code-mower 1.5.2__tar.gz → 1.6.0__tar.gz

{code_mower-1.5.2 → code_mower-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.5.2
+Version: 1.6.0
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -46,13 +46,13 @@ It is not a drop-in unattended merge gate. Humans still own credentials,
 repository policy, reviewer promotion, and exceptional decisions.
 
 <!-- code-mower:release-facts:start -->
-This source defines Code Mower `v1.5.2`, with package spec
-`code-mower==1.5.2`. Confirm the release tag on GitHub Releases and the package
+This source defines Code Mower `v1.6.0`, with package spec
+`code-mower==1.6.0`. Confirm the release tag on GitHub Releases and the package
 version on the selected index before using an index install command; source version
 and publication state are separate facts.
 Python 3.12 or newer is required.
-See the [release notes](https://github.com/codemower-ai/code-mower/blob/main/docs/v152-release-notes.md)
-and [qualification contract](https://github.com/codemower-ai/code-mower/blob/main/docs/v152-qualification.md).
+See the [release notes](https://github.com/codemower-ai/code-mower/blob/main/docs/v160-release-notes.md)
+and [qualification contract](https://github.com/codemower-ai/code-mower/blob/main/docs/v160-qualification.md).
 <!-- code-mower:release-facts:end -->
 Historical v1.4.x artifacts and qualification records remain unchanged.
 The v1.4.2 release did not claim the bounded hosted Devin canary tracked by
@@ -60,9 +60,9 @@ The v1.4.2 release did not claim the bounded hosted Devin canary tracked by
 not claimed by its immutable qualification record.
 
 Documentation on `main` follows the source on `main`. For an installed release,
-read its immutable versioned guide, such as the
-[`v1.5.2` guide](https://github.com/codemower-ai/code-mower/blob/v1.5.2/docs/try-in-10-minutes.md),
-and confirm the tag and package exist before using pinned install commands.
+read its immutable versioned guide. After v1.6.0 publication, use the
+[`v1.6.0` guide](https://github.com/codemower-ai/code-mower/blob/v1.6.0/docs/try-in-10-minutes.md).
+Confirm the tag and package exist before using pinned install commands.
 
 ## What Code Mower Adds
 
@@ -138,7 +138,7 @@ ID with `session lease renew --session-id SESSION_ID` or `session lease release
 --dry-run` or `--no-lease` for read-only work.
 
 Codex, Claude Code, and Cursor are qualified for the shared session, telemetry,
-lease, and Jira-authority contract in the current v1.5.2 release. Devin, Grok
+lease, and Jira-authority contract in the current v1.6.0 source line. Devin, Grok
 Bot, Antigravity,
 Muse, and custom hosts are recognized for briefs and provenance, while their
 execution remains an explicit handoff or provider-specific transport. See
@@ -266,7 +266,7 @@ and the [Cloud Data Contract](https://github.com/codemower-ai/code-mower/blob/ma
 
 ## Optional Hosted Slack
 
-v1.5.2 retains the basic Slack control surface introduced in v1.5.0 for one
+v1.6.0 retains the basic Slack control surface introduced in v1.5.0 for one
 private workspace and one authorized private, unshared channel. A Code Mower
 team administrator opens
 **Setup → Manage Slack integration** in the hosted dashboard and completes OAuth
@@ -295,7 +295,7 @@ for both workflows, supported behavior, and the trust boundary.
 
 ## Current Capabilities And Limits
 
-| Area | v1.5.2 posture |
+| Area | v1.6.0 posture |
 | --- | --- |
 | Default builders and reviewers | Claude Code + Codex |
 | Session hosts | Codex, Claude Code, and Cursor qualified; other identities recognized but require explicit handoff/provider transport |
@@ -305,11 +305,11 @@ for both workflows, supported behavior, and the trust boundary.
 | Forge and merge gate | GitHub |
 | Cloud | Optional metadata/report upload; no upload by default |
 | Graphify | Optional bounded local repository-graph provider behind the packet contract; no default dependency and no network access for the provider |
-| Slack | Optional hosted OAuth and `/codemower` control surface for one private workspace/channel; exact bindings, qualified supervisor, and numeric caps gate work |
+| Slack | Optional hosted OAuth and `/codemower` control surface for one private workspace/channel; exact bindings, qualified supervisor, and numeric caps gate work; metadata-only lifecycle summaries require exact hosted capability acceptance |
 
 GitLab, Bitbucket, broad unattended rollout, uncalibrated merge gates, Devin
 peer-orchestrator/reviewer parity, a hosted work-order CLI, a required Graphify
-dependency, Slack telemetry/Board links, and rich Slack UX are outside v1.5.2. The current priorities
+dependency, Slack-to-Board links, and rich Slack UX are outside v1.6.0. The current priorities
 and boundaries are recorded in
 [Current State And Roadmap](https://github.com/codemower-ai/code-mower/blob/main/docs/current-state-and-roadmap.md).
 
@@ -317,7 +317,7 @@ and boundaries are recorded in
 
 Graphify's optional bounded provider foundation landed in v1.4.0; its complete
 qualified integration, scorecard and query behavior shipped in v1.4.1 and
-remain available in v1.5.2. It is separately installed into an operator-owned
+remain available in v1.6.0. It is separately installed into an operator-owned
 environment, explicitly activated, and outside the base dependency set: a
 default Claude + Codex install adds no Graphify dependency, no indexer, no
 background service, and no watcher.

{code_mower-1.5.2 → code_mower-1.6.0}/README.md

@@ -10,13 +10,13 @@ It is not a drop-in unattended merge gate. Humans still own credentials,
 repository policy, reviewer promotion, and exceptional decisions.
 
 <!-- code-mower:release-facts:start -->
-This source defines Code Mower `v1.5.2`, with package spec
-`code-mower==1.5.2`. Confirm the release tag on GitHub Releases and the package
+This source defines Code Mower `v1.6.0`, with package spec
+`code-mower==1.6.0`. Confirm the release tag on GitHub Releases and the package
 version on the selected index before using an index install command; source version
 and publication state are separate facts.
 Python 3.12 or newer is required.
-See the [release notes](https://github.com/codemower-ai/code-mower/blob/main/docs/v152-release-notes.md)
-and [qualification contract](https://github.com/codemower-ai/code-mower/blob/main/docs/v152-qualification.md).
+See the [release notes](https://github.com/codemower-ai/code-mower/blob/main/docs/v160-release-notes.md)
+and [qualification contract](https://github.com/codemower-ai/code-mower/blob/main/docs/v160-qualification.md).
 <!-- code-mower:release-facts:end -->
 Historical v1.4.x artifacts and qualification records remain unchanged.
 The v1.4.2 release did not claim the bounded hosted Devin canary tracked by
@@ -24,9 +24,9 @@ The v1.4.2 release did not claim the bounded hosted Devin canary tracked by
 not claimed by its immutable qualification record.
 
 Documentation on `main` follows the source on `main`. For an installed release,
-read its immutable versioned guide, such as the
-[`v1.5.2` guide](https://github.com/codemower-ai/code-mower/blob/v1.5.2/docs/try-in-10-minutes.md),
-and confirm the tag and package exist before using pinned install commands.
+read its immutable versioned guide. After v1.6.0 publication, use the
+[`v1.6.0` guide](https://github.com/codemower-ai/code-mower/blob/v1.6.0/docs/try-in-10-minutes.md).
+Confirm the tag and package exist before using pinned install commands.
 
 ## What Code Mower Adds
 
@@ -102,7 +102,7 @@ ID with `session lease renew --session-id SESSION_ID` or `session lease release
 --dry-run` or `--no-lease` for read-only work.
 
 Codex, Claude Code, and Cursor are qualified for the shared session, telemetry,
-lease, and Jira-authority contract in the current v1.5.2 release. Devin, Grok
+lease, and Jira-authority contract in the current v1.6.0 source line. Devin, Grok
 Bot, Antigravity,
 Muse, and custom hosts are recognized for briefs and provenance, while their
 execution remains an explicit handoff or provider-specific transport. See
@@ -230,7 +230,7 @@ and the [Cloud Data Contract](https://github.com/codemower-ai/code-mower/blob/ma
 
 ## Optional Hosted Slack
 
-v1.5.2 retains the basic Slack control surface introduced in v1.5.0 for one
+v1.6.0 retains the basic Slack control surface introduced in v1.5.0 for one
 private workspace and one authorized private, unshared channel. A Code Mower
 team administrator opens
 **Setup → Manage Slack integration** in the hosted dashboard and completes OAuth
@@ -259,7 +259,7 @@ for both workflows, supported behavior, and the trust boundary.
 
 ## Current Capabilities And Limits
 
-| Area | v1.5.2 posture |
+| Area | v1.6.0 posture |
 | --- | --- |
 | Default builders and reviewers | Claude Code + Codex |
 | Session hosts | Codex, Claude Code, and Cursor qualified; other identities recognized but require explicit handoff/provider transport |
@@ -269,11 +269,11 @@ for both workflows, supported behavior, and the trust boundary.
 | Forge and merge gate | GitHub |
 | Cloud | Optional metadata/report upload; no upload by default |
 | Graphify | Optional bounded local repository-graph provider behind the packet contract; no default dependency and no network access for the provider |
-| Slack | Optional hosted OAuth and `/codemower` control surface for one private workspace/channel; exact bindings, qualified supervisor, and numeric caps gate work |
+| Slack | Optional hosted OAuth and `/codemower` control surface for one private workspace/channel; exact bindings, qualified supervisor, and numeric caps gate work; metadata-only lifecycle summaries require exact hosted capability acceptance |
 
 GitLab, Bitbucket, broad unattended rollout, uncalibrated merge gates, Devin
 peer-orchestrator/reviewer parity, a hosted work-order CLI, a required Graphify
-dependency, Slack telemetry/Board links, and rich Slack UX are outside v1.5.2. The current priorities
+dependency, Slack-to-Board links, and rich Slack UX are outside v1.6.0. The current priorities
 and boundaries are recorded in
 [Current State And Roadmap](https://github.com/codemower-ai/code-mower/blob/main/docs/current-state-and-roadmap.md).
 
@@ -281,7 +281,7 @@ and boundaries are recorded in
 
 Graphify's optional bounded provider foundation landed in v1.4.0; its complete
 qualified integration, scorecard and query behavior shipped in v1.4.1 and
-remain available in v1.5.2. It is separately installed into an operator-owned
+remain available in v1.6.0. It is separately installed into an operator-owned
 environment, explicitly activated, and outside the base dependency set: a
 default Claude + Codex install adds no Graphify dependency, no indexer, no
 background service, and no watcher.

{code_mower-1.5.2 → code_mower-1.6.0}/docs/README.md

@@ -40,6 +40,6 @@ historical release evidence and are not current operating guidance.
 
 ## Lifecycle
 
-The manifest currently classifies 62 supporting, 53 frozen, and 5 archived document(s).
+The manifest currently classifies 63 supporting, 56 frozen, and 5 archived document(s).
 See [Documentation lifecycle](documentation-lifecycle.md) before adding, moving,
 or changing release-sensitive documentation.

{code_mower-1.5.2 → code_mower-1.6.0}/docs/board-data-contract.md

@@ -915,11 +915,27 @@ touched. Pruning needs `--yes` and never signals any process.
 
 `code-mower board list` emits `code_mower.boardInventory.v1`, a local inventory
 of visible Code Mower Board listeners. It reports loopback URL, PID, process
-name, parsed repo hint, serving version, installed package version,
-`restart_recommended`, health, and next action. Local cwd paths are redacted by
-default; `--show-local-paths` is for local debugging only. If the host blocks
-listener inspection, the command reports an unavailable inventory instead of
-calling GitHub or reading repository content.
+name, identity-verified repository, invoking version, serving version,
+installed package version, `restart_recommended`, managed-service identity,
+health, and next action. An identity-verified transient row carries a
+stop-and-install `promotion_command`; a stale managed row carries
+`restart_command`. Both commands use the redacted
+working-directory placeholder `--repo-path .`.
+
+`code-mower board list --repo OWNER/REPO` includes a row only when the Board's
+`/api/identity` response establishes that repository. Command-line repo hints
+never satisfy this filter, so legacy, malformed, and unresponsive listeners
+fail closed. The `filter` block counts matched, identity-unverified, and
+other-repository rows without exposing local paths. Local cwd paths are
+redacted by default; `--show-local-paths` is for local debugging only. If the
+host blocks listener inspection, the command reports an unavailable inventory
+instead of calling GitHub or reading repository content.
+
+The invoking CLI sets `restart_recommended` when `serving_version` differs
+from `invoking_version`, even if the process reports that its own serving and
+installed versions agree. The `local_boards` block in `lanes status` is this
+same enriched inventory, so its text and JSON expose the same versions,
+managed-service fields, and guidance.
 
 `code-mower board stop --port PORT --yes` and `code-mower board stop --pid PID
 --yes` emit `code_mower.boardStop.v1`. Stop only sends a local termination

{code_mower-1.5.2 → code_mower-1.6.0}/docs/board-service-lifecycle.md

@@ -62,14 +62,13 @@ comes back with stale arguments, fails the gate instead of passing on a single
 early probe. The payload reports `delayed_health` with its state, the settle and
 refresh windows, and how many refreshes it took.
 
-When that window closes without a validating binding, the operation reports
-`delayed_health_failed`: the service applied but its binding never validated.
-This is the one failure that is *not* in the fail-closed table below, and the
-difference matters. The refusals below are decided before anything is applied
-and leave no local state behind; `delayed_health_failed` is decided after
-launchd already holds the job, so the definition stays installed and
-`board service status` keeps reporting the failing binding until you repair or
-remove it.
+When that window closes without a validating binding, an in-place restart or an
+unchanged install reports `delayed_health_failed`, because no definition was
+replaced. A new apply is different: a fresh install is removed again, while a
+replacement restores and verifies the previous binding. Those operations report
+`apply_failed` when the pre-operation state is verified and `rollback_failed`
+with a recovery command when neither state can be verified. The payload keeps
+the failed `delayed_health` evidence alongside the reconciliation result.
 
 ## Fail-closed refusals
 
@@ -144,18 +143,50 @@ and the `board stop` keepalive guard could no longer see it. That case reports
 `remove_incomplete` and leaves the definition in place.
 
 `--replace` is the only way to take over an existing definition for a port, and
-the replacement is atomic: the definition file is swapped with `os.replace`, and
-a failed bootstrap restores exactly the previous definition or reports
-`rollback_failed`. The swap is also the point at which the original contents
-stop existing, so it happens only once the old job is established as unloaded --
-a `bootout` that succeeded, or the same positively-confirmed absence `remove`
-requires. Writing over a job launchd still holds would fail the bootstrap anyway
-(launchd will not accept a label its domain already holds) and the rollback
-would then preserve the replacement rather than an original that is by then
-gone, so that case refuses as `unload_failed` and changes nothing. A write that fails outright leaves the previous definition on
-disk untouched, so recovery there is to load it again rather than to restore it;
-either way the payload's `rollback` field says whether the previous service came
-back.
+the replacement is atomic: the definition file is swapped with `os.replace`,
+then the terminal result is decided from the host state rather than from a
+`launchctl` return code. The final reconciliation re-reads the definition,
+launchd's running pid and argument vector, the process checkout and supervisor,
+exclusive port ownership, repository identity, installed version and serving
+version. Success means those reads prove the new definition and new process. A
+failed apply means the same reads prove the restored definition and restored
+process. JSON carries that evidence in `reconciliation`; text prints exactly one
+verified state.
+
+This matters because `launchctl bootstrap` can register and start a job before
+reporting a timeout or permission-boundary failure. When the new binding passes
+the whole serving gate, replacement succeeded and no rollback is attempted. If
+it does not pass, rollback unloads it before restoring the backup and performs
+the same complete read against the previous binding. A result never calls both
+replacement and rollback successful. If neither binding can be verified, the
+operation reports `rollback_failed` with one recovery command and the checkout
+where that command must run.
+
+A failed first install has absence as its rollback target. That result re-reads
+the definition, launchd job and unfiltered listener inventory after cleanup;
+only no definition, no job and an available inventory with zero listeners on
+the target port is verified absence. An unavailable inventory or any surviving
+listener is unresolved `rollback_failed`, with the same exact recovery command.
+
+Rollback version checks use the identity/version evidence captured from the old
+Board before it is stopped. A byte-for-byte restored older Board therefore
+validates as the previous state even when the command performing the replacement
+comes from a newer installation. A readable definition whose job was already
+unloaded has no running version to capture; after restoration, its complete
+binding is checked against the normal current-version contract. Missing version
+evidence remains unresolved when a prior job was loaded or its state was unknown.
+If the prior definition was unreadable,
+`--replace` knowingly discarded bytes that could not be backed up; removing a
+failed replacement is then reported as unresolved cleanup, never as a restored
+previous service.
+
+The swap is the point at which the original contents stop existing, so it
+happens only once the old job is established as unloaded -- a `bootout` that
+succeeded, or the same positively-confirmed absence `remove` requires. Writing
+over a job launchd still holds would fail the bootstrap anyway (launchd will not
+accept a label its domain already holds), so that case refuses as
+`unload_failed`. A write that fails outright leaves the previous definition on
+disk untouched; recovery loads and verifies that definition again.
 
 The backup that rollback restores is read before any of that -- before a log
 directory is created, before the old job is booted out, before a byte is
@@ -201,6 +232,22 @@ whatever the installing shell happened to have. If the package cannot be located
 on a canonical path, the request is refused before anything is applied. A
 console-script definition carries no `PYTHONPATH` at all.
 
+### Recording and the supported argument surface
+
+`board serve` is an interactive process and does not record events unless
+`--record-events` is passed. A managed `board service` is intended to preserve
+local history while it stays open, so `service render`, `service install` and
+`service restart` enable recording by default; pass `--no-record-events` to all
+three when the managed Board should remain read-only. That choice is part of the
+rendered argument vector, so changing it requires `restart --replace`.
+
+The service commands accept the durable binding options they can reproduce:
+`--repo`, `--repo-path`, `--host`, `--port`, and the recording choice. Options
+that tune one interactive `board serve` process, such as custom store paths,
+limits, refresh intervals, retention, or `--open`, are not `board service`
+arguments. Review the exact supported service argv with `service render`; do not
+copy an arbitrary `board serve` command after the `service` subcommand.
+
 ### Logs
 
 The definition sends both output streams to `<repo>/.code-mower/board/logs`.
@@ -299,24 +346,28 @@ Selectors are not exclusive: every selector supplied must agree on one binding.
   not be proven to release the port rather than be undone.
 
 `board list` marks each Board `managed` with its service label, or transient,
-and says when that service's supervision is unconfirmed.
+and says when that service's supervision is unconfirmed. Use `code-mower board
+list --repo OWNER/REPO --json` to filter on the repository established by each
+listener's `/api/identity` response. A legacy, malformed, or unresponsive
+listener cannot satisfy the filter even when its process command line contains
+that repository. Omit `--repo` to inspect those unverified rows globally.
 
-In v1.5.2 the inventory is global: use `code-mower board list --json`, then
-filter the returned rows by their identity-verified `repo` value. The command
-does not accept `--repo`. Responsive rows carry `serving_version`,
+Responsive rows carry `invoking_version`, `serving_version`,
 `installed_version`, `restart_recommended`, `managed`, and `service_label`.
+Staleness is computed by the invoking CLI as well as read from the process, so
+an old Board cannot declare itself current merely because its own serving and
+installed versions agree.
 For one known listener, `GET /api/identity` is the compact identity/version
-probe and `GET /api/status` carries the full `board.version` block. Static HTML
-and `lanes status` are not version-verification surfaces in this release.
-
-When a transient Board needs to survive logout, stop it with the exact selector
-reported by `board list`, then review and install a managed definition with
-`board service render` and `board service install`. When a managed Board is
-stale, use `board service restart` with the same repository path and port.
-Repository-filtered inventory, version parity in `lanes status`, and copyable
-promotion/restart guidance are tracked for v1.6.0 in
-[#1063](https://github.com/codemower-ai/code-mower/issues/1063); do not use
-those planned command shapes with v1.5.2.
+probe and `GET /api/status` carries the full `board.version` block. `lanes
+status` presents the same inventory fields and service identity as `board
+list`.
+
+Every identity-verified transient row includes a copyable `promotion_command`
+that stops the exact repo/port listener and then installs the service. Every
+stale managed row includes its exact `restart_command`. The commands keep local
+paths redacted with `--repo-path .`; run them from the intended checkout, where
+the service lifecycle's origin guard verifies the repository before applying a
+definition.
 
 A `launchctl` that cannot be probed at all is one of those unconfirmed cases,
 not an empty inventory. On macOS the installed definitions are enumerated even

{code_mower-1.5.2 → code_mower-1.6.0}/docs/cloud-benchmarking.md

@@ -5,7 +5,7 @@ reports, and the local Board without a hosted account. CodeMower.com is an
 optional destination for longitudinal team reporting and future aggregate
 benchmarks.
 
-## Current v1.5.2 Client Surface
+## Current v1.6.0 Client Surface
 
 The current client can:
 

{code_mower-1.5.2 → code_mower-1.6.0}/docs/cloud-data-contract.md

@@ -249,6 +249,18 @@ identifiers that did not report cost; it is metadata-only and must never
 contain commands, paths, auth output, or secrets.  Missing cost is omitted,
 never serialized as zero.
 
+Shared local spend ledgers may contain attempts for several repositories. An
+attempt with an explicit different `repo_slug` is isolated to that repository
+and does not suppress coverage in the repository currently being synced. A
+builder run recorded before PR creation may omit `pr_number`; the command links
+it only when its recorded branch equals exactly one GitHub `headRefName` in the
+fetched PR population. Missing or ambiguous branch matches remain fail-closed.
+No branch prefix, author, PR body marker, or issue prose is used for this join.
+
+Dollar coverage remains provider-reported. Subscription access, token counts,
+or elapsed time are not silently converted to `cost_usd`; an explicit,
+versioned allocation policy would be a separate data source and contract.
+
 Builder evidence fails closed: a `*.cloud-event.json` file that cannot be
 read, parsed, or recognized as a `builder_run` event is never silently
 omitted.  A failure attributable to a PR via its filename is recorded on that

code_mower-1.6.0/docs/control-surface-telemetry.md

@@ -0,0 +1,92 @@
+# Control-surface session summaries
+
+This supporting contract describes the metadata-only lifecycle summaries used
+by the optional [Slack integration](slack-setup.md). Installation and Slack
+administration remain in the Slack guide. General upload behavior remains in
+the [cloud data contract](cloud-data-contract.md), and local work presentation
+remains in the [Board data contract](board-data-contract.md).
+
+## Boundary
+
+`code_mower.controlSurfaceSessionSummary.v1` is a closed specialization of the
+existing `code_mower.benchmarkEvent.v1` envelope. It reports one meaningful
+session observation rather than a command, message, or transcript stream. The
+packaged schema and fixtures are the normative machine-readable contract:
+
+- `control_surface_session_summary.schema.json`;
+- `control_surface_session_summary.accepted.json`;
+- `control_surface_session_summary.rejected.json`;
+- `control_surface_session_summary.expectations.json`;
+- `control_surface_session_summary.fixture-manifest.json`.
+
+The summary allows an opaque Code Mower correlation key, repository slug,
+categorical provider, lifecycle state and outcome, observation time, operation
+counts, closed lifecycle reason, bounded owner action, optional pull-request
+metadata, and already available elapsed-time or Devin ACU measurements. The
+producer hashes its local logical session into a 32-character key before
+building the event. It never forwards a Slack identity or provider session
+reference.
+
+The lifecycle state, reason, and owner action form one closed policy triple.
+Routine status observations use `none`; owner waits use `answer_question` or
+`respond_to_approval`; failures and suspensions use `inspect_failure`.
+`collect` observations with `result_not_ready` or `result_unavailable` use
+`inspect_provider` regardless of whether the provider is still pending,
+running, owner-waiting, or terminal. This preserves both facts: the provider
+state remains truthful, and the missing result remains visible as the current
+owner action. Unsupported combinations fail closed.
+
+The closed validator rejects unknown root, dimension, metric, and tool
+provenance fields. Tool provenance is limited to the fixed Code Mower reporter
+identity, a bounded package version, and a coarse local/CI runtime category. Task
+text, messages, answers, prompts, response URLs, Slack identities, source,
+diffs, transcripts, tokens, paths, context or graph data, provider references,
+and raw output cannot enter this event.
+
+## Local Board projection
+
+Slack-requested work uses the existing public remote-session lifecycle and
+local Board adapter. The adapter maps `pending`, `running`, owner-waiting,
+completion, failure, suspension, termination, archival, and uncertainty into
+the same Board phases used by other remote work. This is local observation;
+it does not require cloud access and grants no dispatch or merge authority.
+
+## Hosted capability gate
+
+Production emission stays disabled until the hosted service advertises this
+exact closed object:
+
+```json
+{
+  "accepting": true,
+  "capability_version": 1,
+  "fixture_manifest_sha256": "<sha256 of the exact packaged fixture manifest bytes>",
+  "schema": "code_mower.controlSurfaceSessionSummaryCapability.v1",
+  "summary_schema": "code_mower.controlSurfaceSessionSummary.v1"
+}
+```
+
+Every field must match, and unknown fields fail closed. A missing capability,
+version mismatch, digest mismatch, or `accepting: false` leaves operation local
+only. Client rollback stops new emission without rewriting accepted rows.
+The client reads this object from
+`GET /api/health` at `capabilities.control_surface_session_summary`; the cloud
+doctor exposes an accepted exact match in its service-check detail.
+
+After acceptance, the producer emits the first observation and then only a
+meaningful lifecycle, operation-count, owner-action, or pull-request change.
+Timestamp-only changes and changing elapsed time or usage on a nonterminal
+session do not create another event. Terminal elapsed-time or usage changes
+remain meaningful reconciliation evidence.
+
+The hosted service must vendor the five packaged resources byte-for-byte,
+scope repository identity through authenticated tenant policy, and implement
+the retention, export, deletion, tenant-isolation, and aggregate-reconciliation
+expectations in the packaged expectations fixture.
+
+## Contract changes
+
+The fixture manifest hashes exact UTF-8 file bytes. It does not hash itself;
+the hosted capability advertises the SHA-256 of the manifest bytes separately.
+After qualification, changing the schema or any fixture requires a new schema
+or manifest version. Do not refresh hashes in place to accept changed meaning.

{code_mower-1.5.2 → code_mower-1.6.0}/docs/current-state-and-roadmap.md

@@ -22,15 +22,17 @@ dry-run-first.
 
 ## Current Source And Published Baseline
 
-This source defines Code Mower `v1.5.2`, with package spec
-`code-mower==1.5.2`. Confirm the release tag on GitHub Releases and the package
+This source defines Code Mower `v1.6.0`, with package spec
+`code-mower==1.6.0`. Confirm the release tag on GitHub Releases and the package
 version on the selected index before using an index install command; source
-version and publication state are separate facts. See the
-[v1.5.2 release notes](https://github.com/codemower-ai/code-mower/blob/main/docs/v152-release-notes.md)
-and [qualification contract](https://github.com/codemower-ai/code-mower/blob/main/docs/v152-qualification.md).
-After publication, the GitHub Release and linked release issue carry the
-observed source SHA, artifact digests, canary outcomes, publication run and
-reinstall evidence.
+version and publication state are separate facts. The latest published baseline
+remains `v1.5.2` until the entry gates and qualification contract for #1105 are
+complete. See the
+[v1.6.0 release notes](https://github.com/codemower-ai/code-mower/blob/main/docs/v160-release-notes.md),
+[qualification contract](https://github.com/codemower-ai/code-mower/blob/main/docs/v160-qualification.md),
+and [candidate runbook](v160-release-runbook.md). The GitHub Release and #1105
+will carry observed source SHA, artifact digests, canary, soak, publication,
+and reinstall evidence after those observations exist.
 Historical v1.4.x artifacts and qualification records remain unchanged.
 
 `v1.4.0`, `v1.4.1` and `v1.4.2` have all shipped, and the v1.4.0 and v1.4.1
@@ -133,10 +135,12 @@ future hosted-service work.
 - Graphify's bounded provider foundation shipped in v1.4.0; its complete
   qualified integration, scorecard and query behavior shipped in v1.4.1. It
   remains optional and has no default dependency.
-- Slack in v1.5.2 supports one private workspace with explicit member, repository
+- Slack in v1.6.0 retains one private workspace with explicit member, repository
   and private-channel mappings plus private start, status, answer and
-  confirmed-cancel interactions. Telemetry, Board links, Slack Connect, public
-  channels and richer Slack UX remain planned v1.6 work.
+  confirmed-cancel interactions. Metadata-only lifecycle summaries remain
+  disabled until the hosted service advertises the exact accepted contract.
+  Slack-to-Board links, Slack Connect, public channels and richer Slack UX are
+  deferred.
 - Provider cost fields remain unknown when the provider does not return them.
 - A successful release campaign proves installation and operational transport,
   not builder quality or reviewer promotion readiness.
@@ -147,32 +151,36 @@ future hosted-service work.
 
 ## Current Release And v1.6.0
 
-`v1.5.2` is released and is the current supported package. It retains the
-basic Slack boundary from v1.5.0 and adds the five reliability revisions from
-#1050: hosted-install clarity, host-independent tests, lane-exact audit seals,
-checkout-free remote doctor, safe existing-repository initialization, and
-clearer status/version reporting.
-
-The [v1.6.0 milestone](https://github.com/codemower-ai/code-mower/milestone/2)
-and [epic #1066](https://github.com/codemower-ai/code-mower/issues/1066) are the
-live trackers. The planned children are:
-
-1. Board inventory filters, version parity, stale detection, and service
-   guidance ([#1063](https://github.com/codemower-ai/code-mower/issues/1063));
-2. doctor warning taxonomy and hosted-posture scope
-   ([#1064](https://github.com/codemower-ai/code-mower/issues/1064));
-3. hosted adoption prompts, current documentation, and a normal 24-hour release
-   soak with two independent install or upgrade passes
-   ([#1065](https://github.com/codemower-ai/code-mower/issues/1065));
-4. the closed, versioned optional Slack telemetry contract and OSS emitters
-   ([#921](https://github.com/codemower-ai/code-mower/issues/921)); and
-5. hosted validation, aggregation, export/deletion, and fresh authenticated
-   views for that contract
-   ([#978](https://github.com/codemower-ai/code-mower/issues/978)).
-
-#1063, #1064, and the documentation portion of #1065 can proceed in parallel.
-#921 freezes the shared contract and fixtures before #978 enables hosted
-ingest. None of this planned work is part of v1.5.2.
+`v1.5.2` is released and remains the current supported package. The `v1.6.0`
+source line now contains the completed doctor taxonomy, atomic Board replacement,
+identity-verified Board inventory and version guidance, neutral `unmanaged`
+state for ordinary pull requests with no Code Mower provenance, share-safe
+adoption diagnostics, cross-repository cost isolation, and the closed
+metadata-only control-surface summary contract. Visible malformed Code Mower
+claims remain actionable and fail-closed. The optional client
+emitter remains fail-closed unless the hosted service advertises the exact
+accepted contract identity.
+
+The [v1.6.0 milestone](https://github.com/codemower-ai/code-mower/milestone/2),
+[epic #1066](https://github.com/codemower-ai/code-mower/issues/1066), and
+[release issue #1105](https://github.com/codemower-ai/code-mower/issues/1105)
+are the live trackers. All immutable-candidate entry gates are complete. Board
+clarity #1063 merged through PR #1109, and audit-history hardening #1104 merged
+through PR #1107. Hosted PR #542 merged at
+`bcddaa25c633f2dcf8fa2077d6ecb8004c1d8f88`; production deployment
+`6581697672` succeeded in two steps; production deployment
+`dpl_HxhK4CHrYPkCCzjxS9rGjSuBG8C8` is Ready; authenticated health advertises the
+exact accepting contract; the migration ledger is 79/79; and one sanitized
+probe was accepted exactly once and isolated to `jeff-internal`. Public evidence
+is recorded in
+[#978 comment 5770184083](https://github.com/codemower-ai/code-mower/issues/978#issuecomment-5770184083).
+
+After the release PR merges, #1105 serializes the one immutable build, bounded
+private Slack canary, local-versus-hosted reconciliation, 24-hour soak, two
+independent installation passes, exact-head release audits, publication, and
+canonical reinstall. #978 remains open until the retained candidate completes
+the canary and local-versus-hosted aggregate reconciliation. None of those
+post-merge observations is claimed by this source preparation.
 
 ## Near-Term Roadmap
 
@@ -338,13 +346,16 @@ administration/readiness; #920 consumes the immutable candidate to obtain one
 accepted completion and one accepted confirmed cancellation under an explicit
 numeric cap while preserving every attempt and reservation; #923 records the
 tag, publication and independent reinstall evidence.
-Slack telemetry/Board/cloud links and rich UX remain v1.6.0. Slack consumes the
-durable lifecycle instead of scraping terminal or Board output and carries no
-raw private context or private reviewer findings.
-
-The source implementation and qualification contract are complete. Consult #923
-and the GitHub Release for the observed lifecycle, canary, publication and
-canonical reinstall state.
+The v1.6.0 source adds capability-gated, metadata-only lifecycle summaries to
+the local Board and optional cloud emitter. Slack-to-Board links and rich UX
+remain deferred. Slack consumes the durable lifecycle instead of scraping
+terminal or Board output and carries no raw private context or private reviewer
+findings.
+
+The source implementation and qualification contract are complete. This
+statement covers the basic v1.5.0 interaction boundary.
+Consult #923 and the GitHub Release for the observed v1.5.0 lifecycle, canary,
+publication and canonical reinstall state.
 
 ## Delivery Order