## What changed
- add `craft-goal`, a bounded Mayor-style goal compiler/linter for
persistent campaigns over bead-shaped RPI experiments
- add its Codex and Gemini runtime projections plus generated catalogs,
manifests, router, graph, maps, tiers, and registry entries
- split RPI reporting into two explicit surfaces: concise human-readable
interactive output by default, with the full `rpi-report.v1` object
retained as the machine/audit artifact
- add feature and validation assertions that prevent raw schema dumps
from becoming the default interactive response again
## Why
Recent AgentOps history repeatedly showed long-running goal campaigns
confusing the outer goal with one RPI experiment. It also exposed a
presentation bug where the RPI skill instructed agents to paste the
transport-shaped YAML report into chat. This change captures the
corrected goal model and keeps machine evidence separate from the
operator-facing response.
## Validation
- `bash scripts/regen-all.sh --check`
- `bash skills/craft-goal/scripts/validate.sh`
- `bash skills/rpi/scripts/validate.sh`
- `python3 -m unittest skills/rpi/tests/test_run_once.py`
- Codex parity, generated-artifact, and override-coverage checks
- `git diff --check origin/main...HEAD`
- `bash scripts/ci-local-release.sh --fast` ran all branch-relevant
checks successfully; its aggregate exit remained nonzero only for the
pre-existing `skills/using-gc` description-budget violation, which is
unchanged from `origin/main`
## What
The 3.3 GC pack flow becomes Gas City's native human door, drivable by
humans and agents alike (operator decision). Five commits:
1. **a903c23f8** `feat(gc)`: Mayor prompt rewritten observe-only →
**shepherd** — polls external rigs' ready step beads and dispatches each
via `gc sling <gc.run_target> <bead> --nudge`. Never claims, never
authors, never closes.
2. **e58aeb5cb** `feat(gc)`: `invoke.sh mayor start|status|tell` — the
agent control surface over native primitives (`gc session wake`, `gc
session list --json`, `gc mail send --notify`; mail chosen over
sling-text to avoid v1.3.5's inline-text auto-create). Mayor is now a
`mode=always` standing session.
3. **bd8c34df6** `docs(gc)`: README — two doors (human attaches, agent
drives via mail), heartbeat propulsion, #4586 context.
4. **2b6ffe9cf** `feat(gc)`: `skills/using-gc` rewritten as the
mayor-orchestration skill (drive loop, bead-ids-only doctrine, GC
liveness truth stack with both codex wedge classes, stall protocol) +
all regenerated projections.
5. **362f4af79** `fix(gc)` (cross-family review: 1 BLOCKER + 5 MAJORs,
all fixed): **shepherd-heartbeat order** (native `gc order`, 3m cooldown
— mode=always keeps the Mayor resident but nothing re-prompts it; the
order is the liveness engine); HQ filtered from rig enumeration; stall
recovery = `session wake` (re-sling documented as a no-op for routed
beads); `mayor status` tri-state fail-closed; mail authority limited to
dispatch/status with bodies treated as untrusted data (pause/resume
dropped — stateless under fresh wake); test stubs reject non-allowlisted
verbs.
## Why
On v1.3.5, demand-driven worker spawning never fires for rig-routed work
(upstream gastownhall/gascity#4586, ours, with a stock-pack no-LLM
repro). Shepherd-dispatch by a standing Mayor is both the
v1.3.5-functional propulsion path AND the stock-GC operating pattern
(their mayor prompt: create → sling bead-id → monitor) — so this flow
survives the upstream fix rather than fighting it. Intent stays
caller-owned: drivers hand the Mayor bead IDs, never prose work.
## Verification
- `tests.python.test_gc33_thin_pack`: 34 passed (2 integration-gated
skips)
- `shellcheck -S warning` + `bash -n` clean; `scripts/regen-all.sh
--check`: all 11 projections current
- Every gc primitive verified against v1.3.5 source (cmd_mail.go,
cmd_session_wake.go, cmd_sling.go, cmd_rig.go, decode_sessions.go,
orderdiscovery)
- Codex adversarial review round: all findings fixed
- **Not yet proven live**: heartbeat-order discovery/scheduling,
mode=always residency, wake-based recovery, end-to-end propulsion — the
live canary follows this merge.
One canonical root for skill create/heal/audit. Mode routing table absorbs
all heal-skill triggers; every live consumer (gates seed, quality checks,
release scripts, bats, docs, catalogs, parity twins) updated to relocated
paths; all projections regenerated via owning commands.
Validated fresh: verdict PASS (e9b6cdb8), intent 26a4f2be, all five
acceptance scenarios re-executed by an independent context.
Co-authored-by: Cursor <cursoragent@cursor.com>
Fold 5 substrate skills into their survivors (ao skills retire --into), after
re-litigating each keep-rationale:
- vibing-with-ntm -> ntm (operator layer over the same NTM tools)
- agy-headless-evidence -> agy-native (consumes agy-native; evidence is a
listed capability; mirrors agy-mcp/rules/sidecar folds)
- codex-approval -> codex-exec (codex-runtime driving-adapter; mirrors the
codex-* consolidation)
- dual-pane-atm -> using-atm (a specialization of the ATM substrate)
- orchestrate -> using-atm (route/preflight/verify instrument; the ao
orchestrate CLI survives, only the skill doc folds)
using-atm is the surviving out-of-session-substrate consolidator. Manual cleanups
ao skills retire does NOT reach: git rm .agy-plugin/skills/vibing-with-ntm +
drop it from validate-agy-plugin.sh core_skills; drop the dual-pane-atm/orchestrate
lines from scripts/.scenario-linkage-allow; drop vibing-with-ntm from
scripts/lint/codex-cross-runtime-skills.txt; repoint 26 broken cross-ref links to
survivors + fix frozen-twin generated_hash. scenario-linkage / skill-redirects
(47 resolve) / doc-skill-refs / manifests all green.
NOTE: validate-agy-plugin.sh has a PRE-EXISTING 9-bundle drift at HEAD (agent-mail,
beads-*, cass, cc-hooks, dcg, ntm, rch — stale hand-committed .agy-plugin bundle,
no sync tooling, not a routed gate); untouched here, flagged for a follow-up.
Heavy legacy RPI chains with no measured uplift. Add a new `experimental` tier
and demote the three. The tier value is registered at ALL FOUR enum sites — the
authoritative schemas/skill-frontmatter.v1.schema.json (enforced by the blocking
skill.manifests gate), validate-skill-schema.sh, sku_catalog.py, and
generate-registry.sh — plus a Tier Values row in SKILL-TIERS.md. Frontmatter
metadata.tier and the SKILL-TIERS row cell flipped in lockstep for all three.
acfs is demoted, NOT cut: its cut is external (~/acfs) and a deferred operator
one-way-door decision (noted in the disposition ledger). Codex twins refreshed
by regen (not dropped — .18 owns twin cuts). registry drift, manifests schema,
sku-catalog, sync-counts all green; go build + internal tests pass.
Restore the cut reverse-engineer-rpi skill (was cut in 94db74318), rename it
(drop the rpi suffix across 16 files + both trees), and upgrade it from a pure
teardown tool into teardown -> steal-map (have/gap/steal/park/reject) -> route
one-way doors to /discovery's mixed-model duel. Folds this session's discipline:
validated cross-family not self-report, park substrate we delegate (ADR-0009),
steal the pattern not the platform, probe real state not stale. 308->125 lines,
codex twin mirrored (slim frontmatter + hashes), disposition keep row added.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Extract the behavior-first-planning discipline (intent → frozen Gherkin
behaviors → EXECUTED-red acceptance tests → derived spec → acceptance-gated
bead DAG) into skills/behavior-first-planning/SKILL.md, so the capability
survives independent of the bdd-foundry workflow. The rule it enforces: no
runnable acceptance test, no bead — closing the spec-first "beads ship with no
done-criteria" hole (the 3/10 problem) before W3 thins the workflow.
Covers the four bdd-foundry phases + the closing independent-review gate
(validate before tracker write). Codex twin mirrored (manual) + hashes regen;
dispositions ledger row (BC3 Loop, domain, planning, parity required); registry
+ skill-domain-map + SKILL-TIERS + count-propagation regenerated (73→74).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Salvaged the uncommitted work from wt-ag-ez7y6 and completed the 4->2 beads
skill consolidation the salvaged test asserts:
- Fold the "Issue-Lifecycle Discipline" doctrine (live-reads-authoritative,
scoped-closure-proof, parent-reconciliation, narrow-the-umbrella-issue,
normalize-stale-queue) from the retired `beads` umbrella into beads-br.
- Retire skills/beads --into beads-br via `ao skills retire` (trees removed,
ledger row moved to historical: merged-into beads-br).
- Re-target every retired-skill reference: crank/implement/plan/post-mortem/
refactor frontmatter+deps, SKILL-TIERS rows, docs/SKILLS.md, GLOSSARY link,
sku_catalog LOOP_MOVES[2], image manifests (counts adjusted).
- Codex twin: mirror the doctrine into skills-codex/beads-br, prune `beads` from
the codex catalog/manifest, regen hashes (parity gate age-yxl).
- Add cli/cmd/ao/beads_consolidation_test.go (L2 structural invariants). Uses a
leak-proof repo-root finder (skills/+docs/contracts/) because the shared
findRepoRoot keys on .agents/, which the cmd/ao suite leaks into the pkg dir.
Fixed an ao-skills-retire bug surfaced here: the historical row was appended at
the end of the `workflows:` section (between historical: and dispositions:)
instead of inside historical:. Corrected manually; full fix tracked separately.
Bounded-context: BC3-Loop
Evidence: cli/cmd/ao/beads_consolidation_test.go
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Align br-first tracker truth, RPI terminology, stale architecture surfaces,
new drift gates, gate deferral drain (13→11), and audit artifacts so agents
and operators share one hookless map with mechanical acceptance.
Co-authored-by: Cursor <cursoragent@cursor.com>
skills/converge/SKILL.md is a thin (<=120 line) lazily-loaded memo that points
at the Go 'ao converge' command — NOT a reimplementation (it's a Go CLI, not a
skill). References 'ao converge', carries the two-leg cross-family dispatch table
+ the LAW-0 rule, no shell-loop reimplementation. Disposition row added; full
make regen-all propagated the new skill into registry.json + the generated docs
(SKILLS/GLOSSARY/ARCHITECTURE/context-map/domain-map + 71->72 counts).
Closes-scenario: ag-slice4-skill-thin-memo-1wi5y#S4.1
Bounded-context: BC5-Runtime
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
S1 of the factory-DDD governance epic (follows S0 BC6 foundation,
ag-4akl8). Corrects the mis-binned skills and under-graded loop spine
the skill-DDD audit surfaced. The 6 substrate skills
(ntm/swarm/agent-mail/using-atm/vibing-with-ntm/continuity-loop) were
already moved into BC6 by S0; per the Codex comment on the bead,
codex-exec/agy-native/agy-headless-evidence/account-rotation correctly
STAY in BC5 (executor/credential adapters, not substrate-dispatch).
### Re-bins (domain only; roles unchanged)
- `refactor` BC2 Validation → BC3 Loop — loop-side change execution, not
a validation gate
- `perf` BC2 Validation → BC3 Loop — drives optimization work in-loop,
not a fitness gate
- `cass` BC5 Runtime → BC1 Corpus — mines past-session corpus
(capability_class already `corpus`)
### Role re-grades
- `rpi` supporting → domain — loop-spine per-turn executor
- `evolve` supporting → domain — autonomous improvement main loop
- `converter` generic → driven-adapter — factory packaging adapter to
runtime skill formats; the lone `generic` row is now empty
`hexagonal_role` is mirrored in BOTH the dispositions ledger and the
SKILL.md frontmatter because `generate-skill-domain-map.sh` cross-checks
them.
## Acceptance / TDD
L2 test written red-first then flipped green:
`tests/scripts/skill-rebin-bc6-roles.bats` (8/8 pass). Each scenario in
the bead body carries a `@covered-by:` tag pointing at this test.
## Gates (all green)
- `bats tests/scripts/skill-rebin-bc6-roles.bats` — 8/8
- `bats tests/scripts/validate-skill-disposition-schema.bats` —
regression, pass
- `scripts/generate-skill-domain-map.sh --check` — PASS
- `scripts/validate-context-map-drift.sh` — exit 0
- `scripts/check-bounded-contexts-drift.sh` — PASS (6 BCs, all
non-empty)
- `scripts/regen-all.sh --check` — ALL GATES GREEN
- `cd cli && go build ./... && go vet ./...` — clean; `go test
./internal/gates/...` — ok
## Derived surfaces regenerated + committed
context-map.md, agentops-skill-domain-map.md, registry.json,
skills-codex twins (converter/evolve/rpi + manifest).
Closes-scenario: ag-j3ge0#role-audit
Bounded-context: BC4-Factory
Evidence: docs/contracts/skill-dispositions.yaml
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
S0 foundation slice (v4 additive, no-rename — quorum-ratified). Adds the
artifact-classification fields to every active `- skill:` row + workflows entry
and introduces BC6 Orchestration, without renaming the ledger file, the
`- skill:` row key, or the `domain: "BCn Name"` string format.
- skill-dispositions.yaml: backfill kind/runtime_targets/parity_policy/
capability_class/path/aliases/supersedes on all 71 active rows + 4 workflows;
re-bin the 6 orchestration skills (ntm/swarm/agent-mail/using-atm/
vibing-with-ntm/continuity-loop) into BC6.
- bounded-contexts.yaml: add BC6 Orchestration + OrchestrationPort.
- sku_catalog.py: BC6 enum + cli-command-per-BC carve-out (require >=1 active
artifact per BC; cli coverage only where a BC owns commands).
- generate-registry.sh: emit the new fields (+ derived runtime_reach) and a
first-class `workflows` surface.
- generate-skill-domain-map.sh / check-bounded-contexts-drift.sh: BC-count
sites 5->6; both registry docs carry BC6.
- new gate validate-skill-disposition-schema.sh (+ bats) rejects unknown
kind/capability_class and missing fields, naming the offending row; wired into
regen-all, pre-push-gate, and the Go gate registry.
Renamed-consumer parsers (resolve-skill-path.sh, skills_retire.go, heal.sh) and
the `- skill:` fixtures are byte-untouched.
Closes-scenario: ag-4akl8#backfilled-fields-preserve-the-skill-count
Bounded-context: BC4-Factory
Evidence: docs/contracts/skill-dispositions.yaml
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Freeze a mechanical claim, dispatch a stake-free Fable refuter + a codex exec
read-only refuter in parallel with the full gate, fix findings forward, re-verify
pins on the landed tree. Self-audit: WARN (acceptable v1). Factory tax paid:
codex twin+prompt, manifest/catalog/dispositions/tiers rows, counts 67, regen green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replaces the caam skill (which mis-advised on macOS). One symptom-triggered skill
routes by host: macOS+Claude -> claude-acct (Keychain swap); Codex/Gemini or any
Linux/WSL -> caam (file swap). caam CLI stays; it self-documents via --help.
Includes codex parity. heal-skill --check --strict: clean.
## Summary
- Rename the canonical and Codex `using-ntm` skill to `using-atm`.
- Update inbound references, catalogs, context-map/disposition/domain
docs, and rpi/crank/swarm/council related-skill links.
- Sync Codex generated metadata and preserve the upstream NTM note for
the ATM fork/alias surface.
- Repair post-`cp-z1s5` gate drift exposed by this PR: regenerate
`registry.json`, wire `storage-watchdog-ops` into skill-flow, refresh
context-map/Codex metadata, and remove its stale standalone allowlist
entry.
## Validation
- pre-push fast/head on `95a8e9d35`: 34 checks, 33 pass, 1 warn, 0 fail;
warn: `always.retrieval-manifest-paths`
- full local Go gate: `WORKTREE_DISPOSITION_CI_SKIP=1 /tmp/ao-cp-v8m2
gate check --full --json --workflow-coverage` => 72 total, 71 pass, 1
advisory warn, 0 fail
- `scripts/regen-all.sh --check`
- `bash scripts/validate-skill-flow.sh`
- `bash scripts/validate-skill-schema.sh`
- `bash scripts/validate-codex-generated-artifacts.sh --scope worktree`
- `bash scripts/validate-codex-api-conformance.sh`
- `bash scripts/validate-codex-runtime-sections.sh`
- `bash scripts/validate-codex-override-coverage.sh`
## Notes
- Deployed local Codex/Claude cache proof for `using-atm` was performed
before push.
- Unrelated local dirty files in the original checkout were
intentionally excluded: `skills/cass/scripts/validate.sh`,
`skills/ru-multi-repo-workflow/scripts/validate.sh`, `wt-ag-qidx/`.
- `cp-z1s5` is closed on main at `e0932310d`; this PR carries the small
gate-drift repair required to make that main state validate under PR CI.
Squash merge image consolidation after CI repair.\n\nValidated by GitHub Actions: changes, lint, codex-parity, skills-integrity, skill-gates, contracts-sync, correctness on Ubuntu and Windows, security, eval, skill-eval, doctrine-proof, process-hygiene, and summary. Cursor Bugbot was pending/advisory; main has no branch protection/rules requiring it.
## What
Google is deprecating the **gemini CLI** in favor of **Antigravity
(AGY)**. This migrates the vendor lane: retire the 4 legacy `gemini-*`
skills (built for gemini-cli affordances) and build out the real **AGY
lane**.
## Skills
- **Retired:** `gemini-native`, `gemini-mcp-hooks`,
`gemini-headless-evidence`, `gemini-skills-extensions` (both `skills/`
and `skills-codex/`).
- **AGY lane (4, dual-form):** `agy-native` + `agy-rules-workflows`
(enhanced — folded in the still-relevant intent, added
`/goal`+`/schedule`), `agy-mcp-plugins` + `agy-headless-evidence` (new).
Targeted at AGY's real affordances (Antigravity plugins/MCP/hooks,
agentapi headless, scoped worktrees) — **not** a 1:1 rename of
gemini-cli surface.
## Derived surfaces
Regenerated registry (171 skills), codex catalog/manifest,
skill-domain-map, SKILL-TIERS, context-map, narrative docs. `~/.gemini`
*paths* preserved (AGY's real config root).
## Validation
- Door-9 (no `claude -p`) PASS across all skills.
- `scripts/regen-all.sh --check` → ALL GATES GREEN.
- 0 references to dead `gemini-*` skill names. JSON valid.
## Not in this PR (follow-up: fork-and-own)
Binary-tool AGY support — `caam` (add `agy` tool) and `ntm` (add `--agy`
pane). Auth is already shared via `~/.gemini`; these are launch/spawn
wiring gaps tracked separately.
## What
Adds an **AgentOps-owned, shippable `using-ntm` skill** — the missing
NTM leg of the `NTM + MCP + managed-agents` substrate doctrine
(**ag-zaoj**). Until now `automation-shape-routing` pointed **by name**
at the *proprietary* `ntm`/`vibing-with-ntm` skills, which AgentOps
can't ship — a dangling pointer for standalone users. This is original
content modeled on (not copied from) those.
## The seam: skills are the runtime, not the CLI
The skill teaches driving the open `ntm` CLI as the out-of-session
substrate: **NTM spawns Claude/Codex panes that run the `/rpi` and
`/evolve` *skills*** over a bead queue. It explicitly does **not** use
`ao rpi`/`ao evolve` CLI subprocesses — those terminal wrappers are
retired; the substrate dispatches the whole loop as one invocable skill.
## What lands (15 files, +~440)
- `skills/using-ntm/SKILL.md` + `skills-codex/using-ntm/SKILL.md` (twin)
— the new skill.
- `automation-shape-routing` (+ codex twin) — dangling
`ntm`/`vibing-with-ntm` pointers now route to the owned `/using-ntm`;
`ntm` stays as the CLI tool.
- Six derived surfaces regenerated: `registry.json`, skill-domain-map,
SKU catalog, codex hashes/manifest, context-map; + skill-disposition row
and skill-count bumps (80 → 81) in PRODUCT / ARCHITECTURE / SKILLS /
domain-map / BDD-Gherkin.
## E2E verification (against the real `ntm` CLI)
Per the directive (no `ao rpi`/`ao evolve`): verified every `ntm`
subcommand the skill cites exists
(`spawn/send/activity/attach/doctor/deps/kill/health`) and **fixed the
documented flag to the real `--pane=N` syntax** (it had `--pane N`).
`ntm doctor` runs (bv ✓ / bd ✓ / am ⚠). `docs/cli-surface.*` drift
excluded (pre-existing, unrelated).
## Follow-up (not in this PR)
`ao rpi`/`ao evolve` CLI are slated for retirement; `docs/3.0.md` + the
recent Gas City-prune PRs still reference `ao rpi <bead>` as the
dispatch unit and need a skills-not-CLI reconciliation pass.
## Verification
- `regen-all.sh --check` ALL GREEN · registry-drift PASS · codex parity
PASS · skill-isolation/size PASS · markdownlint 0.
Closes-scenario: ag-zaoj#using-ntm-skill
Bounded-context: BC4-Factory
Evidence: skills/using-ntm/SKILL.md
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Bo