `project:<id>` for one project's override. */
+export type PersonaScope = 'user' | `project:${string}`;
+
+/** `GET /persona`: the person's own, every project override, and the voice block each adds to what a chat
+ *  seat is told (the project's override, else the person's, rides every chat's scope statement). */
+export interface PersonaResponse {
+  user: Persona | null;
+  projects: Record<string, Persona>;
+  voice: { user: string | null; projects: Record<string, string> };
+}
+
+/** `PUT /persona` body: a person only (403 otherwise); 404 for an unknown project. */
+export interface PersonaPutBody {
+  scope: PersonaScope;
+  persona: PersonaInput;
+}
+
+export interface PersonaSaved {
+  scope: PersonaScope;
+  persona: Persona;
+  voice: string;
+}
+
+/** `DELETE /persona?scope=project:<id>`: removes a project's override (a person only). */
+export interface PersonaRemoved {
+  removed: true;
+  scope: PersonaScope;
+}
+
+// ── First run (api-types 0.160.0, program DES-LEARN §4) ──────────────────────────────────────────
+
+/** `GET /setup/known` (operator trust): what studio shows before it asks. A fact that cannot be read is
+ *  `null` or empty, never guessed. */
+export interface SetupKnown {
+  /** The global git identity; null when neither name nor email is set. */
+  git: { name: string | null; email: string | null } | null;
+  /** Tracked source files by language across the registered repositories (`git ls-files`), at most 6. */
+  languages: Array<{ name: string; files: number; share: number }>;
+  filesCounted: number;
+  /** Git checkouts one level under the home's code folders and the registered repositories' folders,
+   *  not registered yet (at most 24). `path` is absolute: register with `POST /repos {name, rootPath}`. */
+  nearby: Array<{ name: string; path: string }>;
 }
 
 // ── Skills — the daemon-owned garden plugin root, published as immutable snapshots (api-types 0.28.0) ──
@@ -5143,6 +5770,15 @@ export interface GovernanceClaim {
 /** The launch-run request body (`POST /runs`). */
 export interface LaunchRunBody {
   problem: string;
+  /**
+   * (api-types 0.149.0) Run in POWER MODE: one orchestrator session (the `primary` seat, Claude Code by default)
+   * builds the change in many turns, rigor is sized by an intake QE plan and applied at hand-off, and the only human
+   * gate is deliver (plus what policy requires). ABSENT: the daemon's Settings default
+   * ({@link SystemSettings.powerModeDefault}, on when unset). `false` launches phased. Ignored (phased) when the
+   * engine lacks it (`capabilities.powerMode` false). A power launch runs without plan approval (`humanConfirm`
+   * is forced to `none`); a high-risk plan still holds at its gate (policy).
+   */
+  power?: boolean | undefined;
   sessionId?: string;
   clisJson?: string;
   /**
@@ -5382,6 +6018,10 @@ export interface LaunchRunResponse {
   /** (crew ≥ 0.9.0; wicked-core#850) PRESENT when a full-assurance launch's usable seats are all one
    *  CLI: the run will wait at a gate for a distinct seat. ABSENT otherwise. */
   assuranceNotice?: LaunchAssuranceNotice;
+  /** (api-types 0.149.0) PRESENT (`true`) when the run launched in power mode; absent means phased. */
+  power?: boolean | undefined;
+  /** (api-types 0.149.0) Power mode was wanted (the launch or the setting) but the run is phased: why, in one line. */
+  powerNotice?: string | undefined;
 }
 
 /**
@@ -5814,6 +6454,7 @@ export interface RepoGraphResponse {
   finding?: RepoFinding;
 }
 
+/** One row of `GET /repos/:id/git-history` (`?limit=` 1..500, default 20; newest first). */
 export interface GitCommit {
   sha: string;
   shortSha: string;
@@ -5832,6 +6473,11 @@ export interface GitContributor {
 export interface SystemSettings {
   /** Max nodes returned by wicked-estate graph-view (default 150). */
   graphNodeLimit: number;
+  /**
+   * (api-types 0.149.0) "Power mode for new jobs": the default of `LaunchRunBody.power` when a launch omits it.
+   * ABSENT = `true` (the shipped default is on). Human actors only.
+   */
+  powerModeDefault?: boolean | undefined;
   /**
    * The watch registry's operator settings (TR-W5a, api-types 0.73.0): only `enabled` and
    * `threshold` of a shipped entry, and the LLM lane switch. A `watch` patch needs a human actor
@@ -5861,6 +6507,29 @@ export interface SystemSettings {
    * Exported as `WICKED_COUNCIL_SPAWN_STAGGER_MS`, read per council. Absent = the default.
    */
   councilSpawnStaggerMs?: number;
+  /**
+   * (api-types 0.159.0, operator ruling 2026-10-31) The requirements graph's minimum coverage:
+   * `minCoveragePct`, a whole percentage 1..100, default 80. A repository's requirements graph is
+   * built, and shown labelled with its share, once REAL requirements (0.164.0: placeholders never
+   * count) reach this share of its behaviour-bearing product code; below it the
+   * `domain-extraction` run says "N% real requirements, minimum M%" and keeps the mapping for the
+   * next run. The daemon exports it as
+   * `WICKED_REQUIREMENTS_MIN_COVERAGE_PCT` at boot and on every change. Absent = the default.
+   */
+  requirementsGraph?: {
+    minCoveragePct?: number;
+    /**
+     * (api-types 0.163.0, domain-graph-3) A domain-extraction run maps page after page until the
+     * target; its budget per grant — `maxPages` (1..200, default 20) or `maxMinutes` (1..1440,
+     * default 240), whichever is spent first — ends in an ask: map more, lower the target for the
+     * repository, or stop. `pageSize` (50..2000, default 500) is how many behaviours one page
+     * maps. Exported as `WICKED_DOMAIN_MAX_PAGES` / `WICKED_DOMAIN_MAX_MINUTES` /
+     * `WICKED_DOMAIN_PAGE_SIZE`. Absent = the defaults.
+     */
+    maxPages?: number;
+    maxMinutes?: number;
+    pageSize?: number;
+  };
   /*
    * There is NO skills setting (skills keystone, api-types 0.28.0). The daemon-owned skills root is
    * `<state home>/skills` — the directory holding `manifest.json`, `baseline/<hash>/`, `effective/`,
@@ -6054,6 +6723,74 @@ export interface SettingsResponse {
 }
 
 // ── Requirements management (server-side search + overrides; crew api/requirements.ts) ──
+/**
+ * (0.159.0, operator ruling 2026-10-31 "validation by duplication") How many INDEPENDENT sources in
+ * the repository support a requirement beyond the extractor's own statement, as `wicked-core
+ * domain-graph` computed it: distinct callers (`callSites`), tests, docs that name it, and extractor
+ * seats beyond the first. `validated` at 2 or more; otherwise `unconfirmed`, and `why` says what is
+ * missing — show `why.text` on the item. `why.code` is one of `unindexed_file` (a file the code index
+ * skipped names it, so its callers there are not counted), `dead_code`, `config_only`,
+ * `single_caller`, `test_only`, `doc_only`, `extractors_only`.
+ */
+export interface RequirementCorroboration {
+  status: 'validated' | 'unconfirmed';
+  sources: number;
+  callSites: number;
+  tests: number;
+  docs: number;
+  extraExtractors: number;
+  why?: { code: string; text: string };
+}
+
+/**
+ * (0.164.0, operator decision 2026-11-01, wicked-core#1233) How much of a repository's product code
+ * is REAL requirements, and the minimum the graph is held to (`SystemSettings.requirementsGraph
+ * .minCoveragePct`): label it "23% real requirements · 4397 placeholders · minimum 80%".
+ *
+ * - `realPct` is the one number the minimum is checked against: `floor(real * 100 /
+ *   behaviorBearing)`, floored so it never reads above the minimum it was compared to; 100 when
+ *   `behaviorBearing` is 0 (nothing in product code to map). `real + placeholders + unmapped ===
+ *   behaviorBearing`; a label that breaks either is not sent.
+ * - `real`: behaviours resolved to a stated, sourced business rule.
+ * - `placeholders`: behaviours carrying only a risk-flagged placeholder (an empty statement, a rule
+ *   under the confidence threshold, one written unconfirmed). Shown in the graph as unconfirmed,
+ *   NEVER counted toward the minimum.
+ * - `unmapped`: behaviours with nothing recorded yet.
+ * - `behaviorBearing`: the denominator, product code only. `notProduct` counts the behaviour-kind
+ *   nodes left out because their file is a test, data, manifest or document file.
+ *
+ * Replaces 0.159.0's `mappedPct` / `mapped` / `resolved`, which counted placeholders as mapped (a
+ * repository with 3 real requirements and 117 placeholders read "100% mapped").
+ */
+export interface RequirementsCoverage {
+  realPct: number;
+  minPct: number;
+  behaviorBearing: number;
+  real: number;
+  placeholders: number;
+  unmapped: number;
+  notProduct: number;
+}
+
+/**
+ * (0.165.0) The graph a requirements page lists, as it was built. When `behind`, the header (`coverage`, the store
+ * now) does not count what the list holds: say so. When this `coverage.real` is below the header's: "2,202 real
+ * requirements mapped since the last graph build; build the graph to list them". With `coverage` null: "built
+ * before real requirements were counted; build the graph to list the N real requirements mapped now". Otherwise
+ * (only another count moved, or `real` fell): "the repository changed since this graph was built".
+ */
+export interface RequirementsGraphBuild {
+  /** The build's generation in the store (1 = the first build; 0 = a graph persisted before the engine kept a
+   *  build record). */
+  generation: number;
+  /** The label the build persisted; `null` when it carried none or an older engine's `mapped_pct` label. */
+  coverage: RequirementsCoverage | null;
+  /** True when any count of the build's label differs from the page's `coverage` (or the label is null), or
+   *  (0.167.0) when the engine judged every listed row and the counted rows' verdicts are not the header's real and
+   *  placeholders. False says the counts agree, not that every statement is unchanged. */
+  behind: boolean;
+}
+
 export interface RequirementSummary {
   key: string;
   domain: string;
@@ -6065,6 +6802,20 @@ export interface RequirementSummary {
   risk: boolean;
   riskSource: 'operator' | 'data' | null;
   edited: boolean;
+  /** (0.159.0) Validated or unconfirmed (with why). `null` on a graph built before the field;
+   *  ABSENT from an older daemon. */
+  corroboration?: RequirementCorroboration | null;
+  /** (0.166.0) The engine would not count it a real requirement (a validated requirement, or a business rule at or
+   *  above the resolve threshold, 0.75): a placeholder, unconfirmed whatever its corroboration says. (0.167.0) The
+   *  engine's own verdict when it gives one, else read off the document. ABSENT from an older daemon. */
+  placeholder?: boolean;
+  /** (0.167.0) The coverage share does not count this row, and why: its unit is not a behaviour (`structural`, a
+   *  TypeScript shape or signature), is outside product code (`not_product`), or is no longer indexed (`unindexed`).
+   *  Such a row is neither a real requirement nor a placeholder of the header's (its `placeholder` says only whether
+   *  a rule was stated there), sorts after them, and carries
+   *  `corroboration: null` (a type has no callers; "dead code" would be wrong). `null` when it counts or the engine
+   *  does not say; ABSENT from an older daemon. */
+  uncounted?: 'structural' | 'not_product' | 'unindexed' | null;
 }
 
 export interface RequirementDetail extends RequirementSummary {
@@ -6090,12 +6841,55 @@ export interface RequirementsPage {
   source: 'store' | 'artifact';
   /**
    * Keys in `requirements_overrides.json` that matched NO requirement in the corpus. Operator
-   * edits are keyed by SymbolId (store) or `domain::reqId` (artifact); an estate id-scheme
-   * migration re-mints method/field SymbolIds, so overrides keyed by the old ids stop matching and
-   * would otherwise vanish silently. Non-zero means edits exist that no row is showing — re-run
-   * the annotation workflow, then re-apply or delete the stale keys.
+   * edits are keyed by `domain::reqId` whatever the source (older daemons serving `'store'` keyed
+   * them by SymbolId). The engine keeps a requirement's id across builds, so a key stops matching
+   * when its requirement is retired or its domain regrouped. Non-zero means edits exist that no
+   * row is showing — re-apply or delete the stale keys.
    */
   orphanedOverrides?: number;
+  /** (0.159.0; real requirements since 0.164.0) The graph's coverage label; `null` when absent, an
+   *  older engine's `mapped_pct` label, or one its counts do not support; ABSENT from an older
+   *  daemon. */
+  coverage?: RequirementsCoverage | null;
+  /**
+   * (0.165.0) Which build the rows are. The list is the last graph BUILD; `coverage` counts the store NOW,
+   * which moves on when a run maps more without building (stopped at its repeat ask, or below the minimum,
+   * where the build refuses). `null` when the engine does not say; ABSENT from an older daemon.
+   */
+  graphBuild?: RequirementsGraphBuild | null;
+  /** (0.159.0) How many requirements of the whole corpus are validated / unconfirmed. (0.167.0) Rows the share does
+   *  not count are in neither. */
+  corroboration?: { validated: number; unconfirmed: number };
+  /**
+   * (0.167.0) Rows of the whole corpus the coverage share does not count (items with `uncounted`), split stated /
+   * placeholder: why the list holds more rows than the header. When this is not `null` and `graphBuild.behind` is
+   * false, the rows that are neither placeholders nor uncounted number exactly `coverage.real`. `null` when the engine
+   * did not judge every row (an older engine, a build before it recorded each row's unit, a malformed verdict): those
+   * rows are read off the document, and there is no such claim. ABSENT from an older daemon.
+   */
+  uncounted?: { stated: number; placeholders: number } | null;
+  /** (0.167.0) How many rows of the whole corpus are in each category, so a client can leave out an empty filter.
+   *  ABSENT from an older daemon. */
+  categories?: { functional: number; configData: number };
+}
+
+/**
+ * `GET /repos/:id/requirements` 404 when the repository's `requirements_graph.json` has not been
+ * generated (0.154.0). A state, not a refusal: `code` is the discriminator a client matches on, and
+ * `workflow` names the preset that generates the graph (its last step runs `wicked-core domain-graph`).
+ * Any other 404 on the route (an unknown repo) carries no `code`.
+ */
+export interface RequirementsNotGenerated {
+  error: string;
+  code: 'notGenerated';
+  workflow: string;
+  /**
+   * (api-types 0.163.0, domain-graph-3; real requirements since 0.164.0) How far the repository
+   * is, against its target ("23% real requirements · 4397 placeholders · target 80%"): present
+   * when the repository has a store to count.
+   * `minPct` is the target in force (the repository's own when lowered, else the daemon's).
+   */
+  coverage?: RequirementsCoverage;
 }
 
 export interface RequirementPatch {
@@ -6153,14 +6947,130 @@ export interface ElicitationInfo {
   ord?: number;
   attempt?: number;
   seat?: string;
+  /**
+   * (api-types 0.158.0, guided asks) The person may pick SEVERAL of `options`: at least `min`, at most `max`
+   * (both always set, `1 <= min <= max <= options.length`). Answer it with `content: {values}`; the engine records
+   * the picks as a JSON array in `options` order. ABSENT on a single-choice or free-text question and on an older
+   * daemon.
+   */
+  multi?: ElicitationMulti;
   receivedAt: string;
 }
 
-/** `POST /runs/:id/elicitation` body. `content` is required for accept, absent otherwise. */
+/** (api-types 0.158.0) How many of a multi-select elicitation's options an answer picks. */
+export interface ElicitationMulti {
+  min: number;
+  max: number;
+}
+
+/**
+ * `POST /runs/:id/elicitation` body. `content` is required for accept, absent otherwise: `{response}` answers a
+ * free-text or single-choice question (one of `options`); `{values}` (api-types 0.158.0) answers a multi-select one
+ * ({@link ElicitationInfo.multi}): distinct entries of `options`, `min..=max` of them. Crew answers 400 to `values` on
+ * a question that is not multi-select, and to `response` on one that is.
+ */
 export interface ElicitationResponse {
   elicitationId: string;
   action: 'accept' | 'decline' | 'cancel';
-  content?: { response: string };
+  content?: { response: string } | { values: string[] };
+}
+
+// ── Guided asks (api-types 0.158.0; design DES-GUIDED-CHAT) ─────────────────────────────────────────────────────
+//
+// ONE typed shape for every question a person answers inline: an engine gate, a seat's or MCP server's elicitation,
+// a power-mode pause, a plugin's proposal, a studio setup step. It is a RENDERING contract: the wire shapes that
+// exist stay as they are and map onto it (GateInfo.choices + recommended + gateKind → `choose`; ElicitationInfo
+// options/multi → `choose` / `pick` / `text`), and every answer still goes through its host's own route
+// (`POST /runs/:id/gate` with a GateDecision, `POST /runs/:id/elicitation`, …). Governance is the host's: an ask
+// never widens who may answer, and a gate's ask is always `answeredBy: 'person'`.
+
+/** The six ways a person answers. */
+export type AskKind =
+  /** Yes / no (two options; picking one is the answer). */
+  | 'confirm'
+  /** Choose one of 2..n options. */
+  | 'choose'
+  /** Pick several (`multi` bounds). */
+  | 'pick'
+  /** Short text. */
+  | 'text'
+  /** A point on a scale (named steps, or a number range). */
+  | 'scale'
+  /** Confirm, with a required reason (a danger move: stop, reject, skip QE, override). */
+  | 'confirm_reason';
+
+/** Which route answers the ask. */
+export type AskHost = 'gate' | 'elicitation' | 'chat' | 'learn' | 'plugin' | 'power';
+
+/** One option of a `confirm` / `choose` / `pick` / `confirm_reason` ask. */
+export interface AskOption {
+  /** Stable within the ask. */
+  id: string;
+  /** What the person reads (and the voice vocabulary). */
+  label: string;
+  /** One line under the label. */
+  sub?: string;
+  /** What happens if this option is taken, shown while it is hovered or selected ("If you choose this: …"). */
+  consequence?: string;
+  /** The wire answer: a gate action token, an elicitation option, a pause decision. */
+  token: string;
+  tone?: 'primary' | 'neutral' | 'danger';
+  /** The engine's (or producer's) recommendation: marked, and preselected unless the host says otherwise. */
+  recommended?: boolean;
+  /** Taking it asks for a reason first (kept with the record). */
+  needsReason?: boolean;
+  /** Shown but not choosable; the string says why ("Frozen: nothing merges there"). */
+  disabled?: string;
+  /** A small tag ("default", "current release"). */
+  meta?: string;
+}
+
+/** A named-step scale, or a number range. */
+export type AskScale =
+  | { steps: string[]; consequences?: string[] }
+  | { min: number; max: number; step: number; labels: [string, string] };
+
+export interface Ask {
+  /** Gate: `<runId>:<ord>`; elicitation: its `elicitationId`; otherwise the host's own id. */
+  id: string;
+  host: AskHost;
+  /** Who asks, in words ("Codex asks", "The engine asks"). */
+  from: { kind: 'engine' | 'seat' | 'plugin' | 'studio'; id: string; label: string };
+  /** One sentence, a question. */
+  prompt: string;
+  /** One line under the question. */
+  detail?: string;
+  kind: AskKind;
+  options?: AskOption[];
+  /** `pick`: how many (defaults: 1 and every option). */
+  multi?: { min?: number; max?: number };
+  /** Preselected: an option id (`choose` / `confirm`), option ids (`pick`), a step index or value (`scale`). */
+  default?: string | string[] | number;
+  scale?: AskScale;
+  text?: { placeholder?: string; maxChars?: number; optional?: boolean };
+  /** A follow-up shown in the same card once the first part is answered (pick the steps, then say what). */
+  then?: Ask;
+  /** A gate is always `'person'`. */
+  answeredBy: 'person' | 'any';
+  /** The answer waits this long, with Undo, before it is sent (a gate: 10 000). */
+  undoMs?: number;
+  /** The answered line: `{label}`, `{labels}` and `{text}` are filled ("You chose: {label}"). */
+  record: string;
+}
+
+/** What a person answered: the host turns it into its own wire body. */
+export interface AskAnswer {
+  askId: string;
+  /** `confirm` / `choose` / `confirm_reason`: the option taken. */
+  option?: string;
+  /** `pick`: the options picked, in the ask's order. */
+  options?: string[];
+  /** `text`, and a `then` text. */
+  text?: string;
+  /** `scale`: the step index or value. */
+  value?: number;
+  /** A `needsReason` option's reason. */
+  reason?: string;
 }
 
 // ── Inventory claims (wicked-crew#721) — whether each enumerating step's list is complete ──
@@ -6193,6 +7103,116 @@ export interface RunInventoryUnit {
   claims: InventoryClaim[];
 }
 
+/**
+ * `GET /runs/:id/learnings` — what a run proposed to the approve queue (run learnings, crew src/learnings).
+ * Every learning is a `memory` proposal attributed to the run (`provenance.run_id`); nothing is used until a
+ * person approves it on the Memory page. `distilling` is true while the run's distil seat (one cheap seat
+ * that did not build the run) is still reading its evidence.
+ */
+export interface RunLearningsResponse {
+  runId: string;
+  proposed: number;
+  pending: number;
+  approved: number;
+  rejected: number;
+  distilling: boolean;
+  items: Array<{
+    /** The proposal id (approve or reject it through `/proposals/:id/*`). */
+    id: string;
+    state: string;
+    /** `gotcha` | `decision` | `pattern` | `steering`, as filed. */
+    capture: string | null;
+    content: string;
+    /** Who worded it: `crew` (from the run's record) or the distil seat. */
+    agent: string | null;
+    /** Unix seconds. */
+    createdAt: number | null;
+  }>;
+}
+
+/** (0.155.0) The in-flight check's verdict on a working step. */
+export type UnitInspectVerdict = 'progressing' | 'looping' | 'stuck' | 'wasteful';
+/** (0.155.0) The one action a check recommends; the person chooses, nothing is done for them. */
+export type UnitInspectAction = 'let_run' | 'steer' | 'stop';
+
+/** (0.155.0) Crew's own deterministic reading of a working step's newest attempt (crew src/inspect/reading.ts). */
+export interface UnitInspectReading {
+  ord: number;
+  attempt: number;
+  startedAt: number | null;
+  elapsedMs: number | null;
+  calls: number;
+  openCalls: Array<{ tool: string; target: string | null; forMs: number }>;
+  byKind: Record<string, number>;
+  edits: Array<{ path: string; count: number }>;
+  said: { deltas: number; chars: number; lastAt: number | null; newest: string | null };
+  usage: { inputTokens: number; outputTokens: number; costUsd: number | null; source: 'live' | 'final' } | null;
+  lastSignAt: number | null;
+  verdict: UnitInspectVerdict;
+  evidence: string[];
+  doing: string | null;
+  action: UnitInspectAction;
+  note: string | null;
+}
+
+/**
+ * (0.155.0) One "Is this going well?" check on a working step (`POST /runs/:id/units/:ord/inspect`). A seat that is not
+ * the step's own reads the step's record (one read-only `inspect-unit` run, bounded by time and budget) and answers;
+ * when none can, or it fails, times out or reaches its budget, `source: 'crew'` and `why` says so and the answer is
+ * crew's own reading. It never steers, stops or edits the run it looks at.
+ */
+export interface UnitInspection {
+  id: string;
+  runId: string;
+  ord: number;
+  attempt: number;
+  state: 'checking' | 'done';
+  /** The actor id who asked. */
+  requestedBy: string;
+  /** Unix ms. */
+  requestedAt: number;
+  finishedAt: number | null;
+  /** The step's own seat. */
+  workerSeat: string | null;
+  /** The seat that checked (never the step's own); null when none could. */
+  seat: string | null;
+  /** The check's own run (workflow `inspect-unit`); null when none was launched. */
+  checkRunId: string | null;
+  source: 'seat' | 'crew' | null;
+  why: string | null;
+  verdict: UnitInspectVerdict | null;
+  /** What the step is doing, one sentence. */
+  doing: string | null;
+  /** Roughly how far along it is (the seat's estimate), one sentence. */
+  progress: string | null;
+  evidence: string[];
+  action: UnitInspectAction | null;
+  /** For `action: 'steer'`: the note it suggests sending the step's seat (the person may edit it before sending). */
+  note: string | null;
+  reading: UnitInspectReading;
+  /** What the check itself spent, when its seat reported it. */
+  cost: { inputTokens: number; outputTokens: number; costUsd: number | null } | null;
+}
+
+/** (0.155.0) `POST /runs/:id/units/:ord/inspect` → 202. 403 for anyone but a human operator; 409 `not_working` when the
+ *  step is not working now. A check already running on the step is answered as it is. */
+export interface UnitInspectionResponse {
+  inspection: UnitInspection;
+}
+
+/** (0.155.0) `GET /runs/:id/units/:ord/inspections`: the step's checks, newest first. */
+export interface UnitInspectionsResponse {
+  inspections: UnitInspection[];
+}
+
+/** (0.155.0) `/ws` frame: a check started, its budget moved, or it answered. */
+export interface UnitInspectionEvent {
+  type: 'unitInspection';
+  session: string;
+  ord: number;
+  inspection: UnitInspection;
+}
+
 /**
  * `GET /runs/:id/inventory` (404 for an unknown run). `complete` is true only when at least one
  * unit claimed an inventory, every claim is `full` and every finished unit's output was readable;
@@ -6937,7 +7957,8 @@ export interface ChatScope {
    *  0.35.0, F-2R2-008) names the UI action that would change a `bound: false` outcome, when one
    *  would: `projects.graph.refresh` = build the project graph from the project page. */
   graph: { bound: boolean; reason: string; repoLabel?: string; action?: ProjectGraphAction };
-  /** `crew.repo` members of the project whose registry record is gone — named, not readable. */
+  /** `crew.repo` members of the project whose registry record is gone — named, not readable. (0.155.0) Also
+   *  any repo in scope (project or `everything`) whose folder is missing (`repo_folder_missing`). */
   dangling: string[];
 }
 
@@ -8018,8 +9039,26 @@ export interface DiagnosticsResponse {
    *  — see `DiagnosticsVault`. `null` on a route set booted without an engine adapter; ABSENT on an
    *  older daemon. */
   vault?: DiagnosticsVault | null;
+  /** (crew#1147) The engine's repo-checks floor cache usage (`Core.floorCacheUsage`): `path` is shown as
+   *  `~/...`, never a home path; `repos` is largest first. The engine walks the cache, so the daemon
+   *  caches this answer for 60 s. `{ error }` when the engine has no worker home; `null` on an addon
+   *  without the static; ABSENT on an older daemon. */
+  floorCache?: DiagnosticsFloorCache | null;
 }
 
+/** `DiagnosticsResponse.floorCache` (crew#1147). Every `path` is `~/...`. */
+export type DiagnosticsFloorCache =
+  | {
+      path: string;
+      bytes: number;
+      totalCapBytes: number;
+      repoCapBytes: number;
+      idleTtlSecs: number;
+      repos: Array<{ name: string; bytes: number; leaves: number }>;
+      logs: { path: string; bytes: number; capBytes: number };
+    }
+  | { error: string };
+
 /**
  * (api-types 0.130.0, crew#1068) `DiagnosticsResponse.vault`: what the daemon exported to the engine
  * as `WICKED_VAULT_BIN` at boot. `shipped` = crew's own `wicked-vault` dependency's bin (an absolute
@@ -8491,8 +9530,33 @@ export type SystemLevel = 'green' | 'yellow' | 'red';
 /** The existing action an attention item or row offers (the snapshot itself is read-only):
  *  `sign_in` — the CLI's sign-in (`POST /seats/:cli/login…` / the Agents page); `recheck` — read
  *  the snapshot again (every probe runs fresh per read); `open_gate` — the run's open gate;
- *  `open_run` — the run. */
-export type SystemActionKind = 'sign_in' | 'recheck' | 'open_gate' | 'open_run';
+ *  `open_run` — the run. (0.162.0) `rebuild_seat_images` — `POST /system/seat-images/rebuild`
+ *  (the `seat_images` row: missing or unheld seat images); a skin that does not know a kind shows
+ *  the item without its button. */
+export type SystemActionKind = 'sign_in' | 'recheck' | 'open_gate' | 'open_run' | 'rebuild_seat_images';
+
+/** (0.162.0) `POST /api/v1/system/seat-images/rebuild` (a person only: 403 `{ error }` for an agent
+ *  or plugin bearer) → 202 once the engine process started; 409 while a rebuild runs; 503 on the
+ *  host floor, when crew cannot reach or start the engine binary, when the engine's seat image
+ *  status does not answer, when the roster cannot be read, or when no roster seat has an engine seat
+ *  image (`started: false` with why). A running rebuild is 409 before anything else is asked. The rebuild runs `wicked-core seat-image build <roster seats>` in the background (minutes;
+ *  it also holds an operator's own image); its progress reads on the `seat_images` row
+ *  (`details.rebuild`). */
+export interface RebuildSeatImagesResponse {
+  started: boolean;
+  /** Why it did not start; absent when it did. */
+  reason?: string;
+  rebuild: {
+    running: boolean;
+    startedAt: string;
+    finishedAt: string | null;
+    rc: number | null;
+    tail: string[];
+    /** The last output line that reads as a failure; `null` when none. */
+    error: string | null;
+    clis: string[];
+  } | null;
+}
 
 /** Where an item points. A skin maps it to its own route; crew never spells a studio URL. */
 export type SystemTarget =
@@ -8785,7 +9849,21 @@ export type SystemInfraKey =
   | 'stores'
   | 'seat_floor'
   | 'disk'
-  | 'load';
+  | 'load'
+  /** (0.155.0) The registered repositories' folders: `down` while any is missing (moved or deleted),
+   *  naming each with its path; `details.missing` lists `{ id, name, path }`. ABSENT before. */
+  | 'repos'
+  /** (0.162.0) The container seats' images (wicked-core `seat-image status`): `down` when a missing
+   *  seat image cannot be built (the operator's base is gone with no recipe, or an operator image is
+   *  missing) or the runtime VM disk is at 92 % or more; `degraded` when roster images are missing
+   *  (the next unit builds each first), not yet held against a runtime's image cleanup, the base is
+   *  missing, or the VM disk is at 75 % or more (a kubelet deletes unheld images from 85 %);
+   *  `unknown` when the engine, the roster or the disk could not be read. `details`: `images`
+   *  (`base`, `baseRecipe`, `holdSupported`, `floor`, `seats[]` with `present`/`held`/
+   *  `operatorImage`), `disk` (`totalBytes`, `availBytes`, `usedPct`), `missing`, `unheld`,
+   *  `imageGcHighPct`, `rebuild` (a running or the last rebuild, its output's last lines live).
+   *  `off` on the host floor. ABSENT before. */
+  | 'seat_images';
 
 export interface SystemInfraRow {
   key: SystemInfraKey;
@@ -10677,6 +11755,8 @@ export interface DecidedGate {
   creator: { seat: string; phase: string | null; ord: number } | null;
   /** A standing order could have approved this gate (a phase-review gate of a run that lands no doctrine). */
   orderApprovable: boolean;
+  /** (api-types 0.156.0) Answered by voice and confirmed on screen ({@link GateDecision.input}); absent otherwise. */
+  input?: 'voice';
 }
 
 /** `GET /gates/decided`'s 200. A malformed `since` answers 400. */
@@ -11682,6 +12762,23 @@ export interface EditorControl {
   maxChars?: number;
 }
 
+/**
+ * How an editor looks on studio's Plugins page (program DES-LEARN §2; api-types 0.157.0). Every image is a `data:` URL
+ * (`image/svg+xml`, `image/png` or `image/webp`, base64) the registry read from the editor's own files, bounded (icon
+ * 16 KB, preview 200 KB) and never through a link: no path and no remote URL is on the wire. Each field is optional;
+ * a file that is missing, too big or not the image its name says is left out (the editor is still served).
+ */
+export interface EditorVisuals {
+  /** Drawn on `color`, at about 18 px. */
+  icon?: string;
+  /** `#rrggbb`. */
+  color?: string;
+  /** A 16:9 picture of the editor at work; a `dark` one is used on a dark theme (else `light`). */
+  preview?: { light?: string; dark?: string };
+  /** The editor offers a live preview on its own sample (reserved: studio draws one for run plugins today). */
+  live?: boolean;
+}
+
 /**
  * One registered editor, as Settings → Editors renders it. No path is on the wire: the bundle is
  * fetched at `entry_url` (`GET /editors/:id/:version/entry`, the §8.2 headers, re-hashed per serve).
@@ -11714,6 +12811,11 @@ export interface EditorView {
   /** `studio-bundle`: first-party, shipped with studio. `pack`: a third-party pack the operator installed. */
   source: 'studio-bundle' | 'pack';
   entry_url: string;
+  /** Its one line for the Plugins page (at most 160 characters). Absent when the manifest has none, and from a daemon
+   *  that predates the field (api-types 0.157.0). */
+  description?: string;
+  /** Its icon, colour and preview (api-types 0.157.0). Absent when it declares none that read. */
+  visuals?: EditorVisuals;
 }
 
 /** `GET /editors` (operator+). */
@@ -12068,7 +13170,17 @@ export interface ScheduleRunResponse {
   schedule: WorkflowSchedule;
 }
 
-export type InsightsMetricId = 'pass_rate' | 'override_rate' | 'unresolved_rate' | 'time_to_pr' | 'floor_minutes' | 'wait_on_people' | 'spend' | 'retries';
+export type InsightsMetricId =
+  | 'pass_rate'
+  | 'override_rate'
+  | 'unresolved_rate'
+  | 'time_to_pr'
+  | 'floor_minutes'
+  | 'wait_on_people'
+  | 'spend'
+  | 'retries'
+  /** (api-types 0.149.0, power mode) Power runs whose rigor rose after their intake QE plan sized them. */
+  | 'rigor_raised';
 /** `too-few` = below the minimum sample (n < 5) in the window or the baseline: no trend is called. */
 export type InsightsVerdict = 'too-few' | 'no-change' | 'improved' | 'regressed';
 export type InsightsRecommendationKind = 'steering-rule' | 'memory' | 'setting' | 'issue' | 'resolve-stale';
@@ -12585,3 +13697,112 @@ export interface DefaultEvalDetail {
   report: DefaultEvalReport;
   cases: DefaultEvalCase[];
 }
+
+// ── Voice mode, phase 1 (program DES-VOICE; api-types 0.156.0) ─────────────────────────────────────────
+
+/**
+ * `GET /voice/status` (and the answer of `POST|DELETE /voice/model`). Speech to text runs on THIS machine:
+ * whisper.cpp's CLI plus one model file. Every voice route is the human operator's alone, on loopback
+ * (403 `human_operator_only` / `voice_loopback_only`).
+ */
+export interface VoiceStatus {
+  /** Audio is transcribed on this machine and never sent anywhere. Always `true` in phase 1. */
+  local: true;
+  /** The engine and the model are both here: `POST /voice/transcribe` can run. */
+  ready: boolean;
+  engine: {
+    name: 'whisper.cpp';
+    found: boolean;
+    /** Where the CLI was found; `null` when it was not. */
+    path: string | null;
+    /** How to install (or upgrade) it on this platform, when it is missing or too old; else `null`. */
+    install: string | null;
+    /** (api-types 0.158.0) The version it reports (`--version`); `null` when not found, or too old to report one. */
+    version: string | null;
+    /** (api-types 0.158.0) New enough for voice (1.8.0 or later, reporting `--version`): a stdin transcription prints
+     *  its text and writes no file. An older engine is refused with 409 `voice_engine_outdated`, before any audio. */
+    supported: boolean;
+  };
+  model: {
+    /** `base.en`. */
+    name: string;
+    present: boolean;
+    /** The model file's size; `null` when absent. */
+    bytes: number | null;
+    /** What the consent says before anything is fetched. */
+    approxBytes: number;
+    /** Where it is fetched from (`huggingface.co/ggerganov/whisper.cpp`). */
+    source: string;
+    /** A download in progress, or the last one's failure; `null` when none. */
+    download: {
+      state: 'running' | 'failed';
+      receivedBytes: number;
+      totalBytes: number | null;
+      startedAt: string;
+      error: string | null;
+    } | null;
+  };
+}
+
+/** `POST /voice/model`: the person's consent to fetch the model (202 = started; 200 = already here; 409
+ *  `voice_download_running`). Audited `voice.model.download_started`. `DELETE /voice/model` removes it. */
+export interface PostVoiceModelBody {
+  consent: true;
+}
+
+/**
+ * `POST /voice/transcribe` with an `audio/wav` body (16 kHz mono 16-bit, at most 8 MiB). The audio is held in
+ * memory for the call and dropped: never stored, logged or audited. Errors carry `code`:
+ * `voice_engine_missing` / `voice_engine_outdated` / `voice_model_missing` (409), `voice_audio_invalid` (400/415),
+ * `voice_audio_too_large` (413), `voice_busy` (429: one runs and one waits), `voice_timeout` (504), `voice_failed` (500).
+ */
+export interface VoiceTranscribeResponse {
+  /** The words, one line; empty when nothing was said. */
+  text: string;
+  ms: number;
+  model: string;
+}
+
+/** A section a widget registers in the `voice-dashboard` panel slot (the `panels[]` shape of a run plugin). */
+export interface VoicePanelDecl {
+  slot: 'voice-dashboard';
+  id: string;
+  title: string;
+  /** 1-99, lower first. */
+  order: number;
+}
+
+/**
+ * A USER-MADE dashboard widget: a declarative plugin (no code, nothing framed) that shows one field of
+ * `GET /system` or `GET /diagnostics` as a number or a chart. `metric.path` is a field path:
+ * `infra[key=load].details.load1`, `runs.length`, `toReview`.
+ */
+export interface VoiceWidgetManifest {
+  /** `user.<slug>`. */
+  id: string;
+  title: string;
+  version: 1;
+  kind: 'metric';
+  panels: [VoicePanelDecl];
+  metric: {
+    source: 'system' | 'diagnostics';
+    path: string;
+    display: 'number' | 'chart';
+    unit?: string;
+  };
+  createdAt?: string;
+}
+
+/** `GET /voice/dashboard`: this person's dashboard (keyed by actor id). `layout: null` = never saved. */
+export interface VoiceDashboard {
+  /** Widget ids in order: `builtin.<id>` or a user widget's `user.<slug>`. */
+  layout: string[] | null;
+  widgets: VoiceWidgetManifest[];
+  updatedAt: string | null;
+}
+
+/** `PUT /voice/dashboard` (at most 24 on the layout, 16 user widgets; every `user.*` on the layout is in `widgets`). */
+export interface PutVoiceDashboardBody {
+  layout: string[];
+  widgets: VoiceWidgetManifest[];
+}