## Summary
- pin and materialize an exact colocated Gas City and official Beads
toolchain without editing installed binaries
- add deterministic isolated bootstrap, recovery, teardown, exact
workspace binding, and tracked .gitignore preservation
- add bead-native Mayor, plan review, isolated Codex/Claude workers,
binding Validators, rejection-to-Mayor rescope, fenced Refinery,
integration validation, qualification, and protected PR delivery
- make the local quick release gate deterministic after CLI cleanup
## Validation
- fresh GC-managed Codex Sol verdict: PASS (verdict
d1a1e03808b4605e49cc97423c7570b04d581c9ee1fad9aa8f1daf6e72d6f0ef)
- focused GC executor/factory/projection suite: PASS (32 packet + 77
factory + 4 projection + 21 bootstrap tests, plus doctors and static
contracts)
- teardown suite: 7/7 PASS
- local-ci-fast: PASS
- exact v16 mixed-provider live canary: Terra and Opus 4.8 workers in
parallel, opposite-family candidate validators, Opus Refiner, Sol
integration validator, all lifecycle beads closed, clean managed
teardown
## Scope
The follow-on Fable 5 Mayor/Refiner, Sol-every-bead validation, and Luna
support-worker topology is deliberately not part of this historical v16
baseline; it will build on this foundation in a separate bead program.
## Doctrine flip: enforcement hooks on by default
Operator directive: hooks reach **every** user regardless of install
path. Injection hooks stay dead (#511, delta=0) — the
hookless-cold-start gate is untouched and passing.
### Delivery per install path
| Path | Delivery |
|---|---|
| Claude Code plugin (marketplace) | **Automatic** — new
`hooks/hooks.json` at plugin root; Claude wires the policy dispatcher on
install (`${CLAUDE_PLUGIN_ROOT}` paths, 10s timeout, Bash + Edit\|Write)
|
| npx skills / skills.sh copies | Skill package now carries its own
installer: `skills/cc-hooks/scripts/install-hooks.sh` (resolves
everything relative to the skill dir; works with no repo present) |
| git clone / brew | `scripts/install-policy-dispatch.sh` → thin
delegator to the skill-embedded installer |
### Also in this PR
- 4th registry policy `core.skills:edit-installed-copy` (Edit|Write,
`file_path`-only) — registry twin of the standalone guard, so dispatcher
users get the full protection set.
- Dispatcher hardening: malformed stdin now fully silent (fail-open,
zero stderr) — validator security-pass finding.
- README admission-control section; cc-hooks SKILL.md posture flip
(description, constraints, delivery table).
- Codex twin force-synced (incl. the new installer file), skill mesh +
catalog regenerated.
### Evidence
- 28/28 policy-dispatch bats (incl. plugin-layout registry-fallback
test); 16/16 on the injection-doctrine + standalone-guard suites.
- `ao gate check`: 28 pass / 0 fail on the exact subject.
- Fresh-context validation: first round returned FAIL (uncommitted regen
outputs + a stderr leak on malformed stdin) — repaired, amended,
re-validation in flight; merge follows a PASS verdict.
- Adversarial security pass on the dispatcher (it auto-activates for
plugin users): empty/malformed/1MB stdin, invalid registry, concurrent
fires — all fail-open, silent, correct.
Epic: age-4qw1 (H1/H2 landed previously as 0eaf21f0c). Out of scope:
Codex-plugin hook parity (follow-up on the epic).
Registers the fully-built-but-never-wired eval module into the CLI spine
and repairs its one real instrument bug. Three commits, RPI-shaped: wire
+ fix, drift guards + docs, fixture counts.
## What
- **`ao eval` joins the spine** (cmd/ao/eval_composition.go):
deterministic suite runs, run-record
compare/baseline/scorecard/coverage, locked Tasks, holdout scenarios,
suite A/B verdicts with power-derived n-required, and the holdout-safe
Outcomes projection. This is the operating contract's *Learn* seat — a
read/measure consumer of evidence. It reports numbers and owns no retry,
scheduling, promotion, or lifecycle authority. The retired Aliases/Bench
seats stay nil and their subcommands are omitted.
- **Instrument bug fixed**: both scenario-ab arms were corpus-denied at
runtime — the with-gold treatment was only a prompt injection through
the retired `ao lookup`, so the A/B silently guaranteed a zero delta.
Treatment is now environment-shaped: the with-gold arm runs with the
corpus readable, the control arm stays sandbox-confined (the fail-closed
empty-deny guard is untouched), and judges are always corpus-denied.
- **Schema drift guards**: a run record persisted by the production
writer must validate against eval-run.v1.schema.json (and the minimal
suite against eval-suite.v1.schema.json) — closing the same silent-fork
class the verdict.v2 golden corpus closed.
- **Hermetic test builds hardened**: keep the real HOME's Go caches
(TestMain isolation was forcing module re-downloads) and skip VCS
stamping.
- docs/architecture/go-cli.md gains the eval section; MIGRATION.md notes
`ao eval`'s return; COMMANDS.md, cli-surface, and surface counts
regenerated; new leaves carry honest allowlist reasons; new cmd/ao L2
tests drive eval run/compare/help through the full production wiring.
## Evidence
- Full cli suite 2,801 green; race green on cmd/ao + the eval island;
vet clean
- Full-tier gate: 65/66 on the penultimate commit; the single failure
(surface counts) is the final fixture commit, re-verified PASS
standalone — no other check reads those fixtures
- Fresh independent validation (Codex, frozen subject 86022a3c6, clean
tree at start and end): **OVERALL PASS**, 6/6 — including a live
end-to-end `ao eval run` producing a passing run record
- Rubric-relocation decision honored: true holdout rubrics live in the
external measurement register; the repo keeps only leak-guarded
projections
## Summary
- add a bead-native Gas City factory pack with Mayor, fresh plan review,
Codex/Claude Worker and Validator pools, and a fenced Refiner
- make the bead graph the sole work/lifecycle authority; JSON artifacts
are digest-bound evidence only
- isolate each experiment in its own branch, worktree, Git index, and
lease, then admit exact PASSed candidates to Refinery
- make lease, verdict, rejection, successor, assembly, reassembly, PR
landing, and partial closure transitions crash-replayable
- enforce fresh-worker rescope after FAIL/NOT_PROVEN and an atomic
max-attempt HOLD
- encode the operating contract, live canary, role archaeology, and Bun
Rust-port lessons in AgentOps docs
## Validation
- live GC canary: Claude Worker -> Codex Validator -> Claude integration
Validator -> Codex Refiner -> PR #916 -> landed
`b80a752aad3843af66160b08a823aaed57e07169`
- `./scripts/check-gc-executor.sh`: 20 packet tests, 29 factory tests, 4
projection tests, and 8 bootstrap Bats tests PASS
- both GC packs lint PASS
- Ruff, ShellCheck, Python compile, and generated projection checks PASS
- branch-built `ao gate check --fast`: 13/13 PASS
- branch-built `ao gate check --full`: 66/66 PASS
- independent fresh-context audit of exact head
`1b18cf663ece790a12cd840f6eed2856852c552f`: PASS
## Contract
The unit of work is the bead. The pack defines roles, prompts, commands,
and policy; it does not own a parallel pack/JSON lifecycle. A rejected
experiment must be terminal and closed before any Mayor rescope or
successor reduction can proceed.
## Summary
Closes the findings from the v3.3.0 release-viability audit of main.
**Surface truth (High):** `ao constraint`, `ao goals trace`, `ao session
memory`, and `ao skills edit` are production tombstones but
docs/cli-surface.md documented them as `public-tested`/`covered` (the
test binary keeps constraint live, and the generated doc reflected the
test build). Added `deprecated` allowlist rows, dropped the stale
constraint-subcommand rows, regrouped constraint with its tombstone
peers in the default spine, regenerated both surface projections, and
added `TestCathedralCutTombstonesSurvivePruning` pinning the invariant
that every Cathedral Cut verb keeps an executable tombstone.
**Installer hardening (Medium):** `install-bd.sh` now fails closed when
no published checksum exists for a release asset (explicit `--no-verify`
overrides), and the curl|bash path verifies the fetched
`installer-common.sh` against a pinned SHA-256 before sourcing it
(drift-guarded by a new install-bd.bats test).
**Docs (Medium/Low):** UPGRADING.md no longer links the MIGRATION-3.0.md
file the Cathedral Cut deleted; CHANGELOG 3.3.0 `### Removed` now names
`yield`, `constraint`, and the 3.2 `verify` front door and links the
MIGRATION.md map.
**Gate scripts (Low):** flywheel/provenance gate scripts build `ao` into
`mktemp -d` scratch dirs instead of fixed world-known /tmp paths
(symlink/TOCTOU on shared hosts).
**Bonus (surfaced by the push gate):** `scripts/lib/preamble.sh`
mis-resolved REPO_ROOT under git hook env (GIT_DIR without
GIT_WORK_TREE), which made `go.cli-architecture` refuse every
worktree-origin push touching `cli/cmd/ao/**`. Fixed by scrubbing the
hook-injected discovery env around the rev-parse.
## Validation
- `go build && go vet && go test ./...`: 5,085 tests green,
golangci-lint clean
- `ao gate check --fast`: 27/27 pass, including under simulated hook env
- bats install-bd suite 6/6 incl. new pin drift test; shellcheck clean
on all touched scripts
- markdownlint clean; doc-release gate passes; tombstone exit codes
verified on the built binary
## Summary
- replace removed nightly retrieval commands with the maintained smoke
fixture and focused retrieval coverage
- repair Windows smoke, workflow/actionlint, skill projections,
installer fixtures, and stale Cathedral Cut tests
- refactor verdict validation below the complexity budget while
preserving its error contract
- incorporate the pending cross-runtime hook projection already
represented in the repository manifest
## Validation
- `go test -race -shuffle=on ./...`
- full Bats suite: 874/874 passed
- `scripts/ci-local-release.sh --quick`
- `ao gate check --full --json --workflow-coverage
--require-workflow-parity`: 65/65
- `ao gate check --fast --json`: 43/43
This PR repairs the common causes represented by open nightly issues
#900, #901, #903, #909, #910, and #912. Those issues will be closed only
after the corresponding workflows pass on `main`.
---------
Co-authored-by: boshu <241868352+boshu2@users.noreply.github.com>
Co-authored-by: Test <test@test.com>
The project config (tracker pin) moved from .agentops/config.yaml into
.agents/ao/config.yaml; the no-tracked-agents gate now permits exactly that
one file and still rejects any other tracked or staged .agents state and any
broader gitignore re-include.
Co-authored-by: Cursor <cursoragent@cursor.com>
One canonical root for skill create/heal/audit. Mode routing table absorbs
all heal-skill triggers; every live consumer (gates seed, quality checks,
release scripts, bats, docs, catalogs, parity twins) updated to relocated
paths; all projections regenerated via owning commands.
Validated fresh: verdict PASS (e9b6cdb8), intent 26a4f2be, all five
acceptance scenarios re-executed by an independent context.
Co-authored-by: Cursor <cursoragent@cursor.com>
Retire the 3.x plugin curl/PowerShell installers as tombstones, delete the
plugin-cache helpers, and rewire CI/doctor/conformance onto the canonical
checkout + ao skills link path. Keep install-bd and the opt-in operator scripts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Migrate SYSTEM and AGENTS-{WORKFLOW,CI,CODEX,RUNTIME} into docs owners,
retarget consumers, rewrite the split gate, and craft-densify AGENTS,
README, PRODUCT, and GOALS under the documentation authority graph.
Co-authored-by: Cursor <cursoragent@cursor.com>
## Why
Every PR since #906 has run red on the same 5 checks (correctness
ubuntu+windows, go-gate-shadow, security, summary) — #906 and #907 both
merged with identical red sets. A permanently-red backstop is worse than
none: a real regression is invisible in the noise. This PR fixes every
class and makes green the expected state again.
## What (three commits)
**Wave 1 — the four red check classes** (each verified by running the CI
job's own command):
- **correctness/bats (138 CI-only failures, ~6 env mismatches)**: pawl
verdict-edge fail-closed fires without a trusted `ao` on PATH →
`PAWL_EDGE_FAIL_OPEN=1` on the bats step (the 3 fail-closed regression
suites opt back out); gtimeout probe crashing setup() on Linux; gawk \\"
bracket-expression warning corrupting jq assertions; ripgrep missing on
runners; teardown/skip-path exit codes; taxonomy fixture missing the
now-required observations field.
- **go-gate-shadow (8 full-gate failures → 0)**: #906 landed without a
heal/regen pass — pre/post-mortem pointer skills missing
`hexagonal_role`; codex twins/hashes drift; shrink-only grandfather
lists; evolve SKILL.md referencing 3 deleted scripts;
@covered-by/allowlist conflicts; 3 go.lint findings.
- **security (BLOCKED_HIGH → PASS)**: 3 false positives suppressed
per-finding with justification (gosec G122 on the dev-time arch checker;
2 semgrep mis-traces).
- **correctness/windows**: tests set HOME but Go os.UserHomeDir() reads
USERPROFILE on Windows → cross-platform setHome helper.
**Wave 2 — 18 residual bats failures across 13 files**, each first
proven identical on pristine origin/main (differential run) before
fixing. Content drift (README golden-path literal, discovery references,
bootstrap↔install-bd wiring, pawl-review reachability via council, rpi
helper-rung tokens), validator regressions (validate-codex-rpi-contract
resolver routing, em-loop labels, goal-design fixture), and stale tests
updated only where provably behind a deliberate change (catalog
schema_version pin 1→2, SHA-pinned action regex, retired perf scenario,
drained dangler pin 2→0, tagged-ao test build).
**Commit 3**: the `ao skills unlink` train that landed on main mid-work
re-reddened security with the same semgrep value-struct FP — suppressed
like its skills_link sibling.
## Verification (rebased onto current main tip)
- `ao gate check --full`: **92/93 pass, 0 fail** (1 expected AP7 skip)
- `security-gate.sh --mode quick`: **PASS**
- `go vet` clean; **11,878 Go tests green** (149 packages)
- All 13 wave-2 bats suites **0 not-ok**; CI-sim (no-ao PATH) bats clean
on wave-1 suites
- Windows fix verified via GOOS=windows build+vet (needs the
windows-latest job for final confirmation)
**Acceptance: this PR's own validate.yml run going green.**
Bead: age-htrqp
---------
Co-authored-by: boshu <241868352+boshu2@users.noreply.github.com>
The integration net (FU1 capstone) over the five fresh-install staleness
classes fixed by sibling beads. Consumes the product the way a new user
receives it — clean HOME, fresh non-agentops git project, ao binary, offline
Codex bundle — and exercises first-run so the class cannot regrow:
- scripts/fresh-install-conformance.sh: build/acquire ao (tree default,
--release-tarball mode for the published binary, loud SKIP offline), install
the Codex bundle offline (AGENTOPS_BUNDLE_ROOT), then assert against the REAL
binary output: every quick-start-advertised `ao` command resolves against the
capability contract (extends #907's cobra-tree guard to the integration
level), every /skill mention exists in the installed bundle or repo skills/,
pristine-install `ao doctor` exits 0 with no warnings and names no
repo-relative script fix, and installer skill counts agree
(disk==meta==package_count==printed, the 66-vs-62 class). PASS/FAIL per
assertion + summary table; nonzero exit on any FAIL.
- .github/workflows/fresh-install-conformance.yml: tree-conformance
(ubuntu+macos) on push-to-main paths-filtered + nightly + dispatch;
release-conformance against the published asset on release/dispatch.
- tests/scripts/fresh-install-conformance.bats: proves the harness actually
catches a missing advertised command and a repo-relative doctor fix, passes
on a consistent binary, and loud-SKIPs offline — all offline via a fake ao.
Adopts scripts/lib/preamble.sh; relaxes set -e for record-and-continue.
shellcheck -S warning clean.
Ban CLAIMS of proven/automatic knowledge compounding (unproven — ADR-0004,
ADR-0011) and hookless-3.0-violating 'session hooks' language (docs/3.0.md,
ADR-0009) from user-facing CLI strings + seed/template assets. The claims kept
regrowing (#907, FU4 diet commit) because nothing gated them.
- docs/contracts/forbidden-claims.yaml: seeded lexicon (regex + rationale +
allowed_contexts). Tight patterns require an automatic/every-session qualifier
so the conditional escape-velocity model and the 'flywheel' subsystem name are
NOT banned; the honest 'whether the corpus compounds is unproven' never matches.
- scripts/check-honest-voice.sh: scans cli/cmd + cli/internal Go (excl. *_test.go)
+ seed/template assets; honest-voice:allow suppression; exit 1 naming
phrase+file+line+rationale. Registered contract.honest-voice in the Go gate
registry (Fast|Full, blocking) routed on cli/**, the lexicon, and self-ref.
- cli/cmd/ao/seed.go: sweep — rewrote the stale 'ao init --hooks / session hooks /
knowledge compounds automatically' next-steps + decision-record template to
honest hookless phrasing.
- tests/scripts/check-honest-voice.bats: proves fail on a seeded phrase, pass on
the current tree, suppression, test-file exclusion, and the flywheel/conditional
false-positive guard.
Installers now prove their claims before printing success: the installed
skill directory count, the manifest count `ao doctor` reads, and the
recorded metadata skill_count must all agree, the config-enable entry
must be present, and a sentinel skill must be readable. On any mismatch
the installer exits nonzero naming the delta instead of declaring
victory over a broken state.
Root cause of the audit's "install metadata says 66 skills but manifest
says 62": install-codex-plugin.sh counted on-disk SKILL.md directories
(66) and wrote that into install metadata, while `ao doctor`
(ReadCodexManifestSkillCount) reads the manifest's package_count and
falls back to len(skills[]) = 62 (implementation rows only) when
package_count is absent/stale. The two numbers came from independent
sources with nothing reconciling them. The new self-test computes the
count doctor will use (package_count, else len(skills[])) and refuses to
report success unless disk == manifest == metadata — closing the gap at
the true source rather than papering over it.
- install-codex-plugin.sh: manifest_doctor_count() mirrors doctor;
selftest_codex_plugin() enforces the three-way count identity + config
+ sentinel; success line -> "Verify it worked: restart Codex, /plan".
- install-opencode.sh: AGENTOPS_BUNDLE_ROOT local-source mode (offline);
self-test on linked-vs-source count + plugin link + sentinel.
- install.sh: AGENTOPS_BUNDLE_ROOT local-source mode; orchestrator
self-test tail; fix empty-array expansion under set -u on bash 3.2
(reachable now that local-source mode runs this path offline).
- install-agy.sh: self-test on plugin registration + sentinel skill.
- tests/scripts/installer-selftest.bats: offline coverage incl. the
seeded 66-vs-62 stale-manifest fixture that must fail, and a legacy
no-package_count-but-consistent manifest that must pass (doctor parity).
.ps1 parity (install-codex.ps1/install-ao.ps1) deferred: same latent
divergence exists but no pwsh on the dev host to verify; shipping
untested Windows installer code would undercut the first-run-trust goal.
Remove the vestigial in-repo homebrew-tap/Formula/agentops.rb (frozen at
version 2.31.0 + license MIT while the repo is 3.2.0 / Apache-2.0); the live
tap is generated by GoReleaser into boshu2/homebrew-agentops. Replace the tap
README with a pointer that documents this and forbids re-adding a formula.
Make the .goreleaser.yml archive files: list explicit (README.md, LICENSE,
CHANGELOG.md) so the packed README always matches the tagged commit rather than
relying on GoReleaser defaults.
Add scripts/check-release-parity.sh: asserts (a) tarball README sha256 == repo
README, (b) any in-repo formula license == LICENSE (Apache-2.0), (c) any in-repo
formula version == release tag. Wired into .github/workflows/release.yml as a
post-build gate over each dist/ tarball. Fixture-based bats coverage in
tests/scripts/check-release-parity.bats (red on stale README / wrong license /
stale version, green on parity).
THE ADVISORY WINDOW DID EXACTLY ITS JOB, and the answer is NOT the one the bead expected.
Measured over the 261 local verdicts whose head_sha is a live commit: 26 PASS, **199 FLOOR-fail
(76%)**, 36 fail for unrelated (stale/missing) reasons. The FLOOR failures include verdicts from
unambiguously SUBSTANTIVE reviews — codex caught 3 real defects in this session and those verdicts
still fail the floor.
ROOT CAUSE: pawl_evidence_floor demands a `file:line` finding OR a reviewed-scope attestation. But a
CONFIRMED review has, by definition, NO DEFECT TO CITE — a clean review legitimately reads "no
blocking defects". The floor CONFLATES "no defects found" with "no review performed", so every clean
CONFIRM from codex/agy fails it. Right idea, wrong signal.
CONSEQUENCE: FLOOR_ENFORCE_AFTER=2026-07-16 was FIVE DAYS AWAY and would have started HOLDing ~76%
of real reviews on a CALENDAR TRIGGER with nobody watching — silently breaking the membrane.
THIS COMMIT DEFUSES THE CLOCK ONLY (the minimal, safe, time-critical fix): the date is pushed to a
deliberately distant 2027-01-01 so no calendar event can auto-enforce a floor with a measured 76%
false-positive rate. The floor still MEASURES and WARNs (unchanged), and PAWL_FLOOR_ENFORCE=1 still
forces enforcement for tests/opt-in operators — enforcement is now an EXPLICIT, evidence-gated
decision instead of a silent clock event.
FIXING THE SIGNAL stays on .10: a clean CONFIRM must be provable-substantive WITHOUT a defect
citation, which means changing the REVIEWER PROMPT + verdict writer (emit an explicit reviewed-scope
attestation every time), then re-measuring, then flipping deliberately.
Tests: the floor suite is green (it pins behavior via the env override, clock-independent) + a new
regression pinning that the date cannot auto-fire in the near term.
Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
F13 item 2. cod_dead/agy_dead treated an unreadable `pane_current_command` as ALIVE, so a pane that
was actually GONE was only caught minutes later by the engage deadline. Two shapes now route into
the new bounded _pane_gone re-probe:
- an EMPTY read; and
- a FAILED read — a VANISHED pane makes display-message exit NON-ZERO, and the old
`cmd="$(...)" || return 1` short-circuited straight to ALIVE, so the very case this bead targets
never reached the re-probe at all (caught by a cross-family codex refute; test 4 pins it).
_pane_gone declares death only when BOTH hold: the second read is also unreadable AND the pane
produced NO scrollback change across the probe (a producing pane is alive whatever the read says). A
real foreground command on the re-probe keeps it alive. The conservative bias is preserved for the
genuinely uncertain case; an actually-gone pane now hits the existing respawn path in seconds.
PAWL_PANE_REPROBE_SLEEP tunes the pause (default 2s).
Tests: pawl-pane-reprobe.bats (4): DEAD on two unreadable reads + no activity; ALIVE on a real
re-probe command; ALIVE while still producing output; and the codex-refuted FAILING-first-read case
now correctly reporting DEAD.
Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
The refactor's features have unit bats; this suite proves they COMPOSE end-to-end and pins the
precedence between them, plus the audit's fabricated-verdict guard:
1. REQUIRE-WARM HOLD (F1) — service down + up fails + PAWL_REQUIRE_SERVICE=1 -> exit 5, the
cold reviewer NEVER spawns (asserted by an absent spawn-marker), no verdict written.
2. EDGE-UNBOUND + RECOVERY (F2) — a CONFIRMED review whose emit fails -> exit 6, the verdict file
SURVIVES, and the PRINTED recovery command genuinely binds the edge when re-run against a
working ao (the full recovery loop, not just the error path).
3. COMPOSITION PRECEDENCE — knob set AND emit would fail: the EARLIER gate wins (HOLD at exit 5;
the exit-6 path is never reached, no cold spawn, no verdict).
4. FABRICATED-VERDICT GUARD — a verdict records ONLY panes that actually voted; no fabricated
`*-timeout` refuter for a pane that produced nothing (pins the audit-verified guard).
Each case tees its transcript to a named artifact under the bats tmpdir so a CI failure is
diagnosable from output alone. Portable (no GNU-only tools; macOS bats). 4/4 green.
Case 3 of the original spec (embedded-bundle staleness WARNING) moved to .19 with the Go
trust-aware comparison — the shell layer cannot safely read $ROOT/scripts on the stranger path.
Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
F7-followup: benching was an invisible ambient env footgun (PAWL_BENCHED_FAMILIES="${VAR-agy}" —
exporting it empty silently un-benched everything, and nothing showed the effective set). Now it is
a persisted, visible state: `ao pawl bench <cc|cod|agy>` / `unbench <fam>` write
.agents/pawl/config.json (symlink-guarded, atomic, jq-backed), bare `bench` lists the effective set
+ source. Resolution precedence: env (set, even empty) wins as a one-shot override → persisted
config → the "agy" default; `ao pawl doctor` now prints the effective benched set AND its source
(default|config|env). `unbench` with no arg gives a clean usage line + exit 2 (no bash ${N:?} trace).
Tests: pawl-bench-verb.bats (config round-trip, source: config vs env, unknown-family reject,
clean usage). Existing pawl.sh-sourcing + swarm-bin suites green.
Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
Bo